Apple Doesn’t Care about Security

While thousands of Apple customers suffer from a serious malware outbreak, the company answers to the problem by trying to close down the security company which warned of the attack.
Over 500,000 Macs are already infected with Flashback malware because Apple failed to update some Java software. Nevertheless, the situation has revealed just how useless the company is when it comes to such problems. Surprisingly enough, the first action of Apple was not to update the Java software, but to take down the server of the Russian security company that revealed the problem to the world.

Boris Sharov, CEO of the Russian-based security company called Dr. Web, confirmed that this week the Russian Web registrar Reggi.ru was demanded by Apple to shut down one of its domains. For some reason, Apple believed that the site in question was being used as a “command and control” server, without bothering to take a look at the site owner. Therefore, Apple still hasn’t realized that the domain was one of those which Dr. Web has been using as a spoofed command and control server working as a “sinkhole”.

It seems that Apple didn’t have much experience in dealing with the real world outside. According to Boris Sharov, Apple simply had no idea how to work in a team when tackling security, but rather believed that it could order servers switched off and its problems would fade away.
Dr. Web explained that Apple claimed to the registrar that its domain was involved in a malicious scheme, though the security company wasn’t controlling the sink-hole or harming users. When the security outfit first contacted Apple to let the company know about the Mac-based botnet, Apple never replied. The security outfit has provided the giant with all the data it had, but was responded with a demand that its monitoring server be taken offline.

Meanwhile, locating and closing down command and control servers is a common practice for the outfits trying to cripple a botnet. Dr. Web confirmed it has worked with Microsoft on those efforts. However, Apple won’t even tell anyone about its antivirus group, if it has one at all. And it still insists that its software can’t be infected! Dr. Web slammed the company for its delay in issuing a patch for security vulnerability in Java which allowed the malware to exist. 

Android Can Be Hacked through SMS

Security experts from NQ Mobile have recently detected new Android malware which is controlled through SMS messages. The malware, dubbed TigerBot, is able to record calls and surrounding noise.
TigerBot was detected while circulating in the wild through non-official Android channels.
The malware is wise: it can hide itself on a targeted device. TigerBot refuses to install an icon on the home screen, and masks itself with an ordinary application name like Flash or System.

Once active, TigerBot registers a receiver marked as a high priority in order to listen to the intent with action “android.provider.Telephony.SMS_RECEIVED”.

NQ Mobile explained that when a user receives a new SMS message, the malware would run a check to find out whether the message is a specific bot command. In the event it is TigerBot will prevent it from being seen by the user, after which it will execute the command.

The malware is able to record sounds in the immediate area of the device, along with the calls themselves. It is also able to alter network settings and report the current GPS coordinates of the device. TigerBot was proved to manage capturing and uploading pictures, killing other processes and rebooting the infected device.

However, the malware isn’t written perfectly enough. For instance, some of its commands aren’t routinely supported: the command to kill other processes can only be performed on early Android versions. Still, the mobile security company points out that the fact that this piece of malware and any of its variants might be controlled without your knowledge does mean that it is a serious threat. The insecurity specialists added that users are recommended to always reject unknown application requests and attentively monitor permissions requested by any program.