Use dating apps? Here's a warning for you

-

Earlier this week, Google announced that it took down over 700,000 bad Android apps during the year 2017. The number is 70% more than the apps taken down in the year 2016. Malicious apps on Google Play store have been a long-time concern and pose huge risk to Android smartphone users. Recently, cybersecurity software company Check Point too listed 22 flashlight and utility apps on Google Play Store that fooled people into believing that they were useful apps. Dubbed as LightsOut, the apps have been downloaded between 1.5 million to 7.5 million times. To trick people, hackers gave the apps names like WiFi Password Pro, Super Flashlight Lite, Voice Recorder Pro, and Brightest LED Flashlight-Pro. According to Checkpoint, once downloaded, the apps' scripts overrides the user’s decision to disable ads showing outside of a legitimate context, and then, in many of the apps, hides its icon to hinder efforts to remove it. said Check Point in its research. Here are the 22 malicious apps listed by Check Point: Note: Check Point notified Google about these malicious apps, and the company claims to have removed them from the Google Play store.
Earlier this week, Google announced that it took down over 700,000 bad Android apps during the year 2017. The ... Read More

Dating apps users, here's a warning for you. While analyzing popular dating apps, researchers at security firm Kaspersky Lab have found that some apps transmit unencrypted user data over insecure HTTP protocol thus risking user data exposure. This is because some apps use third party, ready-to-go advertising Software Development Kits (SDKs), which are part of a number of the most popular advertising networks.

The apps involved include some with several billion installations worldwide, and a serious security flaw means private data can be intercepted, modified and used in further attacks, leaving many users defenseless.

An SDK is a set of development tools, often distributed free of charge, which allows software authors to focus on the main elements of the application, while entrusting other features to ready-to-go SDKs. Developers often use third party code to save time by reusing existing functionality to create part of the application. For instance, advertising SDKs collect user data in order to show relevant ads, thus helping developers monetize their product. The kits send user data to the domains of popular advertising networks for more targeted ad displaying.

However, deeper analysis of apps has shown that data is sent unencrypted, and over HTTP, which means it is unprotected when it travels to the servers. Due to the absence of encryption, data can be intercepted by anyone via unprotected Wi-Fi, Internet Service Providers or malware on a home router. In addition, the intercepted data can be modified, meaning the application will show malicious ads instead of legitimate ones. Users will then be enticed to download a promoted application, which will turn out to be malware, putting them at risk.

Researchers have examined logs and network traffic of apps in the internal Android Sandbox to uncover which apps transmit unencrypted user data to the networks over HTTP. They identified a number of major domains, most of them part of popular advertising networks. The number of apps using these SDKs go into several million, with most of them transmitting at least one of the following pieces of data in an unencrypted way:


Personal information, mostly in the form of the user’s name, age and gender. It may even include the user’s income. Their phone number and email address could leak too, as people share a lot of personal information in dating apps, according to a Kaspersky Lab findings. Other vulnerable information includes device information, such as the manufacturer, model, screen resolution, system version and app name; and device location.
VESIT PER DAY FOR MORE UPDATE

Comments

Post a Comment

Popular posts from this blog

wifi-pumkin create a wrog access point

-
Image
Now that we’ve learnt about social engineering , let’s put our new knowledge to work. In this tutorial, we’ll create a phishing page that’ll be served from a rogue Wi-Fi access point. If a victim then enters their details in this page, they will be delivered directly to you. We’re going to be using WiFi-Pumpkin and Kali (You can also use ParrotSec or even plain Ubuntu). We’ll also need an external Wi-Fi adapter. Why is that? Say you’re trying to set up this phishing page in a McDonald’s or a Starbucks. Your laptop’s internal network controller will be connected to McDonald’s Wi-Fi and your external Wi-Fi adapter will be turned into a rogue access point. The external adapter will be our man in the middle and will actually serve the phishing page into which our victim’s can then enter their details. (I strongly recommend the WN722N . It’s small and powerful, practically tailor-made for hacking and it supports every kind of WiFi attack that we’ll learn about in the next...
Read more

How to Find Your First Web Development Client (or Become a FREELANCER)

-
Image
How to Find Your First Web Development Client (or Become a FREELANCER) Just because you have the skill doesn’t mean people will just fork over money to you. You need to do a little bit of work and sell yourself. You also need to put yourself in the right places to get opportunities. Now, as a web developer you have two choices. You can 1) try to land a full-time, on-site job with a company or 2) go the route of freelancing, and look for online gigs. I recommend freelancing. While it doesn’t afford the same guaranteed paycheck that a full-time job does, there are 3 huge benefits: Freedom:  No more clocking in and clocking out. You might still work the same hours (or more), but your schedule, location, and living circumstances are completely up to you. (Plus, no commuting, which saves your hours of time every week.) Money:  Once you become a good freelancer, you’ll have a better shot at making more money (than waiting for a measly 3% raise each year). Prestige:...
Read more

Get Anyone's Wi-Fi Password Without Cracking Using Wifiphisher

-
Image
Do you need to get a Wi-Fi password but don't have the time to  crack it ? In previous tutorials, I have shown how to crack  WEP ,  WPA2 , and  WPS , but some people have complained that cracking WPA2 takes too long and that not all access points have WPS enabled (even though quite a few do). To help out in these situations, I present to you an almost surefire way to get a Wi-Fi password without cracking— Wifiphisher . Steps in the Wifiphisher Strategy The idea here is to create an  evil twin AP , then de-authenticate or DoS the user from their real AP. When they re-authenticate to your fake AP with the same SSID, they will see a legitimate-looking webpage that requests their password because of a "firmware upgrade." When they provide their password, you capture it and then allow them to use the evil twin as their AP, so they don't suspect a thing. Brilliant! To sum up, Wifiphisher takes the following steps: De-authenticate the user from their legiti...
Read more