ICT Security-Sécurité PC et Internet

Des chercheurs de Check Point ont identifié de nouvelles vulnérabilités dans les dispositifs Android. Certifi-gate permet à des hackers de prendre le contrôle d'un appareil.
«Certifi-gate», tel est le nom donné à un vulnérabilité découverte par des chercheurs de Check Point  au sein du système d'exploitation Android. Elle permet à des applications pour offrir aux pirates un accès sans restriction à l'appareil et ainsi, selon Check Point, «dérober des données personnelles, localiser les appareils, activer le microphone pour enregistrer des conversations, et plus encore».

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Certifi-gate

http://www.scoop.it/t/securite-pc-et-internet/?tag=Android

Noch bevor die Sicherheitslücken offiziell auf der Hackerkonferenz vorgestellt wurden kursiert eine Anleitung zum Bau eines Proof-of-Concept im Netz. Ferner soll ein russisches Unternehmen bereits einen Exploit verkaufen.

Die Einschläge kommen näher: Ein chinesisches Blog hat weitere Details zu einer der kritischen Stagefright-Lücken in Android veröffentlicht – darunter auch erste Schritte zum Bau eines Exploits. Wenige Änderungen an einer beliebigen MP4-Videodatei reichen aus, um mit ihr Androids Multimedia-Framework Stagefright zum Absturz zu bringen. Dies konnte heise Security nachvollziehen. Es kommt zu einem Heap Overflow, den ein Angreifer zum Ausführen von Schadcode missbrauchen kann. Bleibende Schäden kann eine nach der Anleitung präparierte Datei jedoch nicht anrichten.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Stagefright

Millions of Android smartphones and tablets are at risk of being attacked via the Heartbleed bug, more than a week after the security vulnerability was first made public.

So, the obvious question you should be considering is, are you running Jellybean 4.1.1 on your Android devices?

Here’s how you can check:

• Enter System settings
• Scroll the screen down to About
• Look for your Android version number

read more in the article...

Learn more:

• http://www.scoop.it/t/securite-pc-et-internet/?tag=Heartbleed

The vulnerability could allow attackers to intercept traffic from Android devices despite an active VPN connection

A vulnerability in Android allows malicious applications to bypass an active VPN (virtual private network) connection and force traffic from the device through an attacker-controlled system where it can be intercepted, according to security researchers from Ben-Gurion University of the Negev in Israel.

These days, the 2013 edition of the DefCamp security conference is taking place in Bucharest. There have been a lot of interesting presentations so fa...

Alecu has found a vulnerability in Google devices that can be exploited to cause them to reboot.

The security hole impacts devices such as Galaxy Nexus, Nexus 4 and Nexus 5, regardless of the version of Android they’re running (even the latest KitKat)!

Google Cloud Messaging serving as conduit for sending data from C&C servers

Criminals rent such networks to others for malware distribution. Among the malware distributed is the most sophisticated Android Trojan, known as Obad, Kaspersky said.

The malware opens a backdoor in an infected device in order to download additional malicious code for stealing money from victims' bank accounts. While not common in the U.S., people in other countries often use their smartphone for money transfers.

An official Google blog post has gone on to say that from this week on, Nexus devices will receive over-the-air security updates on a monthly basis.
Meanwhile, Samsung has announced that it too will be releasing security updates “regularly about once per month.”
“With the recent security issues, we have been rethinking the approach to getting security updates to our devices in a more timely manner. Since software is constantly exploited in new ways, developing a fast response process to deliver security patches to our devices is critical to keep them protected,” said Dong Jin Koh, an executive vice president at Samsung. “We believe that this new process will vastly improve the security of our devices and will aim to provide the best mobile experience possible for our users.”
So, good news. A patch for Stagefright is on its way, as well as the integer overflow bug in Android’s media server service that can “render a phone apparently dead – silent, unable to make calls, with a lifeless screen.”
The announcements haven’t come a minute too soon, as researchers prepared to demonstrate the Stagefright vulnerability to the world at the Black Hat conference in Las Vegas.
For too long many Android users have been treated appallingly, left to fend for themselves with no access to security patches to protect their smartphones and personal data.
Let’s hope that this new momentum to keep users updated shows some real results, and helps defend Android users against increasingly hostile attacks.
Google, Samsung and other Android phone manufactures and service providers… we are watching you. Don’t let us down.

Learn more / En savoir plus / Mehr erfahren:

http://www.scoop.it/t/securite-pc-et-internet/?tag=Stagefright

Si votre fournisseur de smartphone ou de tablette ne patche pas Stagefright de lui même, ce malware basé sur l’envoi de MMS peut être vraiment effrayant. Mais vous pouvez vous en protéger en respectant quelques étapes.

Stagefright peut attaquer tout smartphone Android, tablette, ou un autre dispositif fonctionnant sous Android 2.2 ou supérieur. Des approximativement quelque 1 milliard de gadgets Android présents sur le marché, Stagefright pourrait, en théorie, toucher 95% d'entre eux. Joshua J. Drake, le vice-président de Zimperium zLabs qui a découvert Stagefright prétend qu'il est parmi les « pires vulnérabilités Android découverts à ce jour ».

Car la partie vraiment sournoise est qu’il n’est pas nécessaire de consulter le MMS pour être infecté. Si vous utilisez l’application Hangouts de Google , vous êtes infectés sans même consulter cette application de messagerie si l’on vous fait parvenir ce message.

Learn more / En savoir plus / Mehr erfahren:

• http://www.scoop.it/t/securite-pc-et-internet/?tag=Stagefright

Successfully exploiting the vulnerabilities could allow an attacker to spy on users, or even completely take over the device.

Researchers with Zimperium have identified multiple critical remote code execution vulnerabilities in Android's Stagefright code that can be exploited on 95 percent of devices – an estimated 950 million – by simply sending an MMS message.

Learn more / En savoir plus / Mehr erfahren:

• http://www.scoop.it/t/securite-pc-et-internet/?tag=Stagefright

The curent report is a return to the problem of security mechanisms implemented in modern anti-theft technologies that reside in firmware and PC BIOS of commonly used laptops and some of desktops.

Learn more:

- http://www.scoop.it/t/securite-pc-et-internet/?tag=COMPUTRACE

We've recently found a vulnerability in certain Android apps that may leave user data at risk of being captured or being used to launch attacks.

Android-Entwickler wollen eine geheime Hintertür in Samsung-Galaxy-Smartphones entdeckt haben. Auch zwei von Samsung produzierte Nexus-Phones sollen betroffen sein.

A new trojan for Android has been discovered that resides in the memory of infected devices and launches itself early on in the OS loading stage. Even if some elements of the threat ...

A fake version of the popular Android game Minecraft - Pocket Edition is half the price of the real thing, but comes with a nasty surprise.

Un chercheur a trouvé une méthode pour forcer les smartphones de la gamme Nexus de Google à redémarrer et ne pas se connecter au réseau. Il utilise une sorte d'attaques DDOS avec des SMS spéciaux.