Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Are Apple's iPhones really impervious to malware attack? What do you do if your software ends up pre-infected with a backdoor? What strength of password is appropriate for a toilet? And when will we get firmware updates for the Android code verification holes?
Watch this week's 60 Second Security and find out more!
? Can't view the video on this page? Watch directly from YouTube. Can't hear the audio? Click on the Captions icon for closed captions.
(If you enjoyed this video, you'll find plenty more on the SophosLabs YouTube channel.)
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Bitcoin is often in the news, not least because it is somewhat controversial.
It's a digital currency, backed by cryptography, not by any central issuing authority.
Its "coins" are strings of bits, and anyone can generate one, given enough time (and assuming no-one else generates the same coin first).
The calculations required to "mine" a Bitcoin are configured so that the complexity of finding them doubles every four years.
That means there's an exponential dropoff in the rate at which new Bitcoins appear, and that the supply is capped at 21 million Bitcoins.
The number remaining will quickly close in on zero, with 1/2 gone in 2012, 3/4 by 2016, 7/8 by 2020, and so on.
By about 2030, we'll be close to that asmyptotic maximum of 21 million coins.
For what it's worth, and it is rather a lot, Bitcoin exchanges currently value each Bitcoin (BTC) around US$100.
Now, creating BTCs is one thing, but buying and selling with these digital strings - actually realising that $100/BTC - is quite another matter.
In fact, if you've read any BTC-related horror stories, like the time the value on Mt Gox imploded from $15 to 1c in minutes, or the time Bitfloor was floored by cyberintruders who ran off with $250,000, it almost certainly involved to the trading infrastructure surrounding the Bitcoin algorithms, not the Bitcoin system itself.
Well, it's happened again.
You need somewhere to store your Bitcoins, and a digital wallet that uses public key cryptography is the obvious answer.
Simply put, you can trade in BTCs using an "address", which is actually a public key that others can use to transact with you.
The private key, as usual, you keep to yourself.
As long as you are the only person who knows it , only you can authorise transactions from that address; if you want to sell a Bitcoin sum, you can trade the private key for real money.
That means you need software that will create BTC addresses for you (public-private key pairs), and store your private key safely.
The public key algorithm used in the BTC infrastructure is called ECDSA, short for Elliptic Curve Digital Signature Algorithm.
To cut a long story short, generating a new ECDSA keypair requires you to use a random number between 1 and 2ks - 1, where ks is the key size.
Once you're done, you can discard the random number - indeed, you don't want anyone else to find out what it is.
The mathematical basis of ECDSA means not only that you need the random number in order to go forwards to produce the public and private keys, but also that, with the public key and the random number, you can go backwards to work out the private key.
Of course, that also means your random number should be unique, not just secret, but since you don't keep it lying around after use, how can you ever be sure?
The answer is that the bare minimum officially sanctioned ECDSA key size is 160 bits, so that, at worst, there are 2160 - 1 random values to choose from.
That's about 10 million million million million million million million million, so collisions shouldn't be a problem.
Unless you use a flawed pseudorandom number generator (PRNG), that is.
A PRNG produces an algorithmic sequence of "random" values, which has to start somewhere; if you start from the same place twice, you get the same sequence.
? For some applications, where repeatability is needed, reseeding a PRNG from the same point is a feature, not a bug. Generally, however, you try to seed a PRNG using a bit string that is as close to hardware-random as you can get.
Bitcoin wallet software that re-uses random numbers was found last year by a researcher called Nils Schneider, who documented the computational steps that show why this is a bad thing.
Well, it's happened again.
It looks as though, at least on occasion, the Java-based PRNG on Android will repeat its pseudorandom sequences, thanks to a flaw in Android's so-called SecureRandom Java class.
The Bitcoin Forum has already reported the theft of close to BTC56 (worth about US$6000) from a number of people.
A list of known-vulnerable Android Bitcoin wallets has been published by the Bitcoin Project, with instructions on what to do when the various wallet apps are fixed to use better-quality random numbers.
The Bitcoin Project doesn't go as far as suggesting that you stop using Android altogether to manage your BTC savings.
But perhaps you should consider it?
With two bad security holes recently exposed in Android's digital signature validation for apps, perhaps the platform isn't yet quite ready for the financial big time?
What do you think?
Are you ready to trust Android and Android apps with your hard-earned funds?
Follow @duckblog
You may remain anonymous in Naked Security comments. Just put "Anonymous" as your name and leave the email address blank.
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
How did rapper JAY Z take the concept of Magna Carta to a whole new level?
Watch this week's 60 Second Security and find out!
? Can't view the video on this page? Watch directly from YouTube. Can't hear the audio? Click on the Captions icon for closed captions.
Google's Android operating system has another security hole. Same story as before: uou can tamper with other peoples' digitally-signed packages and Android won't notice.Rapper JAY Z's latest album release, "Magna Carta", was preceded by a custom Android app that had some privacy boffins up in arms.Tumblr managed to forget the S in HTTPS in a recent release of its iOS app. The social networking company is "tremendously sorry."
(If you enjoyed this video, you'll find plenty more on the SophosLabs YouTube channel.)
http://twitter.com/duckblog
Tags: 60 Sec Security, 60 Second Security, 60 Seconds, 60SS, Android, APK, app, carter, Code signing, data breach, Data Collection, EPIC, Exploit, exra field, Google, https, ios, Jay Z, master keys, Privacy, sniffing, Social Networking, Spam, Tumblr, vulnerability
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
News, opinion, advice and research: Chet and Duck (Chester Wisniewski and Paul Ducklin) bring you their unique and entertaining combination of all four in their regular quarter-hour programme.
Chester's been on the road, so this epsiode of the Chet Chat is a couple of days late for logistical reasons.
We apologise for that, but Chet and Duck think it's no less interesting nevertheless!
In fact, this week's main story - the two-in-a-row exploits against Android code verification - intrigued your presenters so much that they resolved to link up and record this show, come what may.
And so, here it is: SSCC Episode #113.
(You can keep up with our podcasts via RSS or iTunes, and catch up on previous Chet Chats and other Sophos podcasts by browsing our podcast archive.)
The news wires have been buzzing with the "master keys" attack, and the "extra field" attack, both of which let you create Android Package files (APKs) that show one set of content to Google's cryptographic verification, and another to the installer.
Chet and Duck explain what happened, come up with some ideas that would have avoided the problem in the first place, explain what to do about it, and wonder how long before the fixes are on your handset.
From Android to iOS, where Tumblr published a version of its app that somehow managed to leave out the part that encrypts your PII before sending it over the internet.
Chet wonders how the average user is supposed to spot that sort of bug.
Nintendo got pounded by crackers who mounted a month-long password guessing attack.
The crooks only got hold of 24,000 passwords as a result (only!), and it looks as though those successes were largely down to using dictionaries of usernames and passwords from earlier hacks.
What to do? Federated identity? Password managers? A slimmer digital lifestyle?
Chet and Duck discuss the pros and cons of various ways to address the problem of password re-use.
And Chet's going to be at BlackHat 2013, and at DEF CON, so be sure to look him up in Vegas and say, "Hi."
Duck won't be there in body but you will find him present in mind and spirit, as he's putting together a special #sophospuzzle for the occasion.
The puzzle will go up on Naked Security, so everyone can have a go, but BlackHatters can enter at Sophos's booth at the trade show and win a secret prize!
(It's a cool secret prize, which Duck lets slip in the podcast, and Chester bemoans being ineligible to win.)
Don't forget: for a regular Chet Chat fix, follow us via RSS or on iTunes.
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Thanks to Nagy Ferenc László of SophosLabs for the behind-the-scenes work that he put into this article.
Fake anti-virus, also suggestively known as scareware, tricks you into paying money by pretending to find threats such as viruses and Trojans on your computer.
The scan to find the "threats" is free; the cleanup part is not.
If you do pay up, the software then pretends to remove the non-existent threats so you may not even realise that you've been scammed, on the principle that all's well that ends well.
But not only are you out of pocket, typically between $40 and $100, you're also led into a false sense of security, because the clean bill of health provided after you've paid is as bogus as the infection report at the start.
This sort of scam is most common on Windows, with OS X a long way back in second place. But other operating systems aren't exempt from the depredations of cybercriminals.
SophosLabs recently acquired an Android scareware sample going by the entirely hokum name of Android Defender. It's not particularly polished, and it crashed quite a bit as we played with it, but it does show that the scammers have an active interest in the Android ecosystem.
I thought I'd give you a guided tour of what it looks like. That way, you'll have some pointers that I hope will help you determine real from fake security software in future.
I started by creating a fresh Android 4.2.2 emulator image and firing it up.
Then I installed the malicious APK (Android Package file). In real life, you might be encouraged to download it from a handy website; I just used the Android Debug Bridge (adb) to inject it from my research computer into the emulated image.
You can see the application icon at top left, since its name conveniently starts with 'A'.
I launched it to see what would happen. It advised me that my device "is at risk of being infected," which is an understatement: my device is already infected, because Android Defender is on it.
I'm invited to buy, but there's no serious pressure yet.
The inital scan quickly suggests I have a problem.
Two viruses, one Trojan and a Malware, to be precise.
You might be inclined to believe this report, since the "threats" found are Android malware names you might have heard of.
But it's all smoke and mirrors. You don't have to be a Java coder, or even a programmer at all, to spot in the source code below that the app is using the Math.random() function to build up a list of virus names to report later.
The malware names are field-updatable, stored in Russian and in English in an XML data file that is part of the malware's APK file.
This is about as close to "malware identities" (also known as signatures, patterns or definitions) as you will find in the app.
There isn't anything to help the product actually locate viruses in infected files. There's just a list of names: when you're choosing randomly even on uninfected devices, recognition patterns just aren't needed.
Most of the viruses on the list are existing Android malware names, in order to add a ring of verisimilitude. But somehow the Windows-only virus Conficker managed to get in there.
The pressure on me to register the product is increasing, because it's now time to think about cleaning up the malware.
So I gave it my best shot, and tried to "activate" the software.
The buy page wasn't working, so I can't tell you how much the scammers intended to charge.
But it didn't matter, because I had an activation code up my sleeve from the source code itself.
We saw this happy-go-lucky attitude to activation in early Mac scareware.
Was the activation system this simplistic for experimental convenience, or is it just a prototyper's indolence? We shall probably never know.
The product crashed after I clicked the Activate button, but when I started it up again, I found that the activation had worked and my device was "fully protected."
The next system scan is no longer a scary red but a go-ahead green.
Better still, the app is pretending to have "eliminated" the malware it "detected" earlier.
In fact, the software builds a small sqlite database in which it remembers what viruses it has "found", and whether it has fraudulently "cleaned" them, so it will be consistent in its dishonesty.
There's a half-hearted privacy manager tool built in to the app, presumably because that's the sort of feature that other Android security products provide.
And there's an update page, though the crooks forgot to translate that part properly.
The update pretends to work, even listing signature files it supposedly downloaded from the internet.
(In my case, it couldn't have downloaded anything from outside - I tested in with my device in Airplane Mode, which inhibits all outbound connections. That cuts you off in the emulator, just as it would on a real device.)
Updates are only simulated once a day, in order to appear more realistic.
The app pretends that its pattern database has increased in size every time you update. Once again, the Java pseudorandom number generator is used behind the scenes.
I don't imagine you installed this progam, but if you did, you need to remove it right away.
And you couldn't have installed it without first telling your device that you wanted the freedom to go looking for software outside Google's own official Play Store.
I'd suggest, if you did so (since it ended badly enough for you to get this malware!) that you turn "Unknown sources" off once again.
And you might want to consider installing a proper Android security tool in which the detection and the cleanup are free.
Sophos Security and Antivirus is available from the Play Store, so you don't need to enable "Unknown sources" to install it.
And yes, it does actually look for threats before it reports them.
If it finds a threat, there aren't any demands. Just a warning and an instant "Uninstall" button.
In the words of many a Naked Security video and podcast, thanks for listening, and until next time, stay secure!
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Watch our 60 Second Security videos and arm yourself with anecdotes you can use when your friends or colleagues ask you, "Do I really need to worry about things like privacy and security?"
Here you go: the latest security stories in just 60 seconds.
In this episode:
(If you enjoyed this video, you'll find plenty more on the SophosLabs YouTube channel.)
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
A security researcher and trained commercial pilot combined his interests and cooked up an exploit framework and Android app that can be used, at least theoretically, to hack a plane.
That includes potentially gaining information about an aircraft's onboard computer, changing the intended destination, flashing interior lights, delivering spoofed malicious messages that affect the behavior of the plane, and, just maybe, if pilots don't manage to turn off autopilot and/or have difficulty with manual flight operation, crashing the plane.
These are theoretical exploits demonstrated by Hugo Teso, a security consultant at n.runs AG in Germany, who gave a talk about his research at the Hack in the Box conference in Amsterdam on Wednesday.
Of course, Teso hasn't tried any of this out on real planes, given that there aren't many planes lying around waiting for people/plane/landscape annihilation, which would, at any rate, be illegal and amoral.
Rather, he conducted his research on aircraft hardware and software he acquired from various places.
That includes equipment from vendors offering simulation tools that use actual aircraft code and from eBay, where he found a flight management system (FMS) manufactured by Honeywell and a Teledyne Aircraft Communications Addressing and Reporting System (ACARS) aircraft management unit, according to Network World.
According to Help Net Security's Zeljka Zorz and Berislav Kucan, Teso's demonstration shed light on "the sorry state of security of aviation computer systems and communication protocols."
Teso created these two tools to exploit vulnerabilities in new aircraft management and communication technologies:
An exploit framework named SIMON, andAn Android app named, appropriately enough, PlaneSploit, which delivers attack messages to the airplanes' FMSes.
The two vulnerable technologies Teso exploited with these tools:
The Automatic Dependent Surveillance-Broadcast (ADS-B) (this surveillance technology, used for tracking aircraft, will be required by the majority of aircraft operating in US airspace by Jan. 1, 2020), and The Aircraft Communications Addressing and Reporting System (ACARS), a protocol for exchange of short, relatively simple messages between aircraft and ground stations via radio or satellite that also automatically delivers information about each flight phase to air traffic controllers.
According to Help Net Security, Teso abused these "massively insecure" technologies, using the ADS-B to select targets.
He used ACARS to siphon data about the onboard computer and to exploit its weaknesses by delivering spoofed messages that tweak the plane's behavior.
Using the Flightradar24 flight tracker - a publicly available tool that shows air traffic in real time - Teso's PlaneSploit Android app allows the user to tap on any plane found within range - range that would be limited, outside of a virtual testing environment, to antenna use, among other things.
The application has four functions: discovery, information gathering, exploitation and post exploitation.
According to Help Net Security, these are some of the functions Teso showed to the conference audience:
Please go here: Allows user to change the targeted plane's course by tapping locations on the map.Define area: Set detailed filters related to the airplane, such as activating something when a plane is in the area of X kilometers or when it starts flying on a predefined altitude.Visit ground: Crash.Kiss off: Remove plane from the system.Be puckish: Trigger flashing lights and buzzing alarms to alert the pilots that something is seriously wrong.
Teso has, thankfully, responsibly, refrained from disclosing details about the attack tools, given that the vulnerabilities have yet to be fixed.
In fact, he told his listeners that he's been pleasantly surprised by the receptivity he's received by the industry, with companies vowing to aid his research.
Given Teso's belief in responsible disclosure, the industry can take steps to patch the security holes before someone with more malicious intent has an opportunity to exploit them.
From the sound of things, this researcher has garnered plenty of media attention but still values aircraft and passenger safety well over fame and glory.
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Every few years, someone reads, or remembers, or rediscovers something we often forget: computer memory isn't volatile, after all.
RAM chips don't lose their contents immediately when you turn your computer off, and that can have interesting security ramifications.
Don't get too excited: RAM contents don't persist without power in a reliable and consistent way.
If you accidentally pull the plug out of the wall before you've saved that fantastic new presentation, don't expect to get it back.
But if you can cycle the power quickly enough, and reboot under your own control from some secondary device, such as a USB key, you might be able to see the ghostly remnants of what the previously-running operating system was up to.
You can guess where this is going.
If you clean boot a computer with a hard disk that's running full disk encryption, or FDE, you can't get anything off it.
Not just the data, but also the operating system, swap and hibernation files are scrambled. Nothing can be accessed without the decryption key.
But what if the decryption key, or a large enough chunk of it, is part of the RAM that didn't fade to grey when you cycled the power?
That can happen, thanks to the phenomenon of left-behind data in RAM.
(The name you'll hear is remanence, a word originally used for residual magnetic fields, and now also used to refer to the not-yet-decayed electrical charge in memory chips.)
And if you cut the power abruptly, you prevent the operating system from taking any emergency shutdown measures, such as deliberately purging critical areas of memory to wipe any active encryption keys.
The latest researchers to rediscover remanence in a newsworthy way are from FAU, the Friedrich-Alexander Universität Erlangen-Nürnberg.
They've turned their sights on Android, building a custom distro of Android Linux called FROST, short for Forensic Recovery Of Scrambled Telephones.
So far, they've only tried it on the Samsung Nexus phone from Google.
That's because they need three planets to align before the attack will even begin to work:
The bootloader needs to be unlocked.The device needs an easily-removable battery.Ideally, the device needs to be at or close to 0°C.
The reason for these limitations are the things that go wrong if they aren't in place.
If the RAM is at room temperature, its remanence is greatly reduced, so it "forgets" much more quickly.
If you can't get at the battery, you can't easily cycle the power abruptly.
If the bootloader is locked, the device will automatically get wiped if you try to unlock it.
The wipe-on-unlock feature is a clean and simple security process enforced by Google, at least on recent devices.
? Android devices support a stripped-down mode called FASTBOOT, which gets its name because it boots up your device in a second or two. A magic chord of keys pressed down at power-up is typically used when you want to engage FASTBOOT's services. It has very limited functionality, but the key features are that it allows you to unlock your firmware, and to reflash it. Locked firmware can't be flashed, for security reasons, and unlocking (assuming your device allows it) it will wipe the device so that your freedom to reflash doesn't come at the previous owner's expense.
The first thing you need to do, when you rediscover remanence and want to use it against a specific device, is to find out if your proposed attack is practicable.
That means loading up memory with something you'll easily find and recognise later, and seeing how well your chosen content survives a power outage.
When a posse of Princeton programmers famously brought remanence into the limelight back in 2008, they used images of Mona Lisa.
The FROST crew picked a more modern mascot, Google's Android robot:
The results weren't terribly convincing at room temperature, given that rebooting the phone quickly by jiggling the battery takes an unpredictable time.
Lowering the temperatures offered improved results, as the authors showed graphically:
(They neglected to label the axes, a peccadillo usually restricted to marketing departments, so we'll have to assume that the X-axis shows reboot time in seconds, and the Y-axis shows the percentage of bits lost. The obvious conclusion: take less than a second, and head towards freezing point.)
The authors eventually settled on popping the target phone in a freezer at -15°C for an hour. They laconically point out that they can't promise you that your phone will survive, noting that "damaging the phone is your own risk, but we haven't experienced any problems yet."
? A word of warning. If you live somewhere warm and humid, such as Singapore, Dar es Salaam or Brisbane, your phone will rapidly start to collect moisture when you remove it from the freezer. If you're fiddling with the battery and the buttons of your phone to try to orchestrate this attack, you won't be able to dry it off as you go along. As the FROSTers say, damaging the phone is your own risk.
To find the FDE decryption keys in memory (Android uses AES encryption), the authors used a modified version of a program called aeskeyfind, originally created for the 2008 paper referenced above.
This cleverly-written tool uses a variety of heuristics to churn through memory, looking for contiguous blocks of RAM that look like the output of the AES key schedule.
This is the algorithm that AES uses at the outset to convert a 128-bit key into 176 bytes of key material to use in the AES process itself, or a 256-bit key into 240 bytes.
And now the burning question. Did the FROSTERs succeed?
Sort-of. They've got some visual material that suggests they did, though whether the key information was actually enough to unscramble the encrypted data on the phone is not specified.
The paper is similarly ambiguous, saying somewhat noncommittally that the authors were "able to recover the disk encryption keys (given that no or only a few bits were decayed)."
That's a bit like saying that "we came out ahead financially every time we placed a winning bet." It doesn't tell us much about the practicability of the attack in real life.
Nevertheless, the FROST paper teaches, nay proves, an important lesson:
If you have an Android phone with an unlockable bootloader, LOCK IT AGAIN WHEN YOU'RE DONE REFLASHING.
The authors are unequivocal about this.
When they needed to unlock the bootloader to try to attack an encrypted phone, they ended up with nothing to decrypt.
Oh, and if you pick up your phone to make a call and it seems unusually cold against your ear, look out!
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Is Google doing a good enough job of policing apps in the official Android app store?
It seems not, judging by the number of bogus apps that continue to be made available for public download from Google Play, exploiting the name and reputation of legitimate games in an attempt to make money for fraudsters.
For instance, take a look (but I suggest you don't install) the apps made available by an Android app developer called "abbaradon":
There are some pretty well known games listed there, including "Plants vs Zombies" and "PES 2012" (Pro Evolution Soccer).
The real Android version of "Plants vs Zombies", developed by Electronic Arts, costs a few dollars, and has had thousands of reviews.
However, Abbaradon's version is free, and has some fine print tucked away at the end of its description in the Google Play store:
Plants vs. Zombies Free! Please leave only positive feedback. If you have any support questions - please send us email. This is a Amazing puzzle specially for game fans.
Creating an app takes time and money, In order to keep creating great (and free!) apps, we are using a new search service to monetize our apps. With this service we are able to create more great apps for you guys. This option bundles a few search points (icon, bookmark and homepage) for you to use. You can erase these easily and with no effect to our app. Thanks!
The app itself isn't Plants vs Zombies at all. It's a simple jigsaw puzzle-type app, that uses an image from the game.
And it's not just Abbaradon. SophosLabs has seen scores of similar bogus apps, trying to make money out of unsuspecting users, in the last couple of weeks. Google tries to stamp out the rogue developers, but they simply return with a new name and start uploading their fake apps again.
So, what happens if you run one of these apps?
In the screenshot below you can see what happened when we ran a fake version of PES 2012.
The program admits that it is ad-supported, may display adverts in apps and your Android device's notification tray.
Furthermore, they say they will collect information about you - including your email address and phone number - if you click on any of the adverts, and pass it onto third parties.
And all you wanted to do was have a free game of football..
But it doesn't stop there, the app is also going to change your browser's home page, add a bookmark, and add icons to your device's home screen. All of this is designed to earn money for the app developer.
Sure enough, a couple of search icons have been added to the Android home screen alongside the icons for the games we've downloaded.
Clicking on the icons leads to search engines, such as Moberium.
Various advertising frameworks are being used by the apps, including Apperhand, Clicxap, Airpush and Startapp - presumably earning money for the developer who is bandying around apps on the Google Play store, pretending that they are free versions of popular games.
Google doesn't take kindly to app developers duping users in this way - and so the developers are using different certificates, different names, and ensure that their packages are heavily obfuscated so they do not look alike.
Although it's easy for a human analyst to determine that the apps are doing similar things, it seems that Google's automated systems are finding it a far harder job to weed out these fake money-making apps from their Android app store.
Sophos detects the bogus apps as Andr/NewyearL-B.
Android malware is a growing problem, with rogue apps even making their way into the official Google Play store. Last year, for instance, we talked about how one Naked Security reader downloaded what he thought was an official Android version of the Legend of Zelda game, only to be bombarded by pop-up notifications and adverts.
If you think it's time to protect your Android smartphone or tablet against the increasing number of threats, check out our free Android anti-virus app.
Follow @gcluley
Thanks to SophosLabs researcher Vanja Svajcer for his assistance with this article.
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
If Apple were to start making Android versions of some of its most popular products that would be pretty big news, right?
So it's no wonder that eyebrows raised when a commenter on Reddit discovered what appeared to be a host of apps created by "Apple Inc" in the Google Play store.
Versions of Garage Band, iPhoto, iMovie, Keynote, Numbers and Pages were listed on the official Google Play store, all claiming to have been developed by Apple Inc and giving a contact email address of android@apple.com.
The bogus Apple apps, which were listed for sale at prices between $4.98 and $9.97, have now been removed from the Android marketplace.
What isn't clear is whether this was a scam to simply pilfer money from unsuspecting Android users hoping to get some Apple-created apps on their devices, or whether it was a more sinister attempt to infect Android phones with malware.
Regardless of the motive, it's clear that once again the Android Google Play store has been found falling short in protecting its users, failing to preventing bogus apps from clearly unverified developers from being distributed via official channels.
Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.
Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.
Already using Google+? Find us on Google+ for the latest security news.
Do you have photographs on your smartphone that you don't want others to see? If an app publisher tells you that they will keep your secrets safe would you trust them?
The best advice when it comes to privacy and photos is "don't take a photo that you don't want your teacher/boss/mum/dad to see".
But as this advice is not always heeded, the next best thing is to keep them safe from prying eyes should anyone borrow, steal or find your phone.
Encouraged by a recent article on the shortcomings of the Snapchat safe sexting app, I tried a few apps that promise to protect your privacy, but often fail to do anything of the kind. These examples are all based on tests I conducted on an Android smartphone, but many of the apps are also available for iPhone.
First I tested Secret Pictures which describes itself thus:
"Prevent your pictures from letting others know! ... Pictures vanish from Gallery and are locked behind easy-to-use PIN pad. Protect your private pictures ... Secret Pictures locks your private pictures with your PIN. Only you can see the pictures in Secret Pictures."
It sounds very much like your pictures are protected, hidden from view, secured, etc.
But all it really does is move photos to a poorly hidden directory from where the photos can be viewed and shared. All it takes is a file browser and your privacy is ruined!
Next is Photo Safe which markets itself with the slogan
"Protect Your Privacy! ... No one touches your private data without permission!"
Again, the app gives a definite impression that your hidden photos are safe from prying eyes, and again the app moves your photos out of the gallery - but this time the directory is not even hidden.
Instead the PhotoSafe app renames the file you want to hide in a weak attempt to disguise it, putting some extra characters after the file extension.
You can either rename the file or instruct the phone that the file is an image, and once again it is viewable and shareable just like any normal photo.
Next in my list was KeepSafe Vault. This app describes itself as the
"Best hide pictures & video app on Android ... Selected pictures vanish from your photo gallery, and stay locked behind an easy-to-use PIN pad. With KeepSafe, only you can see your hidden pictures. Privacy made easy!"
I started to see a recurring theme in the promises that these apps make.
This one has similar failings as the first two apps, using a weakly hidden directory and renaming the images, again easily overcome with nothing more than a file browser.
It's not all doom and gloom though. There are some apps for hiding the pictures and text messages on your Android which live up to their promises although they all seem to come with some trade-off. You really don't get something for nothing when it comes to apps.
Take, for instance, Hide Pictures & Text Messages:
" lets you hide or encrypt almost anything on your phone including photos, videos, contacts, text messages, and other apps."
For once, when they say they encrypt the content they actually mean it. You can still browse to the directory where files are stored but any feasible attempt to open them outside of the app results in a "Load failed!" error message.
The app lets you hide its own icon too so people won't even know that you have an app for hiding stuff.
All this functionality does come at a price though.
After an initial number of free uses you have to pay in order to be able to encrypt or hide further files.
Due to the extra functionality you will also need to hand over a lot of access permissions to your phone and given that you're looking for extra security and privacy, this may be something that you have reservations about.
Another promising looking app is Private Gallery which also seems to encrypt your photos meaning they can not easily be viewed outside of the app.
This app is free but it's supported by adverts from an ad network that compromises on security by transmitting the location and identification data from your phone in the clear.
The app also requires some permissions which seem unnecessary given its purpose (for instance, the ability to dial numbers and view/edit your browser history).
Again, if you're in the market for added security and privacy then these concessions may concern you.
The last app I tried was Vaulty which also seems to live up to its promises.
Vaulty looks a little more considerate in that it asks for a more acceptable list of permissions. It also offers a decent balance of functionality in the free version with optional extras in paid-for plugins. If I had a need for a photo/text message privacy app I'd probably go for this one as it seems to ask for the least in return for the most.
Looking into the history of Vaulty highlighted a different problem though.
An automatic update from the developer borked the app for many users, rendering their encrypted files inaccessible. The fault was corrected in a rushed patch but it still demonstrates that should this happen again your protected photos and files might not always be recoverable.
Of course, this risk applies equally to any app which encrypts your data.
In summary, not all apps are created equal and two apps that appear to offer the same service might in fact give very different levels of functionality.
Sooner or later I expect we'll see an app developer being held accountable for leaked secrets. After all, they promised the unsuspecting user that they would protect those secrets.
It would be better if the descriptions of these Android apps properly reflected what each app does and does not do. At least then users can make an informed choice about how much they wish to trust the app, and whether it is sufficient for the intended purpose.
And, of course, my advice echos those who have gone before me - there is really no situation where you absolutely have to store on your phone naked photographs of yourself.
If you have a photograph or sensitive information that you don't want others to see then try to avoid putting it on a device that others are likely to use.
If you're still determined to go ahead then avoid having anything identifiable in the frame, both of yourself and in the background of the picture.
That way you can at least pretend that it's not you in the photograph when it falls into the wrong hands.
Bitcoin is often in the news, not least because it is somewhat controversial.
Well, it's happened again.
News, opinion, advice and research: Chet and Duck (Chester Wisniewski and Paul Ducklin) bring you their unique and entertaining combination of all four in their regular quarter-hour programme.
But not only are you out of pocket, typically between $40 and $100, you're also led into a false sense of security, because the clean bill of health provided after you've paid is as bogus as the infection report at the start.
A security researcher and trained commercial pilot combined his interests and cooked up an exploit framework and Android app that can be used, at least theoretically, to hack a plane. 
The application has four functions: discovery, information gathering, exploitation and post exploitation.
RAM chips don't lose their contents immediately when you turn your computer off, and that can have interesting security ramifications.
If the RAM is at room temperature, its remanence is greatly reduced, so it "forgets" much more quickly.
Do you have photographs on your smartphone that you don't want others to see? If an app publisher tells you that they will keep your secrets safe would you trust them?
Sooner or later I expect we'll see an app developer being held accountable for leaked secrets. After all, they promised the unsuspecting user that they would protect those secrets.