What’s the cost of a free lunch?

By Tony Anscombe

We are all familiar with the concept “there is no such thing as a free lunch”. There is always an agenda that involves us giving information up or doing something to earn the lunch.

Recently Kaspersky Lab announced their adding of a free antivirus to their portfolio, making them a member of the growing list of vendors that give away their software, apparently for free.

We all know that there is no such thing as a free lunch, or security product, so what’s the catch?

I’ve taught my son that when you download an app that’s free you need to understand how the company makes money, maybe advertising, cross‑ and up‑selling, in‑app purchases, and if you can’t see how then you are probably what they make money from. Of course, it may be by all the methods mentioned, the key is to understand what you are trading to use a free product.

Let’s investigate how the free eco systems works by installing a free antivirus product: (not Kaspersky), but the one that claims to have the most users.

The first install screen offers the free antivirus and by default a Google Toolbar for Internet Explorer, unless I select to opt out in small print at the bottom of the screen. Apparently, my Internet Explorer will benefit from searching from any website, translate pages instantly, and auto-fill web forms with one-click. Internet Explorer does ask for confirmation to install the toolbar and the vendor’s own security add-on the next time I open it.

After installing, and on the first run of the antivirus program, I am told that I am now sharing data and if I don’t wish to then I can switch this option off in the settings of the product. Taking a look at the privacy policy on the vendor’s website I am told that among other things the URLs of websites I visit, along with web searches through search engines, are being collected.

Further down in the privacy policy I am advised that sensitive personal data is not collected, this includes sexual preference, religion, political views and health. For most of us I think it is fair to say that all of these could be gained from search and URL data which is now being shared.

The intricacies of privacy policies, what can or cannot be collected and then whether the data is anonymously shared with third parties is complex even for those who understand and are interested. For the less technology-literate this is most likely incomprehensible. We are often presented with the words “shared with third parties” on websites, registrations, product installations and in privacy policies.

Companies that share data commercially are highly likely to be receiving payment for the sharing. In most scenarios it is probably better to consider sharing as meaning “sold”, but very few people would agree to sharing if the words presented actually said “sold to third parties”.

For transparency on this topic, ESET collects some data. We use it to improve our products and provide the services you purchase from us. In some instances some of it must be shared, for example our online store may share it with the payment processing service when you purchase a product. We do not sell your data to a third party, and never will.

During the installation an icon appeared on my desktop – a secure browser. I don’t recall seeing any mention of this during the installation process. Running this browser presents me with a Yahoo! search page. This seems at odds to the claimed benefits of Google I was presented with a few moments ago.

The next time I open Internet Explorer I am advised that the Google Toolbar and the additional add-on are slowing my browsing down by 2.36 seconds; the obvious implied recommendation is to disable them. The experience is confusing – nothing seems to be working together to improve my security, which was the reason I installed the product.

Back to the reason I installed, opening the antivirus product presents me with a welcome gift. I need to unwrap it, I am being offered an upgrade to the paid product with additional features at a discount.

Taking the first scan option starts an in-depth look at my machine, scanning for viruses, network threats and performance issues. At last I am getting what I came for, protection, or am I? The user interface is littered with options that are not available unless I upgrade to the paid product, for example Firewall, Banking Protection, Secure Shredding to name a few.

The advertising within the product interface has changed and now offers me additional products from the vendor. There is also a big green ‘Activate’ button; pressing this presents a screen offering a discounted upgrade or confirming my choice of free. Confirming free takes me to another screen offering me a free trial of the paid product. There is a continual up-sell.

To summarize my experience, Internet Explorer now offers me Google Search, the new browser offers me Yahoo!, my URL and search data is being collected and can be shared with third parties and I am being continually upsold to.

Remind me, what was the price of this free product?

The vendor is making money from Google by installing the Toolbar in Internet Explorer, monetizing search with Yahoo! in the newly installed browser, probably selling the data collected to third parties, and lastly, they would make some directly from me should I decide to purchase a paid license or their other products. It is also worth noting that both Google and Yahoo! may be collecting my browsing data as well: what we search for and our preferences are a valuable commodity.

What happens when it all goes wrong and I need help?

Not surprisingly when you use a free product support is limited, mainly a self-help service. If you do need that extra level of assistance of a person to help you then payment is required. Either a single support incident or you will again be subjected to an upsell to support every device you own, which will set you back in excess of $175 per year. That just made free rather expensive, especially when paid products, for instance from ESET, get free support.

The example above may explain why Microsoft includes a default free antivirus product in Windows 10. They want the user to have a pleasant experience using the operating system without having to combat continual changes and messages because of a product they installed. For those who have experienced the disruption after installing a free antivirus product, then Windows Defender may seem like a good idea, but there is a fundamental problem when too many people make the same decision.

A dominant security product causes a monoculture, a default standard for cybercriminals to attack. Research shows that there is an increase in malware infections when there is a vendor with dominant market share in any particular geography. The cyber criminals only need to look for the weakness in one product to infect a significant portion of devices, thus the majority can become infected as a result of using the most popular program.

For the detectives out there you may have also spotted the other benefit to Microsoft in the example above. By removing the need for third-party, free antivirus products to be installed, the browser search engine and homepage defaults are not being altered, so a typical user continues to use Bing/MSN, thus increasing Microsoft’s search revenue.

When you have an asset that’s as important as your identity there is a need to protect it from harm or theft. Understanding the value of the asset may help you decide what the cost of the protection should be.

Are you willing to trade your browsing history to gain a few dollars and get only the most basic antivirus protection? Most of us would consider this data very personal, it’s worth more than a few dollars especially if it’s being shared with third parties for commercial purposes.

The assets I have on my personal machine, which include personal data and my identity, deserve protection without compromise and for this I am willing, and recommend others, to pay. Let me put it a different way though, would you use a free lock on your front door, or would you and your family feel safer if you purchased one?

https://www.welivesecurity.com/2017/08/03/whats-cost-free-lunch/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

ESET’s Anton Cherepanov picks up Pwnie for Best Backdoor

By Editor

Anton Cherepanov, a malware researcher at ESET, has picked up a Pwnie Award for Best Backdoor at this year’s ceremony at Black Hat USA 2017 in Las Vegas.

The award was in recognition for his work in discovering what Cherepanov described earlier this month as a “stealthy and cunning backdoor” that allowed cybercriminals to install and spread Diskcoder.C via M.E.Doc.

As the organisers of the awards stated in their nomination blurb for the award: “To prepare their taxes, folks the world over install janky software developed for a captive market of their nation’s tax laws.

“In Ukraine, accountants who installed M.E.Doc received a backdoor in the gig and a half of their full installation.”

According to Cherepanov in his analysis of the Telebot backdoor, it is believed that this was injected into one of M.E.Doc’s legitimate modules.

Interestingly, it is believed that the cybercriminals could not have done this without having access to M.E.Doc’s source code.

“The backdoored module has the filename ZvitPublishedObjects.dll,” explained Cherepanov in his expert piece.

“This was written using the .NET Framework. It is a 5MB file and contains a lot of legitimate code that can be called by other components, including the main M.E.Doc executable ezvit.exe.”

Concluding his analysis of the backdoor, ESET’s malware researcher noted that this was a highly sophisticated and technical operation, which had been well thought out.

https://www.welivesecurity.com/2017/07/28/esets-anton-cherepanov-picks-pwnie-best-backdoor/

Are smartphones threatening the security of our IoT devices?

By Editor

By 2020, the number of Internet of Things devices is estimated to surpass 20 billion.

From smart fridges to coffee makers and Barbie dolls, connected things will soon fill our households.

Many of these devices are, and will continue to be, accessed via our smartphones. While this is very convenient for users, there are weaknesses in smartphone security that can be exploited to turn smart objects against us.

While many of us are now well acquainted with best practice when it comes to using laptops or desktops, it is easy to be somewhat lax when it comes to our phones.

So, what are the risks?

Smart medical records

Recent years have seen an upsurge in internet-connected medical devices and fitness trackers, many of which feed data to or can be controlled via apps on our phones.

This means that such devices now contain valuable data about our health and wellbeing that are vulnerable to cyberattacks.

IoT objects increasingly rely on smart devices with sensors built in and applications to support them.

The problem with this is that the infrastructure to shore up and support the security of the data being funnelled through our phones simply does not exist yet.

It isn’t just medical data that can be exploited, either.

We increasingly use our phones to access our online banking, to buy goods through consumer websites and to access public services.

The data up for grabs is a goldmine for both identity thieves and fraudsters.

A surge in connected cars, smart traffic management as well as development in appliances we’re familiar with, such as fare payments for public transport, will form part of that IoT revolution.

The downside of smart mobility is that the use of GPS is integral to its functionality – and GPS is seen as an easy target by cybercriminals.

Many gamers, for instance, use it to cheat at the popular augmented reality game Pokemon Go.

Exactly what a cybercriminal could do with data that reveals the location of your car or the last tube journey you took is a chilling thought – as is knowing where you are not.

Smart manufacturing

There could also be wider risks for businesses. Imagine the potential damage if cybercriminals could tap into IoT-based manufacturing networks.

What’s more, smart manufacturing is on the rise as collaboration between man and machine continues to increase.

Manufacturing processes can now be networked to provide greater efficiency as well as real-time diagnostics and rapid response.

However, smartphones could pose a vulnerability.

Company gateways that connect IoT devices to networks are made as secure as the devices themselves. However, the rise of bring your own device to work policies could leave a gaping hole if these networks are accessed via smartphones that don’t have the same security credentials.

Smart cities

Just as we are making our home lives more efficient with the help of connected devices, the cities we live in are becoming smarter as well.

Councils can now use big data to help decide on planning applications, to monitor power usage and even to bolster public safety and emergency response.

While this is all good news, some of the data that is being gathered could be exploited by cybercriminals via our smartphones.

The smarter your city, the more computer systems it has and the more open the access to the data collected by those systems is.

In addition, there can be as many as 25 different sensors in our smartphones, relating to GPS, to cameras and microphones, near-field communication and, in addition to others, gyroscopes.

This is a problem because most mobile apps don’t have to ask permission to access your smartphone’s sensors, meaning malicious programs can covertly “listen in” and steal sensitive information.

It was reported in 2016 that the biggest drawback for consumers looking to acquire an IoT device was the price, with 62% of respondents claiming they were too expensive. As the price drops, and the number of connected devices grows, IoT security becomes even more crucial – and consumers should take it seriously.

https://www.welivesecurity.com/2017/07/28/smartphones-security-iot-devices/?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+eset%2Fblog+%28ESET+Blog%3A+We+Live+Security%29

Malware found lurking behind every app at alternative Android store

By Peter Stancik  

ESET researchers have discovered that CepKutusu.com, a Turkish alternative Android app store, was spreading malware under the guise of all offered Android apps.

When users browsed the Turkish alternative app store CepKutusu.com and proceeded to download an app, the “Download now” button led to banking malware instead of the desired app.

A few weeks after ESET researchers turned to the store’s operator with the discovery of the attack, the store’s malicious activity ceased.

Interestingly, although ESET researchers found the redirection from a legitimate app to the malicious one to be general – meaning that every single app was set to be replaced with the banking malware – the crooks behind the campaign added an exception.

Probably to increase their chances to stay under the radar longer, they introduced a seven-day window of not serving malware after a malicious download. In practice, after the user downloads the infected app, a cookie is set to prevent the malicious system from prevailing, leading to the user being served clean links for the next seven days. After this period passes, the user gets redirected to the malware once they try to download any application from the store.

The malicious app distributed by the store at the time of the investigation was a remotely controlled banking malware capable of intercepting and sending SMS messages, displaying fake activity, as well as downloading and installing other apps.

When installed, the malware doesn’t mimic the app the user intended to install. Instead, it imitates Flash Player.

Figure 1 – The malicious app served to a user who thinks they are downloading the Clash of Clans game and the legitimate game served to the same user within the seven day period, respectively.

To gain more insight into this attack and its wider implications, we turned to Lukáš Štefanko, a malware researcher at ESET, who specializes in Android malware and who discovered the malware-distributing app store.

An app store serving its customers with malware on a mass scale – that sounds like a big threat. On the other hand, serving Flash Player instead of whatever customers wanted – that’s a rather thin disguise. What’s your take on this?

First, let me say that this is the first time I’ve seen an entire Android market infected like that. Within the Windows ecosystem and in browsers, this technique is known to have been used for some time. In the Android ecosystem, however, it’s really a new attack vector.

As for the impact, what we saw in this particular case was most probably a test. The crooks misused their control of the app store in the simplest manner. Replacing the links to all apps with a link to a single malicious app requires virtually no effort – but it also gives the store’s customers a fair chance to detect the scam. If you got lured into downloading a popular game and ended up with Flash Player instead … I think you’d uninstall it straight away and report the issue, right?

This might explain why we have seen only a few hundred infections.

From this point of view, it doesn’t sound like a big deal …

Well, like I said, it was probably a test. I can imagine a scenario in which the crooks who control the store’s back end append a malicious functionality to each of the apps in the store. Serving those interested in a particular game with a trojanized version of that game – that would remove the biggest red flag and the number of victims might rise significantly.

As for the attribution of this attack – have you found any traces?

There are three possible scenarios here: an app store built with the intention to spread malware; a legitimate app store turned malicious by an employee with bad intentions; and a legitimate app store becoming a victim of a remote attacker.

As for scenarios two and three, I would think that such an attack wouldn’t go unnoticed by a legitimate store. User complaints, suspicious server logs and changes in code should be sufficient indicators for its operators – especially if it occurs over a prolonged period of time. Also of interest in this regard is that we contacted the store operators with our findings but haven’t received any reaction.

How to protect yourself

Recommendations by Štefanko:

·         If possible, always favor downloading apps from official app stores. This piece of advice is infinitely repeated for a good reason – there’s no guarantee of any security measures in alternative app stores, making them a great place for malware authors to spread their “work”, and not just via single malicious apps, but also on a mass scale, as illustrated in this case.

·         Be cautious when downloading content from the internet. Pay attention to anything suspicious in file name, size and extension – this is where many threats can still be recognized and avoided in time.

·         Use a reliable mobile security solution to protect you from the latest threats. As for this threat hidden in the CepKutusu.com alternative app store, ESET detects it as Android/Spy.Banker.IE and prevents it from getting downloaded.