If you didn’t get a chance to see last nights airing on Fox 8 Cleveland, you can view the whole segment at:
http://www.fox8.com/health/parenting/ and by clicking on the “Cell Phone Viruses” video.

In an effort to increase awareness of the risks associated with mobile devices (smartphones, tablets), we have created and posted the following webpage outlining some tips and procedures to protect yourself and your mobile device. 

Tips to protect yourself and your phone

Additionally, if you’re involved in corporate training of employee’s or in education and want to educate your staff (or students) on the dangers of Smartphones, we have already released a poster series dedicated to Mobile Security and developed other literature.  If interested, please email partnership@thirtyseven4.com.

posted by Steven Sundermeier

October 24, 2011

New Scareware on Android Emerges - “Battery Doctor”

Android.Batterydoctor.A is a new form of Scareware targeting Android mobile devices.  The fake app, calling itself "Battery Doctor", claims to have the functionality to recharge your devices battery. While this is a false claim, it does contain the functionality to steal user information behind the scenes.



When the program first executes, the following window appears.



As you can see from the screenshot above it shows battery overview and displays two pie charts- 1) showing running applications and 2) showing the available storage space.

The program loads as a service called NotifAdSDK, and this service has the ability to forwarded on your profile information every four hours.



Android.Batterydoctor.A sends the information to its home server "push.m[xxxx]ze.com":

-Its screen size;
-The version of the browser and OS on the device;
-The program that is generating the traffic (com.androidupgrade.battery) and its version;
-The name of the campaign;
-The device’s manufacturer and model;
-The network the device uses;
-The phone’s coarse (mobile network) or fine (GPS) location;
-The IMEI and phone number;
-The app’s API key;
-A unique identifier for the device.

posted by Steven Sundermeier

October 17, 2011

Android Malware Disguises Itself as Netflix App

We recently intercepted and updated for Android.Fakeneflic.A.  Android.Fakeneflic.A is a new malware that masquerades as a genuine Netflix application for Android devices in attempt to steal Netflix user account information.

When the fake Netflix app is downloaded and installed it looks like a genuine Netflix app- even the permissions required were made to appear identical to the legitimate Netflix application. With all the uncertainty recently about the splitting of the Nextflix business into two entities and anger towards the recent raise in rates, the malware author is apparently capitalizing on user curiousity with Netflix being highly popular topic at the moment and exploiting its user base confusion.

How it works:

After installing the application, it asks the user to enter their Netflix account information- information that includes Email ID and Password. This information is captured and sent to a configured remote server (at the time of this post is now unavailable). Once the information is entered, it displays a screen that says there are incompatibilities with their hardware and recommends they install another version of the application.

Icon of the application:


The account credential screen:


Code for sending the information to remote server:



We advise users to be smart and only download and install apps from trusted sites.  Thirtyseven4 Mobile Security (TS4Android) users are fully protected against this threat.


posted by Steven Sundermeier

October 7, 2011

QR CODES EXPLOITED

As it was reported earlier this week, malware authors have found an easy way to get their malicious creations installed on Android devices...the new technique utilizes QR codes.

QR (Quick Response) codes are a form of a matrix barcode,that contain and encoded form of data (for example: to store the URL/website information).  Scanning QR Codes are a convenient way for a user to open a website directly, opposed to typing in the whole website address.

In the case below a malware author has used a malicious QR Code to redirect unknowing users to malicious websites that install a new Trojan. Essentially, when a user scans the QR Code with their Android device, the code redirects them to a site that will install a Trojan (now found in-the-wild) on to their phone. Once installed, the Trojan will attempt to deliver a number of SMS messages to premium-rate numbers.

The installed icon of the Application looks like:



And during installation, it asks the user for the following permissions below:



Here is how the Trojan send messages to the premium rate numbers.



Thirtyseven4 Mobile Security detects the file as TrojanSMS.AndroidOS.Jifake.f.  An extended trial license of Thirtyseven4 Mobile Security is available here.

posted by Steven Sundermeier

September 29, 2011

ANDROID MALWARE INCREASING

As I was quoted saying in our press release yesterday (available here), the popularity of Android devices are lending itself to a rapid increase in malware created specifically for Android-based smartphones and tablets. These malware (some already out in-the-wild) pose a serious threat to Android Users and the confidential information often times stored on there phones and tablets. And while mobile malware is intercepted by our virus research team on a daily basis, I thought I'd describe a few recent examples:

Case 1: Android.RogueSPPush.A

Android.RogueSPPush.A is a relatively new malware that targets Android Users (specifically Chinese Android Users).  It targets unknowing users by using a SMS-based subscription system to sign-up users for certain services without the user’s knowledge and consent. If successful, the Android users will end up suffering potentially significant financial losses.

Looking at a Chinese SMS based subscription, the process involves three stages.

1.)  A user sends a service-subscribing SMS message to a defined service provider.

2.)  The service provider replies back to the user a service confirming SMS message containing the detailed information of the service

3.)  The user will have to confirm the subscription by replying back to the SMS message with the recommended "Y."

After installation, the installed icon will look as follows.



As described above, the malware will send the confirmation with the text ‘Y’ to complete the process.



The malware will then send the SMS with the confirmation to the service provider.



Thirtyseven4 Mobile Security (TS4Android) detects this malware as Android.RogueSPPush.A


Case 2: Android.Lotoor.B - an Android malware now establishing Root privileges

Android.Lotoor.B is a newer type of malware attacking the latest version of the Android operating system, version 2.3 (Gingerbread).  This new malware has already been seen "in-the-wild" and masquerading as an app featuring the "Beauty of the Day" pictures.

Package1 downloaded uses the following permissions:
android.permission.READ_PHONE_STATE
android.permission.READ_LOGS
android.permission.DELETE_CACHE_FILES
android.permission.ACCESS_CACHE_FILESYSTEM
android.permission.WRITE_SECURE_SETTINGS
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_OWNER_DATA
android.permission.WRITE_OWNER_DATA
android.permission.WRITE_SETTINGS
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RESTART_PACKAGES

Using Gingerbreak, and utilizing the latest exploit for gaining root access to Gingerbread, the malware gathers information about the infected device and sends it to remote servers. In addition to gathering and reporting the IMEI, phone number and SIM serial number, GingerMaster creates a backdoor root shell, stored in the system partition in an attempt to survive after software upgrades, to allow for an attacker to access the device.

Thirtyseven4 Mobile Security for Android (TS4Android) detects these files as Android.Lotoor.B.

posted by Steven Sundermeier

September 2, 2011

Information on Worm Morto

There has been a lot of news coverage, based on a warning issued by Microsoft, regarding a new Internet Worm dubbed "Morto". Morto is a worm that spreads to systems through the use of the Remote Desktop Protocol (RDP) Port.  Essentially, it attempts to connect to a remote machine by scanning the RDP Port on the network, this scanning causes a lot of network traffic for port 3389/TCP (the RDP Port). We have posted a complete description for Morto here.

The most important thing is that our Virus Research Team immediately updated for this new threat and Thirtyseven4 Users are fully protected against Worm.Morto. Protection was released on August 28th, 2011


Posted by Steven Sundermeier

July 15, 2011

THIRTYSEVEN4  - “THANK YOU”

As the owner of Thirtyseven4, I wanted to say “thanks” to all our customers for making Thirtyseven4 their antivirus of choice- quarterly sales were at an all-time high.  We have been very blessed by your support and humbled by all the positive e-mails we have been receiving.

Here’s one such example:
"Thanks for everything so far. I just wrote a very strong recommendation of your product to our region's tech director mailing list. If it were up to me, I'd have the whole state running your software! You guys have been rock stars from the get-go, from installation right up to now. Please share my thanks and attaboys with the rest of your staff, and keep up the awesome work!"
-Jimmy Fisher, Winters ISD  

More importantly, through your support, we were able to financially fill the sponsorship gaps of over 180 young girls [this quarter alone] through our partnership with Remember Nhu,  “Thank you.”



posted by Steven Sundermeier

June 9, 2011

Thirtyseven4 Antivirus - Good Time to Upgrade

With the weather getting warmer and schools now letting out for the summer, it may be a great time to upgrade your older Thirtyseven4 installations to the latest version. Or better yet, a great time to transition off your existing antivirus provider to Thirtyseven4 Antivirus.

Thirtyseven4 Antivirus offers a 5-in-1 protection suite that includes, Antivirus, AntiMalware (detection and removal), AntiRootkit, Firewall and Data Theft Prevention.

posted by Steven Sundermeier 

June 2, 2011

Thirtyseven4 Admin Console 4.5 Service Pack 1 Released

This week we released Service Pack 1 (SP1) for users running Admin Console 4.5.  In order to apply SP1, from your Admin Console system, navigate to C:\Program Files\Thirtyseven4\Thirtyseven4 Admin Console 4.5\Admin\web\builds and execute the file, “acsvpack.exe“.

posted by Steven Sundermeier