What Can a Hacker Do with Stolen WiFi Credentials?

Recently HTC acknowledged a vulnerability that can expose a user’s WiFi credentials, including the WiFi SSID and security passwords to a malicious app running on some of its Android phones. The vulnerability was discovered by the security architects Chris Hessing and Bret Jordan, and is published on the US-CERT website also.

The vulnerability is due to an issue in certain Android models that allow an Android application with basic permissions (particularly ‘android.permission.ACCESS_WIFI_STATE’) to access all the stored WiFi credentials, including the respective SSIDs, user names and security passwords, belonging to various WPA/WPA2-PSK/802.1x based Wi-Fi networks. On the top of this, if an application also has internet permission (‘android.permission.INTERNET’), it can transfer the accessed list of WiFi credentials to a remote server.

Exposing the list of WiFi credentials to an unintended party or person without the user’s knowledge can have serious security implications if the former has malicious intent. Some of these include:

Unauthorized access to private WiFi networks: Gaining access to the list of WiFi credentials from a user’s mobile device, the simplest for a hacker to do is to intrude into corresponding private WiFi networks. The private network can be a home, campus or a corporate WiFi network. The intrusion will allow a hacker to carry a host of malicious activities on the network, such as installing malware on the network and scanning the network for confidential information/security vulnerabilities. Many corporates are adopting the BYOD (Bring Your Own Device) initiatives nowadays, giving access to corporate WiFi to the employee’s personal mobile devices. But, since personal devices lack strict corporate controls, vulnerabilities similar to this recently discovered one can be a serious security threat for corporates adopting BYOD schemes. All WiFi networks requiring a security passphrase (in case of WPA/WPA2-PSK security) or a combination of username and password (in case of WPA/WPA2-802.1x) can suffer intrusion by the potential exploitation of discovered vulnerability. In contrast, WiFi networks requiring digital certificates or SIM based authentication (in case of WPA/WPA2-802.1x) are potentially safe to intrusion attacks launched via vulnerability exploitation.

Eavesdropping/Session hijacking on secured WiFi networks: Loosing the WiFi credentials of a WPA/WPA2-PSK WiFi network can be more damaging compared to WPA/WPA2-802.1x Wi-Fi network, because in the former all the WiFi clients of a particular network share a common security phrase. Therefore, an attacker having gained the SSID and security passphrase through the discovered vulnerability can sniff all the private encrypted WiFi communications happening over the associated WiFi network (using easily available hardware and software) and decode the same afterward or simultaneously using the available credentials. With the decoded traffic that can potentially reveal browser cookies, a hacker can potentially hijack an authorized user’s web session also. WPA/WPA2-PSK networks are popular among home and SOHO users, and therefore user’s online traffic, even though encrypted, is susceptible to eavesdropping and session hijacking when a hacker has gained necessary credentials illegally by exploiting the discovered vulnerability.

Man-In-the-Middle attack on WiFi users: Loosing the WiFi credentials also enables a hacker to launch man-in-the-middle attack on connected users of affected WiFi network. The attack can potentially hurt the users due to leakage of confidential data or malware implantation. Although WPA/WPA2-PSK networks are more susceptible to man-in-the-middle, but exploiting the Hole196 vulnerability, one can also do this attack on WPA/WPA2-802.1x networks too.

Potential loss of personal information: People often use WiFi hotspots for broadband access on their devices while they work, travel or visit various public places. And, many WiFi hotspots contain identity of their location in their SSID, therefore loosing the WiFi credentials also, including the SSID details, can potentially reveal a lot of information about a user to third-parties like company name, travelled places, etc. The personal information details can motivate crimes such as stalking.

Looking at the damages of loosing out the list of WiFi credentials, the vulnerability discovery is very important from user’s security perspective considering the growing usage of Android-based mobile devices and WiFi networks across the world. Moreover, considering the open nature of Android market, malware exploiting the vulnerability can be easily developed and targeted toward the users of affected devices, posing a greater security concern for them. A fix for the vulnerability is already available and HTC has already said that many phones have received the fix through regular updates, but some users may need to manually update their phones.

Hopefully, acknowledging the list of potential damages of the discovered vulnerability, mobile device users would be a bit more careful while selecting and installing an app on their device.

SOURCE : infosecurity-magazine

Read More

Android Trojan Steals Credit Card Info, Locks Devices Remotely

A new Android banking Trojan capable of spying on users and stealing credit card info is achieving persistency on infected devices by asking for device administrator rights and continuously showing the dialog window until the user gives in.

Researchers at Avast warn that the new Banker Trojan relies on social engineering and employs various evasion techniques in an attempt to remain undetected on the compromised devices.

The malicious program is installed on the infected devices under different names, including AVITO-MMS, KupiVip and MMS Центр (MMS Center), depending on the sample. After installation, an app icon is placed in the launcher, but the icon is hidden after the program’s first run, to make the Trojan more elusive.

The malware also checks whether it runs in an emulator, and, if it doesn’t, it starts a background timer that shows the Device Admin activation dialog in a continuous loop, even if the user presses the “Cancel” button. However, the dialog disappears if the user gives in and enables device administrator rights for the app.

After gaining admin rights, the malware repeats the process, but for setting the default SMS manager app. By gaining device admin rights, the Trojan makes it more difficult for users to uninstall it, while also allowing its operators to remotely lock the device, researchers say.

On smartphones running under Android Marshmallow, users can try to uninstall the application despite the continuous flood of request dialogues, by going to settings with the top-down swipe. Owners of devices running under Android KitKat, however, aren’t as fortunate and can get rid of the malware only after a factory reset.

The Trojan was designed to send information about the device to the command and control (C&C) server, to intercept incoming SMS messages and send them to the server, and to receive further commands from its operators.

The information sent to the C&C server includes device IMEI, ISO country code, SIM operator name, Android build version, Phone number, SIM serial number, info on whether the app has admin rights and if it is the default SMS app, the current version number of the Trojan, and generated unique user ID for the phone.

Upon command, the Trojan can display a fake Google Play window on the infected device, prompting the victim to enter their credit card information. The malware also supports commands for downloading an APK and prompting the user to install it, locking the screen, and redirecting calls to a specific number. Moreover, it can get call logs, SMS inbox, bookmarks, contacts, a list of installed apps, and GPS coordinates of the device and send them to the C&C server.

According to Avast, the Trojan was most active in the first half of February, and it was targeting making users in Russia, followed by Germany, the U.S. and Czech Republic.

To stay protected, users should make sure they have an anti-malware program installed on their devices, and should also keep their data backed up at all times. Should the infection occur, however, users might be forced to reset their devices to factory settings to remove all installed apps and user data, including the malware.

Some of the most recent Android banking Trojans spotted in the wild include Asacub, which evolved from a spyware Trojan to a backdoor and then a banking malware, SlemBunk, a continuously evolving piece of malware, with 170 samples identified in mid-December to target users of 33 banking applications worldwide, and Xbot, which exhibits multiple malicious activities, ranging from stealing banking credentials and credit card information, to encrypting files on external storage.

Read More

52% of Consumers Want Biometrics and Other Post-Password Options

Just as Google’s post-password play moves forward with major banks, a new survey has revealed that 52% of consumers want biometrics and other modern authentication methods to replace traditional passwords.

According to the data from Gigya, 80% of consumers believe biometric authentication is more secure, and they understand the pitfalls of typical password/user ID combos.

This is good news for projects like Google’s Project Abacus, which is set to be trialed with several major banks next month. It combines biometrics like facial and voice recognition with user behavior such as the times and locations one usually tries to log-in. From these it deduces a Trust Score which can then be used to check if the individual trying to log-in is you.

The survey shows that the thirst for post-password approaches could be motivated by sheer laziness: Those same consumers aren’t practicing good password hygiene in the first place.

Consider: only 16% of respondents follow password best practices with a unique password for each online account. About 6% use the same password for all accounts, and 63% use seven or fewer passwords across all their online accounts. And, 68% abandon the creation of an online account due to complex password requirements.

Millennials have the worst password practices, with only 67% using insecure passwords like, well, “password,” “1234” or their birthdays.

This, in spite of the fact that 26% of respondents have had at least one online account compromised in the past 12 months. When segmented by generation, 35% of millennials, 28% of Generation Xers and 18% of baby boomers reported having online accounts compromised.

So obviously, authentication mechanisms need to be simple and easy to use in order to be adopted. Biometrics by and large fit the bill, with 20% saying they would adopt fingerprint scanning, voice recognition, facial recognition or iris scanning technology were it available.

In fact, nearly one-half of millennial respondents use one or more forms of biometric authentication, such as fingerprint scanning technology (38%), voice recognition (15%), facial recognition (11%) or iris scanning (5%). Millennials also report that at least one of the applications they’ve downloaded offer some form of biometric authentication, which is consistent with Juniper Research’s estimates that more than 770 million biometric-enabled applications will be downloaded each year by 2019, as compared with 6 million in 2015.

Two-factor authentication, which couples traditional usernames and passwords with a personal security question or verification code sent via text message, has its supporters too. A full 29% of survey respondents like the idea (likely because it allows for weak passwords and password reuse).

Other frictionless approaches, like social-network authentication, are popular too. The “log in with Facebook” option that many websites have now implemented are a perfect example of this.

“Within the next 10 years, traditional passwords will be dead as an authentication form,” said Patrick Salyer, CEO of Gigya. “Consumer-focused brands require modern customer identity management infrastructures that support newer, more secure authentication methods, such as biometrics. Businesses that are already using advanced authentication methods demonstrate increased customer registration and engagement while enjoying greater login convenience and security."

(Source : infosecurity-magazine)

Read More