By Atul Periwal.

You might be thinking of how a wallpaper can be a medium of malware? There might be an error but no, a wallpaper on android phone can be used as a medium of malware to crash your android mobile phone.

The image above, which can be directly downloaded from Google images, causes certain android phones to crash.

What is malware?

Before I explain to you about wallpaper as a medium of malware, I will explain about malware first. So basically malware is a paragliding word for malware that includes viruses, Trojan, ransomware, keyloggers, spyware, adware, worms, and so on. The exact motive can differ depending on the specific malware. The mutual interest among all of them is that they are all created with the goal of d and destruction.

Malware Wallpaper: What is it?

A member of Twitter i.e. Ice universe issued a warning on Twitter which states, “Never set this picture as wallpaper, especially for Samsung mobile phone users! It will cause your phone to crash! Don’t try it! If someone sends you this picture, please ignore it.”

When you download this image and set is as a wallpaper, an android phones tend to crash that make us to assume the maker of an image can have malicious intent. While some mobile phones after the crash can be rebooted and used in safe mode, some mobile phones can’t be recover. In such a scenario, it is natural to think that the picture has inserted some code that has caused the phone to crash.

To create this, the attacker has used the method called steganography. Using steganography, an attacker can insert malicious code in image and can send the image through different forms. Once the image is downloaded and opened, malicious code will automatically run on the device and perform its actions.

Malware Wallpaper: Causes

The investigation took place for this image and it was found that the image color changed when it was uploaded to Weibo. After the further investigation, they looked into the metadata of the image and discovered that Google Skia has a peculiar ICC colour profile-E3CADAB7BD3DE5E3436874D2A9DEE126. The investigation lead to the following:-

            Dimension: 1440 * 2560

            Colour space: RGB

            Colour profile: Google/Skia/ E3CADAB7BD3DE5E3436874D2A9DEE126

The colour profile for some Android devices tend to trip Google Skia’s graphics engine forcing them to reboot.

Technically while attempting to load the wallpaper with the embedded color profile, com.android.systemui.glwallpaper. ImageProcessHelper crashes from an ArrayIndexOutOfBoundsException.

When Android UI loads, the wallpaper loads which triggers another reboot. Due to that, the smartphone get stuck in a boot loop – which keep on rebooting when the wallpaper start loading.

Malware Wallpaper: Solutions

We can use a photo editor (like Photoshop) to remove the ICC color profile from the image and save the image without embedded color profile. It won’t trigger the malware, when we take a screenshot of the image and set it as a wallpaper. Another way is to use an EXIF software or app to remove the metadata from it which will also remove the colour profile. The only problem if we remove the colour profile is that it will make the image look less vivid.  

Conclusion

This wallpaper looks aesthetically beautiful but is it really important to download a wallpaper from an unknown sites or get it from a known or an unknown person? You might have a question as to what the problem is in transferring a picture from a known person. How would you know about the main source from where the wallpaper has been downloaded?

Don’t just get attracted to such wallpapers and download it from an unknown source. If you like to download it and set it as a wallpaper, download it from credible source like your phone company’s official Website/App. Please be safe and alert from the different methods that are used by attackers which causes harm to your digital systems as well as from Coronavirus that can harm your body system.

By Atul Periwal.

The outbreak of coronavirus (Covid-19) has halted the entire world for months and it’s not ended yet. In this pandemic as the figure of infected people is rising due to a virus, simultaneously cybercrime threats are increasing at a rapid rate. It is pointless to mention, there are thousands of examples showing how hackers are taking the advantage of current situation and exploiting people. According to statistics, it shows that the average amount of time spent on the internet has increased by 2 hours after many countries around the globe have imposed the lockdown. Not only that but work culture has also changed in this pandemic, people used to work in their firms but now they have started working from home due to which cyber threat has increased rapidly.

During the outbreak, the most serious cybercrimes that are identified include phishing, ransomware, fake news, etc. Criminals have started using innovative techniques to harm people such as creating a fake advertisement for goods and services that is not available easily or not available in discounted rates or using fake challenges that are posted on social media. Due to their selfish nature, people get excited and end up in problems.

According to statistics, cyber threat has increased by more than 500 % as compared to last year’s. According to the FBI, cybercrime occurrences seem to have jumped by as much as 300 % since the start of the coronavirus pandemic. UK’s National Cyber Security Centre had reported that coronavirus-related fraud and scams rased by 400 % in March, indicating that this is due to the rapid move to remote work. Recently, the office’s Internet Crime Complain Centre (IC3) said it receives around 3,000 and 4,000 reports a day.  To better appreciate COVID-19’s effect on customers, 9,215 adults in the United States, Canada, Colombia, Hong Kong, India, South Africa, and the United Kingdom where surveyed in the week of April 13. The result stated that approximately 3 out of 10 respondents (29%) said they were targeted by COVID-19-related cyber fraud, with Millennia’s (those between 26 and 40 years of age) being the most affected at 34%. Besides, consumers who say that their household income is being negatively affected by the COVID-19 pandemic are more likely to experience digital fraud with 32 % reporting being targeted by online COVID-19 scams compared to 22 % of people who are not financially affected.

Popular cybercrimes during this Pandemic

  1. Phishing

Phishing is a malicious effort to acquire personal information or data such as usernames, passwords, and credit card details by disguising yourself in an online message as a trusted person. According to statistics, phishing has increased by more than 600% in the pandemic time.

According to Computer Misuse Act 1990 (in police and justice act) and Fraud Act 2006 in the UK, it states that if phishing and another form of cybercrimes take place, the attacker has to pay compensation to the victim and up to 10 years of imprisonment. The Anti-Phishing Act of 2004 and the Anti-Phishing Act of 2005 would impose more stringent penalties on those convicted of phishing.

Examples of phishing crime taking place during the pandemic:- Netflix and Amazon Prime fraud states that you get a free subscription. Users have to add their bank details on these movies and series streaming apps but are unaware of the background process that’s taking place.

Typical phishing or smishing message.

2. Malware/Ransomware

Software primarily designed to disrupt, damage or gain unauthorized access to your computer network. That software can be ransomware, viruses, Trojan horse, worm, spyware, adware, etc. COVID-19 is used in several malicious campaigns including spam mail, BEC, malware, ransomware, and malicious domains. While the number of those infected continues to grow by thousands, promotions often increase that use the disease as a lure. According to the statistics, the ransomware attack has been spiked by 148% in this pandemic. 

The attacker took advantage of COVID-19 and created a lot of ransomware namely being COVID-19 Tracker among the few.Once the system is attacked by the ransomware, the attacker asks for a ransom of $100 in bitcoins within 48 hours and failing to do so while result in loss of personal data and information and shared on the social media platform. Another malware called AZOrult was found to be concealed inside a downloadable program for monitoring Coronavirus. It is a Trojan horse and aims at stealing usernames, passwords, and other sensitive data.

3. Fake news

Fake news is a problem not for months but years and its increasing gradually in this pandemic. Attackers are taking advantage of the current situation and bringing out false information and sharing that information on social media. Posting information on social media is easy but controlling them is very difficult. One of the fake news that came out stated that WHO requires funds for COVID-19 and donate in bitcoins. When investigation took place for this news it came out that WHO doesn’t have any bitcoin account. It’s not only fake news but also a scam. The attacker uses to send the link in message and opening that link will display the exact copy of WHO’s website and will ask for a donation which goes to the attacker.

Using current events to scam

Conclusion

These days about COVID-19 a multitude of scams and phishing campaigns are being carried out to target the general public at massive scale. It is important as an end-user to be aware of any potential attack. It is a fact that false information spread faster than the virus. During this pandemic, we are not only fighting against COVID-19 but also against an infodemic. Individuals and organizations need to take care of security and should take steps to protect against threats. We shouldn’t open malicious sites, links, software, etc. It is important to know why attackers ask ransom in bitcoins because tracing is very difficult and if the attackers exchanges Bitcoin into Dogecoin or Litecoin and then exchange back to bitcoins which would screw everything up making it untraceable. So please be careful while you are in a digital world especially during this period. Till then stay home, stay safe, and be careful from both viruses, one which enters your body and the other which enters your digital world

By Chloe Wood.

It has been 99 days since Boris Johnson announced to the UK that we will be going into lockdown due to Covid-19. This lockdown saw us swap our offices, to make-shift home set ups. Although lockdown rules are starting to be eased in the UK, (I’m sure we all can’t wait for a pint in the pub on the 4th), it would appear working from home is going to be our new normal, for the foreseeable future. During the pandemic, naturally our focus has been on staying safe, and protecting the NHS. However, with a 600% increase in phishing alone, a lot of us are working remotely making ourselves and our data vulnerable to cyber criminals.

So, before we get into how to protect our digital assets, let’s see why cybercrime has increased. Naturally, to work remotely we need some sort of internet connection, which of course opens a huge range of vulnerabilities. We are away from the security infrastructure of the office environment. Yes, you cannot really see the cyber security within your office but taking your device away from the office infrastructure means you no longer have the security provided by things such as firewalls and IP blacklists.

Cyber security can be hard to implement completely, even for the professionals, so this post will address the 5 common threats to remote workers and outline some simple techniques to mitigate against them.

PHISHING

As I mentioned before, phishing scams have skyrocketed since the end of March 2020. This includes traditional scams and the introduction of new scams exploiting our fear and worry of Coronavirus.

To mitigate against phishing, if possible, all work should only be carried out on corporate devices – especially if a Bring Your Own Device (BYOD) policy has not yet been thoroughly designed and delivered. Not only will this ensure you have the protection of the security controls implemented by your organisation, but it will help your IT guys manage this new, remote digital infrastructure the lockdown has created. This means the IT team can manage the corporate devices as normal, allowing them to monitor all activity on the network, which is vital if anything malicious starts appearing.

To really adopt a defence-in-depth approach against phishing we cannot just rely on the technical side of security, we can also use our own knowledge and education. It is so important to stay updated on what type of scams are going around, which can easily be done by visiting IT Governance “Catches of the Month”. By educating ourselves about this, we can stay alert when we go through our inbox. Alongside knowing the specific scams about at the moment, its always best practice to become suspicious of any emails asking to input sensitive data, such as your card details, no matter how legitimate the email appears. If you receive an email like that, always try and verify it before clicking on anything included in the email, such as messaging the person its claiming to be from in another way which is not email (phone call, skype message). Phishing scams play on a sense of urgency, forcing us to make quick decisions with huge consequences, so always take your time to verify the authenticity of the email. 

UNAUTHROISED ACCESS TO CORPORATE NETWORKS

To ensure you are not allowing anyone unauthorised to access the network, it’s best to use an encrypted network. Now, I know this can sound quite technical, but you are probably already doing it. Most up-to-date home Wi-Fi networks provide this type of security, in the form of allowing you to set up a password to your Wi-Fi connection. Make sure you have changed your password to something different than the default one you were given. This can be done simply by logging into your router, which can be done by inputting your routers IP address (usually you can find this somewhere on your router) into the address bar of your web browser and logging in. Then go to the wireless settings tab and input your desired password in the password field. Remember it is always best practice to change passwords regularly.

As you are working remotely, it would make sense to use remote access security controls, specifically two-factor authentication. This is super easy to implement, I personally like to use the Google Authenticator app on my smartphone to generate one-time codes for all my logins.

ENSURE PRIVACY WITH A VPN

To create an encrypted network connection that authenticates the user and encrypts data in transit between the user and the network, a Virtual Private Network (VPN) should be used. Most corporate devices should have this set up for you already, but do not worry if your organisation does not have a state-of-the-art tech team, most business routers and some small home routers have built in VPN capabilities.

The two VPN technologies you should be interested in are OpenVPN and IPsec. OpenVPN is for those of you still accessing a business router, whereas IPSec is supported by lower cost, home routers. Both technologies can be configured by logging into your router and, most often than not, clicking a few boxes.  Once you have OpenVPN configured, you should install apps on the device that will access your brand-new VPN. These can be found on the OpenVPN website, then install and configure them with the files generated while setting up OpenVPN on your router. If you are using IPSec VPN, this is usually built into most devices, so you won’t have to go through the same app installation process as OpenVPN.

UNAUTHORISED ACCESS TO SENSITIVE INFORMATION

With modern day laws and regulations, such as the General Data Protection Regulation (GDPR) not taking any prisoners when it comes to dishing out fines and the current economic situation not looking too great, it’s probably best we all scrub up on our data protection techniques to avoid those hefty fines.

Information leakage can be easily avoided if we take the right precautions, especially when it comes to emailing information. You should try and avoid emailing sensitive information, instead adopt the use of corporate intranet resources, perhaps a SharePoint team site, to share working files – this is also super convenient at making sure files stay up to date! Obviously, when we’re all working from home adopting a new method isn’t the ideal situation, so if using the intranet is not possible and you do have to email sensitive information make sure you apply email sensitivity classifications in your email subject.

Alongside, these preventive measures we also need to adopt detection techniques. This can be achieved by installing updated anti-malware and anti-virus software. It is always best practice to keep any software on your device updated. To do this turn on your auto-updates and regularly restart your device. I know updates often do not seem to make any different to the app, but they regularly patch against vulnerabilities found in older software versions.

STAYING SAFE DURING VIDEO CALLS I’m sure now we’re all very used to Zoom calls both for our professional and personal lives, so I don’t need to give you a run down on how easy that is to use. However, the one bit of security advice I can offer is do not share the virtual meeting URL’s on any public facing platforms, such as social media.