How to update Android without bugs, data loss, security risks or other nuisances | Kaspersky official blog

/in

For many, Android smartphone updates are a sore point. On the one hand, they’re essential to fix dangerous bugs and vulnerabilities on your phone, delivering handy new features and support for the latest technologies at the same time. On the other hand, updates are often delayed, get installed at the worst possible time, they can slow down your phone, and in really bad cases cause data loss or even brick the device.

Let’s figure out how to install Android updates properly to get all the benefits and zero misery.

Different types of updates

“Installing updates” can refer to five quite different scenarios depending on what exactly is being updated.

Updating apps. Individual apps on devices are updated automatically or manually through an app store (Google Play, Huawei AppGallery and the like). Updating one app in this case rarely affects the rest and generally has little effect on the gadget.
Updating Android components. Google developers have long been committed to modularization, so many parts of the operating system (such as the call screen or photo viewer) are essentially separate apps. Some of these likewise download updates through an app store; others (like Google Play Services) are forcibly updated at a lower level.
Updating extensions from the smartphone manufacturer. All that distinguishes a Samsung, Oppo or Xiaomi smartphone from a “pure” Android device are proprietary extensions, which often radically alter the look of the operating system and sport fancy names like OneUI or ColorOS. The internal structure and update method differ from vendor to vendor — many try to time extension updates to coincide with the release of general Android updates, but this isn’t a hard-and-fast rule.
Updating Android itself. Google rolls out major Android updates once a year — upping the major version number by one — but bug fixes and security updates appear monthly. However, most smartphones don’t get the latest version of Android from Google directly: manufacturers of specific models must first add the correct low-level components and vendor-specific extensions, and only then offer the latest version of Android to users. Therefore, for any Android update, the time from rollout to availability on smartphones other than Google Pixel or devices running AOSP (Android Open Source Project) can be anything from a month to… eternity — depending on the manufacturer’s promptness.
Updating low-level components. This means the bootloader, 4G/Wi-Fi chip firmware, drivers and the like. As a rule, these components are updated along with the operating system, but they can get their own updates as and when required. In any case, updates of this type are released only by the company that made your phone.

Updates of the first two types (bootloader, 4G/Wi-Fi chip firmware) arrive either automatically or by pressing literally one button in your chosen app store, and usually take just seconds; others need much longer, require a smartphone restart, and are slightly more prone to side effects. Which means you need to cushion the potential blow.

What could go wrong

Nuisances. On many manufacturers’ devices, alerts about new updates appear in the notification drawer and remain stuck there. Sometimes they go full-screen and demand immediate installation. One mis-tap and your phone is already pulling gigabytes of data – heaven forbid if you’re in roaming mode.

Eating up phone space. Security updates and bug fixes are usually small in scope, but new versions of vendor extensions or Android itself can be significantly larger than their forebears. And this creates a separate problem for budget smartphones with low storage capacity.

Post-update bugs. Even Google makes mistakes. For example, users updating to Android 12 encountered all sorts of issues — from unstable network connection and flickering displays to bricked devices. Similar problems sometimes occur with vendor extensions.

Loss of data or functionality. A rare but most unpleasant occurrence is when, after an update, various apps stop working (if, say, they’re too outdated to receive updates) or user data vanishes.

Why you still need to update

Vulnerabilities. Stories about how smartphones can get infected with malware without any user action or with no signs that anything is wrong are not fiction, but rather the result of the exploitation of dangerous bugs in Android itself and installed apps. Vulnerabilities even crop up in cellular or Wi-Fi modules. And if you think this “spy fiction” doesn’t apply to you, beware — cybercriminals will quite happily use vulnerabilities of this kind to steal your money, passwords and anything else that isn’t bolted down. Each monthly Android update fixes a handful of serious vulnerabilities and a dozen or two low-risk ones.

Bugs. From increased power consumption and memory leaks to camera focus issues, the corresponding bug fixes in low-end components, Android itself, and/or vendor extensions make the smartphone experience more enjoyable.

Compatibility. Even if you don’t like new stuff, sooner or later you have to update the browser, programs, and operating system anyway just to be able to continue using your online apps and even visit certain websites. The support period for older versions of software is steadily dwindling, and, for example, in a severely outdated Chrome, many sites refuse to open properly.

Top tips for hassle-free updating

Use only official sources. Download updates only through your chosen app store or your smartphone’s system settings. Don’t install updates from websites unless the manufacturer offers no other way; in which case, as above, download updates only from said manufacturer’s official site — never from aggregators, news media or unknown sites.

Create backups. Android doesn’t fully back up everything automatically, but you can set up uploading of photos and documents to Google Drive, while your contacts, calendar and various other data are backed up to your Google account, and many apps (for example, WhatsApp) have built-in backup. Set up backup in all apps where possible, so that important information gets saved to the cloud on a nightly basis. If you don’t trust third-party clouds, there are utilities for syncing your phone with a storage server on your home network.

Optimize update downloading. Explore your smartphone settings. If updates are customizable, opt to download them at night, assuming Wi-Fi and power are available. That way, downloading updates won’t interrupt your daytime work, chew through your mobile data, or drain your battery. If there are no such settings, and update notifications often come at a bad time, you can risk turning off notifications or automatic checking for updates. In this case, you must set a regular reminder (say, once a month on a weekend) to check for updates manually through the device settings. It’s best to choose an installation time when you can afford to put your phone down for a while.

Be selective. If it’s not a critical vulnerability fix, you can put off installing it — but not for long, of course; however, waiting a few days to a week should be ok, all the while checking on forums to see if owners of the same smartphone are having issues with the update. If so, that will give time for hundreds of them to voice a complaint, and, if you’re lucky, time also for a patched version to come out.

Get rid of unnecessary stuff. Binning downloaded documents no longer needed, clearing caches, deleting unused apps and moving photos and videos to the cloud helps free up a lot of smartphone memory and reduce the likelihood of update problems. Incidentally, our mobile application for Android comes with a handy junk cleaner tool.

Update apps and firmware separately. To make it easier to track the source of potential issues, don’t update apps and firmware at the same time: after updating the operating system and vendor extensions, wait a few days before installing app updates — again, only if there are no critical vulnerability fixes.

Install Kaspersky: Antivirus & VPN on your Android device. Our application warns and protects you against known vulnerabilities, scans downloaded apps for viruses, fixes dangerous device settings, manages app permissions, blocks dangerous links, and keeps your data safe if ever your phone is lost or stolen.

Kaspersky official blog – ​Read More

How Ducktail steals Facebook accounts | Kaspersky official blog

/in

Our researchers have discovered a new version of malware from the Ducktail family. Cybercriminals are using it to target company employees who either hold fairly senior positions or work in HR, digital marketing, or social-media marketing. Their ultimate goal is to hijack Facebook Business accounts, so it makes sense that the attackers are interested in folks most likely to have access to them. Today, we talk about how attacks occur, what’s unusual about them and, of course, how to protect yourself.

Bait and malicious payload

What the cybercriminals behind Ducktail do is send out malicious archive to their potential victims. To lull the recipient’s vigilance, the archives contain bait in the form of theme-based images and video files on a common topic. For example, the theme of the most recent campaign (March to early October 2023) was fashion: emails were sent out in the name of big fashion industry players with archives containing photos of items of clothing.

However, inside these archives were also executable files. These files had PDF icons and very long file names to divert the victim’s attention from the EXE extension. Additionally, the names of the fake files appeared to be carefully chosen for relevance so as to persuade the recipients to click on them. In the fashion-themed campaign, the names referred to “guidelines and requirements for candidates”, but other bait like, say, price lists or commercial offers, can be used as well.

The malicious Ducktail archive contains a file that looks like a PDF but is in fact an EXE

After clicking the disguised EXE file, a malicious script runs on the target device. Firstly, it does indeed display the contents of some PDF file embedded in the malware code, with the hope that the victim doesn’t smell a rat. At the same time, the malware scans all the shortcuts on the desktop, the Start menu, and the Quick Launch toolbar. It searches for shortcuts to Chromium-based browsers, such as Google Chrome, Microsoft Edge, Vivaldi, Brave… Having found one, the malware alters its command line by adding an instruction to install a browser extension, which is also embedded in the executable file. Five minutes later, the malicious script terminates the browser process, prompting the user to restart it using one of the modified shortcuts.

Malicious browser extension

After the user clicks the shortcut, a malicious extension is installed in the browser, where it convincingly masquerades as Google Docs Offline, using the exact same icon and description (though only in English, which can give away the fake in some regions).

The malicious extension masquerading as Google Docs Offline (left), and the real Google Docs Offline extension (right) in the Google Chrome browser

Once installed and running, the malicious extension starts constantly monitoring all tabs opened by the user in the browser and sending information about them to the attackers’ C2 server. If it finds an address associated with Facebook among the opened tabs, the malicious extension checks for Ads and Business accounts and then hijacks them.

The extension steals information from Facebook accounts logged into on the victim’s device, as well as active session cookies stored by the browser, which can be used to sign in to the accounts without authentication.

The group behind the malware has reportedly been active since 2018. Several research teams believe it has Vietnamese origin. The group’s distribution of Ducktail can be pinpointed to 2021.

How to guard against Ducktail

To protect against Ducktail and similar threats, employees need to simply observe basic digital hygiene; in particular:

Never download suspicious archives on work computers — especially if the links come from untrusted sources.
Carefully check the extensions of all files downloaded from the internet or email before opening them.
Never click on a file that looks like a harmless document but has an EXE extension — this is a clear sign of malware.
Always install reliable protection on all work devices.This will warn you of potential danger and defeat any attacks in time. Our solutions detect this threat with the verdict HEUR:Trojan.Win64.Ducktail.gen.
You can find indicators of compromise as well as more technical details on this malware in the respective Securelist blog post.

Kaspersky official blog – ​Read More

Why Nothing Chats is unsafe | Kaspersky official blog

/in

The Nothing Chats app is a messenger created by the developer of the quite popular smartphone Nothing Phone — yet another “iPhone killer”. The main selling point of Nothing Chats is was the promise of giving Android users the ability to fully communicate using iMessage — a messaging system previously available only to iPhone owners.

However, Nothing Chats was almost immediately found to have a whole host of security and privacy issues. These problems were so serious that less than 24 hours after its release in the Google Play Store, the application had to be removed. Let’s delve into this in more detail.

Nothing Chats, Sunbird, and iMessage for Android

The Nothing Chats messenger was announced on November 14, 2023, in a video by the well-known YouTube blogger Marques Brownlee (aka MKBHD). He talked about how the new messenger from Nothing had plans to allow owners of a Nothing Phone (which is Android-based) to communicate with iOS users through iMessage.

By the way, I recommend watching the video by MKBHD, at least to see how the messenger worked.

The video also briefly outlines how the messenger operates from a technical point of view. To begin, users have to provide Nothing Chats with the login and password to their Apple ID account (and if they don’t have one yet, they need to create one). After this, to indirectly quote the video, “on some Mac mini somewhere on a server farm”, this Apple account is logged in to, after which this remote computer serves as a relay transmitting messages from the user’s smartphone to the iMessage system, and vice versa.

To give credit where credit is due, at the end of the sixth minute, the author of the video makes a point of emphasizing that this approach carries some serious risks. Indeed, logging in with your Apple ID on some unknown device that doesn’t belong to you, located who knows where, is a very, very bad idea for a number of reasons.

The coveted blue message clouds of iMessage — the main promise of Nothing Chats

The Nothing company made no secret of the fact that “iMessage for Android” was not their own development. The company partnered with another company, Sunbird, so the Nothing Chats messenger was a clone of the Sunbird: iMessage for Android application, with some cosmetic interface changes. By the way, the Sunbird app was announced to the press back in December 2022, but its full launch for a wide audience was constantly postponed.

Nothing Chats and security issues

After the announcement, suspicions immediately arose that Nothing and Sunbird would face serious privacy and security issues. As mentioned earlier, the idea of logging in with your Apple ID on someone else’s device is highly risky because this account gives full control over a significant amount of user information and over the devices themselves through the Apple feature Find My…

To reassure users, both Sunbird and Nothing asserted on their websites that logins and passwords aren’t stored anywhere, all messages are protected by end-to-end encryption, and everything is absolutely secure.

Sunbird’s website confirming the security and privacy of iMessage for Android, as well as the use of end-to-end encryption (spoiler: this isn’t true)

However, the reality was way off even the most skeptical predictions. Once the application became available, it quickly became clear that it totally failed to deliver on its promises regarding end-to-end encryption. Worse still, all messages and files sent or received by the user were delivered by Nothing Chats in unencrypted form to two services simultaneously — the Google Firebase database and the Sentry error monitoring service, where Sunbird employees could access these messages.

The FAQ section on the official Nothing Chats page also explicitly mentions end-to-end encryption

And if that still wasn’t enough, not only Sunbird employees but anyone interested could read the messages. The issue was that the token required for authentication in Firebase was transmitted by the application over an unprotected connection (HTTP) and could, therefore, be intercepted. Subsequently, this token provided access to all messages and files of all users of the messenger — as mentioned earlier, all this data was sent to Firebase in plain text.

Once again: despite assurances of using end-to-end encryption, any message from any user on Nothing Chats and all files sent by them — photos, videos, and so on — could be intercepted by anyone.

Also, the FAQ page of Nothing Chats claims that messages are never stored anywhere — doesn’t it make you want to cry?

One of the researchers involved in analyzing the vulnerabilities of Nothing Chats/Sunbird created a simple website as proof of an attack’s feasibility, allowing anyone to see that their messages in iMessage for Android could indeed be easily intercepted.

Shortly after the vulnerabilities were made public, Nothing decided to remove their app from the Google Play Store “to fix a few bugs”. However, even if Nothing Chats or Sunbird: iMessage for Android returns to the store, it’s best to avoid them — as well as any similar apps. This story demonstrates vividly that when creating an intermediary service that allows access to iMessage, it’s very easy to make catastrophic mistakes that put users’ data at extreme risk.

What Nothing Chats users should do now

If you’ve used the Nothing Chats app, you should do the following:

Log into your Apple ID account from a trusted device, find the page with active sessions (devices you’re logged in to), and delete the session associated with Nothing Chats/Sunbird.
Change your Apple ID password. It’s an extremely important account, so it’s advisable to use a very long and random sequence of characters — Kaspersky Password Manager can help you generate a reliable password and store it securely.
Uninstall the Nothing Chats app.
You can then use a tool created by one of the researchers to remove your information from Sunbird’s Firebase database.
If you’ve sent any sensitive information through Nothing Chats, then you should treat it as compromised and take appropriate measures: change passwords, reissue cards, and so on. Kaspersky Premium will help you track possible leaks of your personal data linked to email addresses or phone numbers.

Kaspersky official blog – ​Read More

A week in security (November 20 – November 26)

/in

Last week on Malwarebytes Labs:

Windows Hello fingerprint authentication can be bypassed on popular laptops

Citrix Bleed widely exploitated, warn government agencies

Chrome pushes forward with plans to limit ad blockers in the future

$19 Stanley cup deal is a Black Friday scam

Malwarebytes consumer product roundup: The latest

Explained: Privacy washing

Nothing Chats pulled from Google Play

How to stop fake System notifications on macOS

Why less is more: 10 steps to secure customer data

Atomic Stealer distributed to Mac users via fake browser updates

Scattered Spider ransomware gang falls under government agency scrutiny

Student discount: Get 50% off Malwarebytes

Stay safe!

Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

Malwarebytes – ​Read More

Windows Hello fingerprint authentication can be bypassed on popular laptops

/in

Researchers have found several weaknesses in Windows Hello fingerprint authentication on Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X laptops.

Microsoft’s Offensive Research and Security Engineering (MORSE) asked the researchers to evaluate the security of the top three fingerprint sensors embedded in laptops. They found vulnerabilities that allowed them to completely bypass Windows Hello authentication on all three.

If you like to read the full technical details, we happily refer you to the Blackwing researcher’s blog: A TOUCH OF PWN – PART I. For a less technical summary, carry on.

First but foremost, it’s important to know that for these vulnerabilities to be exploitable, fingerprint authentication needs to be set up on the target laptop. Imagine the type of disaster if that wasn’t true.

The three sensors the researchers looked at were all of the “match on chip” type. This means that a separate chip stores the biometric credentials (in this case the fingerprints), making it almost impossible to hack into.

The communication between the sensor and the laptop is done over a secure channel, set up through the Secure Device Connection Protocol (SDCP) created by Microsoft.

SDCP aims to answer three questions about the sensor:

How can the laptop be certain it’s talking to a trusted sensor and not a malicious one?

How can the lapop be certain the sensor hasn’t been compromised?

How is the raw input from the sensor protected?

The input has to be authenticated.

The input is fresh and can’t be re-playable.

So, what could go wrong?

The researchers were still able to spoof the communication between sensor and laptops. They were able to fool the the laptops using a USB device which pretended to be its sensor, and sent a signal that an authorized user had logged in.

The bypasses are possible because the device manufacturers did not use SDCP to its full potential:

The ELAN sensor commonly used in Dell and Microsoft Surface laptops lacks SDCP support and transmits security identifiers in cleartext.

Synaptics sensors, used by both Lenovo and Dell, had turned SDCP off by default and used a flawed custom Transport Layer Security (TLS) stack to secure USB communications.

The Goodix sensors, also used by both Lenovo and Dell, could be bypassed because they are suitable for Windows and Linux, which does not support SDCP. The host driver sends an unauthenticated configuration packet to the sensor to specify what database to use during sensor initialization.

The recommendation of the researchers to the manufacturers is clear: SDCP is a powerful protocol, but it doesn’t help if it isn’t enabled or when it can be bypassed by using other weak links in your setup.

The fact that three manufacturers were mentioned by name doesn’t mean by any stretch that others have done a better job. It just means the researchers didn’t get round to testing them.

If you, as a user, are worried about anyone being able to get near your laptop with a USB device, you shouldn’t be using fingerprints as an authentication method and disabled.

Type and search [Sign-in options] in the Windows search bar, then click [Open].

Select [Fingerprint recognition (Windows Hello), then click [Remove], and the fingerprint sign-in option will be removed.

Until the manufacturers have dealt with the weaknesses in their setups, we can’t assume that this is a secure method of authentication.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Malwarebytes – ​Read More

Chrome pushes forward with plans to limit ad blockers in the future

/in

Google has announced it will shut down Manifest V2 in June 2024 and move on to Manifest V3, the latest version of its Chrome extension specification that has faced criticism for putting limits on ad blockers. Roughly said, Manifest V2 and V3 are the rules that browser extension developers have to follow if they want their extensions to get accepted into the Google Play Store.

Manifest V2 is the old model. The Chrome Web Store no longer accepts Manifest V2 extensions, but browsers can still use them. For now. Manifest V3 is supported generally in Chrome 88 or later and will be the standard after the transition planned to take place in June 2024.

A popular type of browser extensions are ad blockers. Almost all these ad blockers work with block lists, which are long lists of domains, subdomains, and IP addresses that they filter out of your web traffic. These lists are commonly referred to as rulesets. One part of the transition will “improve” content filtering. And to be fair, Google has made some compromises when it comes to the version as it’s now in the planning, compared to what it originally planned to do.

Originally, each extension could offer users a choice of 50 static rulesets, and 10 of these rulesets could be enabled simultaneously. This changes to 50 extensions simultaneously and 100 in total.

Extensions could add up to 5,000 rules dynamically which encouraged using this functionality sparingly and made it easier for Google to detect abuse. Extensions can add rules dynamically to support more frequent updates and user-defined rules. But it comes with the risks of phishing or data theft because these “updates” are not checked during the Chrome Web Store review. For example, a redirect rule could be abused to inject affiliate links without consent. But Google has decided that block and allow are not that easily abused so it will allow up to 30,000 rules to be added dynamically.

However, this is still far from enough to fully reach the potential of the best ad blockers we have now. And it’s not just the hard limits on filtering rulesets, there are a lot of other new limits on filtering. Items can’t be filtered based on the response headers or according to the URL in the address bar. Also, extension developers are limited in what regular expressions they can use, along with other technical limitations.

Even if this is not targeted at ad blockers specifically, it’s still a major change that makes blocking requests less flexible. But the bottom line result is that it limits the API that many ad blockers use, and replace it with a less capable one.

Google’s will tell you that by limiting extensions, the browser can be lighter on resources, and Google can protect your privacy from extension developers and calls it “a step in the direction of privacy, security, and performance.” The Electronic Frontier Foundation (EFF) however calls Manifest V3 deceitful and threatening.

“Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.”

Under the new specifications, browser extensions that monitor and filter the web traffic between the browser and the website will have greatly reduced capabilities. This includes ad blockers and privacy-protective tracker blockers. No real surprise, considering Google has trackers installed on 75% of the top one million websites.

According to Firefox’s Add-on Operations Manager, most malicious extension that manage to get through the security review process, are usually interested in simply observing the conversation between your browser and whatever websites you visit. The malicious activity happens elsewhere, after the data has already been read. So in their mind, what would really help security is a more thorough review process, but that’s not something Google says it has plans for.

After looking at the arguments Google used to justify this transition, ArsTechnica came to the conclusion that there’s no justification for arbitrarily limiting the list of filter rules. It says once Manifest V3 happens, Chrome users will be limited to light ad blocker functionality while users will need to switch to Firefox or some other non-limited browser to get the full extension.

Nevertheless, Firefox said it will adopt Manifest V3 in the interest of cross-browser compatibility. And Chrome’s market share will certainly have influenced that decision as well.

Google Chrome Enterprise users with the “ExtensionManifestV2Availability” policy turned on will get an extra year of Manifest V2 compatibility.

If you want to help Malwarebytes get ready for the transition, you can test the beta version of Browser Guard for Manifest V3.

We don’t just report on privacy—we offer you the option to use it.

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

Black Friday sale

Save 50% on our Home bundles for a limited time only!

CHECK OUT DEALS

Malwarebytes – ​Read More

Malwarebytes consumer product roundup: The latest

/in

At Malwarebytes, we’re constantly evolving to protect our customers. These days, our products don’t just protect you from malware, we protect your identity, defend you from ads, safeguard your social media, and keep your mobile safe too.

Here are the innovations we’ve made in our products recently. Are you making the most of them?

Malwarebytes Premium

Windows

Tamper / Uninstall Protection. This allows you to password protect your software so that it can’t be removed remotely.

Trusted Advisor. This dashboard provides an easy-to-understand assessment of your computer’s security with a single comprehensive protection score, and clear, expert-driven advice.

Brute Force Protection. This blocks Remote Desktop Protocol (RDP) attacks, which are attempts by cybercriminals to access a computer remotely. We do this by blocking IP addresses that exceed a threshold of invalid login attempts.

Smart Scan. This enables you to schedule scans at a time when you’re not using your computer, which is best for productivity.

Mac

The old adage about Macs not getting viruses is simply not true. Macs need protection too and our Premium for Mac is now compatible with macOS Sonoma.

Mobile Security

Whether you’re on iOS or Android, our Mobile Security app just got an upgrade. Our Premium Plus plan now includes a full-featured VPN to help keep your connections private, no matter where you are. Using the latest VPN technology, WireGuard® protocol, you can enjoy better online privacy at a quicker speed than traditional VPNs.

What you get with our apps:

Android: Scan for viruses and malware, and detect ransomware, android exploits, phishing scams, and even potentially unwanted apps.

iOS: Detect and stop robocalls and fake texts, phishing links, malicious sites, and annoying ad trackers (while browsing in Safari).

Browser Guard

Available for both Windows and Mac, Malwarebytes Browser Guard is our free browser extension for Chrome, Edge, Firefox, and Safari that blocks unwanted and unsafe content, giving users a safer and faster browsing experience. It’s the world’s first browser extension to do this, while at the same time identifying and stopping tech support scams.

Browser Guard adds an extra layer to your personal security, on top of your antivirus or firewall. Because it’s a browser extension, it can offer protection in the browser that other means of protection do not have access to.

We’ve recently made enhancements to Browser Guard:

Improved protection: Stops even more threats with enhanced phishing detection. 

New scanning blocks: Prevents websites from scanning for vulnerable network ports. 

Facebook support: Blocks ads and sponsored content from appearing on Facebook feeds. 

Monthly overview: Summary showcases what has been blocked. 

On top of that, Malwarebytes Premium Security users (Windows only) can now take advantage of:

Content control: Take control of your browsing experience and define what’s appropriate for you and your family. Fully customize the content you want to block while browsing.

Import and export: Use your preferences and customized rules with all your browsers, even on other devices. This helps you to experience a consistent and clean web experience. Discover on this video how to transfer Malwarebytes Browser Guard settings to another browser.

Historical Detection Statistics: View past detections and see what we’ve protected you from.  

Want to see Browser Guard in action? Read the 25 most popular websites vs Malwarebytes Browser Guard

Malwarebytes Identity Theft Protection

Newly released, Malwarebytes Identity Theft Protection scours the dark web for your personal information, prevents your social media account from being hacked, and even keeps an eye on your credit (US only) — and it’s all backed by an up-to-$2 million identity theft insurance. (Insurance coverage is $1 or $2 million depending on selected package (latter only available in the US plan Ultimate))

Here’s what you get (based on your selected plan):

Ongoing monitoring: Peace of mind that we are actively working in the background to keep you safe

Real-time alerts: Immediate notifications if we identify suspicious activity

Recommendations and best practices: Advice on how to prevent identity theft, and help if it happens

Identity restoration helpline and top-notch customer support.

Black Friday sale

Save 50% on our Home bundles for a limited time only!

CHECK OUT DEALS

Malwarebytes – ​Read More

Explained: Privacy washing

/in

Question: Who said the sentence below?

“Privacy is at the heart of everything we do.”

Answer: Sundar Pichai, the CEO of Alphabet and its largest subsidiary Google. And if you look at the recent actions Google has announced, you’d be tempted to take his word for it:

An initiative to let Chrome hide your IP address.

Strengthening the safeguard measures for Google Workspace customers.

Changing data retention practices to make auto-delete the default.

But at the same time, Google is under fire because some of its actions seem half-baked. Allegedly Google’s option to “browse privately” is nothing more than a word play.

Let’s be fair. Google makes lots and lots of money by knowing what we are looking for. And to achieve that goal it needs to gather as much information as possible about us. Maybe not specifically about us as a person, but at least about us as a group.

Data are the most coveted currency of our era, and technology giants like Facebook, Google, and Amazon are considered the behemoths of the data gathering industry. If they don’t already, they want to know everything about each and every one of us.

We’re not all equally valued though. Certain milestones in a person’s life prompt major changes in buying patterns, whether that’s becoming a parent, moving home, getting married, buying a car, or going through a divorce. Some of the most personal and secretive troves of data rank as the most expensive.

In a recent blog, privacy company Proton explained how Google is spending millions lobbying and actively fighting against privacy laws that would protect you from online surveillance.

Proton used the expression, “privacy washing” which compares Google’s disparity between actions and words to those of the world’s largest environmental polluters who portray themselves as eco-conscious, known as “green washing.“

According to lobbying reports and other records, Alphabet and its subsidiaries have spent more than $125 million on federal lobbying, campaign contributions, and trade associations since 2019.

This is done under the guise that Google wants regulators to let companies decide themselves what’s good for you and for society. But so far, big tech is consistently letting us down in this regard.

A small but telling example was a recent court case where a judge ruled that car manufacturers collecting users’ text messages and call logs did not meet the Washington Privacy Act’s (WPA) standard that a plaintiff must prove that “his or her business, his or her person, or his or her reputation” has been threatened.

In other words they can steal all the data they want as long as you can’t prove that it doesn’t hurt your business, yourself or your reputation. Does that sound fair to you?

Several US states are going through the process of passing new comprehensive consumer privacy laws, in an attempt to give American citizens more control over their personal data. Privacy advisor IAPP reckons that by 2026, 13 state privacy laws will have taken effect, as newly enacted laws in Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, and Texas will join California, Colorado, Connecticut, Utah, and Virginia.

The European Union (EU) is a pioneer when it comes to privacy laws, so it’s easy to see why Big Tech has spent so much money (about $30 million in 2021) lobbying European lawmakers to protect their data gathering practices. Google has been among the most aggressive to water down or slow down the expansion of consumer protections through additional regulations — in particular the Digital Markets Act, Digital Services Act, and ePrivacy Regulation. Google happily bragged about stalling the ePrivacy Regulation, which would crack down on tracking cookies.

It’s common for industries to lobby lawmakers on issues affecting their business. But there is a massive disparity in the state-by-state battle over privacy legislation between well-funded, well-organized tech lobbyists and their opposition of relatively scattered consumer advocates and privacy-minded politicians, The Markup has found.

So, Sundar Pichai, we would like you to put your money where your mouth is. And make some real changes to improve our privacy, rather than engage in privacy washing.

We don’t just report on threats – we help safeguard your entire digital identity

Cybersecurity risks should never spread beyond a headline. Protect your and your family’s personal information by using Malwarebytes Identity Theft Protection.

Malwarebytes – ​Read More

Nothing Chats pulled from Google Play

/in

Sometimes it’s all in the name. The Nothing Chats beta has been pulled from the Google Play Store after reports that the company behind it has access to your (unencrypted) messages.

Nothing Phone 2 owners were promised a first-of-its-kind app developed in partnership with Sunbird, which allowed them to message other iMessage users via blue bubbles on their Nothing Phone.

And, as promised, the beta version was made available for download in the Play Store on Friday November 17, 2023. But today the Nothing Chats page says:

We’ve removed the Nothing Chats beta from the Play store and will be delaying the launch until further notice to work with Sunbird to fix several bugs. We apologize for the delay and will do right by our users.

Now, it’s pretty normal for beta releases to have some bugs that need ironing out. That’s what they are in beta for. But these weren’t some mildly annoying bugs.

Basically, Nothing Chats is just a reskinned version of the existing Sunbird application, which is currently available on the Google Play Store. In essence the Nothing Chats app routes your messages through a macOS virtual machine that sends them on as iMessages. But to do this the Nothing Chats application is required to send your Apple ID credentials to its servers, so it can authenticate on your behalf.

According to Nothing, Sunbird’s architecture provides a system to deliver a message from one user to another without ever storing it at any point in its journey. But only one day after the release of the beta, Texts.com published a blog titled Sunbird / ‘Nothing Chats’ is Not Secure.

Members of the Texts.com reverse engineering team took it upon themselves to take a look into the Sunbird application and its security practices, and found a few vulnerabilities and implementation issues.

texts team took a quick look at the tech behind nothing chats and found out it’s extremely insecure

it’s not even using HTTPS, credentials are sent over plaintext HTTP

backend is running an instance of BlueBubbles, which doesn’t support end-to-end encryption yet pic.twitter.com/IcWyIbKE86

— Kishan Bagaria (@KishanBagaria) November 17, 2023

While Sunbird tries to implement end-to-end-encryption (E2EE), its implementation is overshadowed by decrypting, and then storing the unencrypted payloads in its database.

The apps route all data relating to a message sent by Sunbird, and Nothing Chat, including the contact information, message contents, and attachment URLs to the Sunbird’s Sentry. This Sentry acts as a debugging platform, which allows access to the data in plaintext by authorized parties within the company.

Which is not what Nothing promised:

All Chats messages are end-to-end encrypted, meaning neither we nor Sunbird can access the messages you’re sending and receiving.

Other investigators found that Nothing Chats sends all media attachments, including user images, to Sentry with links to those attachments visible in plain text.

Thread time!

Summary:
– Sunbird has access to every message sent and received through the app on your device.

– All of the documents (images, videos, audios, pdfs, vCards…) sent through Nothing Chat AND Sunbird are public.

– Nothing Chats is not end-to-end encrypted.

— Dylan Roussel (@evowizz) November 18, 2023

Nothing Chats sends all media attachments, including user images, to Sentry with links to those attachments visible in plain text. Further, researchers found all data was sent and stored through Firebase. They found over 630,000 media files currently stored by Sunbird via Firebase including images, videos, PDFs, audio, and more. So, while it may be true that Sunbird doesn’t store user data on its own servers, the data does get stored.

This isn’t a major problem for everyone, but the authentication is. By sending our Apple ID to a third-party service, we are not only trusting the third-party with our texts, but should they become compromised, our photos, videos, contacts, notes, keychain, and more are at risk.

Users worried about a spill of sensitive data should read our guide: Involved in a data breach? Here’s what you need to know.

We don’t just report on threats—we remove them

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Malwarebytes – ​Read More

Why less is more: 10 steps to secure customer data

/in

In an advisory aimed at the protection of customers’ personal data, the Australian Cyber Security Centre (ACSC) has emphasized that businesses should only collect personal data from customers that they need in order to operate effectively.

While that may seem like kicking in an open door, it’s really not. It’s relatively easy to decide which personal data you need to have for a new customer. It’s a bit harder to stop there. Many small business use pre-formatted questionnaires that ask for information they don’t actually need for day to day operations, and it’s hard to keep track of data they no longer need.

The advisory, titled Securing Customer Personal Data for Small and Medium Businesses, is written for small and medium businesses, but many larger corporations could benefit from it as well. The guide was written because data breaches against Australian businesses and their customers are increasing in complexity, scale, and impact.

It outlines a few steps businesses can take to organize, minimize, and control the personal data they collect, in order to contain the impact of a data breach. With the growing tendency to do business online, businesses have a responsibility to keep the personal data they collect safe.

The ACSC recommends implementing 10 steps to secure customer personal data:

Create a register of personal data. Keep an inventory of the types of data you have collected and where they are stored. For example, a register of databases and data assets.

Limit the personal data you collect. Do not collect data “just in case.” You don’t have to worry about what you don’t have stored.

Delete unused personal data. Probably the hardest step, it takes policies stipulating how long customers’ personal data should be stored before it is deleted.

Consolidate personal data repositories. Consolidating customers’ personal data into centralized locations or databases allows businesses to focus on key data repositories and apply enhanced security practices.

Control access to personal data. Employees should only have access to customers’ personal data that they need in order to do their job.

Encrypt personal data. Full disk encryption should be applied to devices that access or store customers’ personal data, such as servers, mobile phones and laptops. Customers’ personal data should be protected by encryption when communicated between different devices over the internet. Additionally, businesses may choose to implement file-based encryption to add an extra layer of protection in the event that systems are compromised as part of a cyberattack.

Backup personal data. Backups are an essential measure to ensure an organization can recover important business data in case of damage, loss or destruction. Backups are also critical in protecting customers’ personal data from common incidents such as ransomware attacks or physical damage to devices.

Log and monitor access to personal data. Implementing logging and monitoring practices can assist businesses in detecting unauthorized access to customers’ personal data.

Implement secure Bring Your Own Device (BYOD) practices. Businesses that employ BYOD policies need to have appropriate protections in place to ensure that this is done securely and does not increase the risk of data breaches. It’s important to have a clear policy and rules to enforce it.

Report data breaches involving personal data. Make sure you are aware of the existing local reporting obligations in case you are the victim of a data breach involving customers’ personal data.

Our business solutions remove all remnants of ransomware and prevent you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.

TRY NOW

Malwarebytes – ​Read More