Google Discovers New Android Malware Called Tizi

The security team of Google has discovered a brand new type of Android malware. Called Tizi, the malware has so far been used mainly to target users in African nations.

Tizi is categorized as spyware, meaning it could access data in your device.

According to Google, Tizi’s capabilities are many though its main focus is on social media applications and activities. As per the security engineers at Google Threat Analysis and Google Play Protect, Tizi could be put to use for the following purposes:

• Stealing information from social media apps like Twitter, WhatsApp, Skype, Telegram, LinkedIn, Viber and Facebook.
• To record calls on Skype, WhatsApp and Viber.
• Recording ambient audio using microphone.
• To take pictures of the screen without letting the user know.
• Sending and intercepting SMS messages on the infected gadgets.
• Accessing calendar events, photos, call logs, wi-fi encryption keys and also apps that are locally installed in the device.
• When the Spyware infects a device first, it sends the GPS coordinates of the device through SMS to a C&C server(C& C servers are Command and Control servers that are used to remotely send commands to botnets, which are networks of internet connected devices).
• Any subsequent communication with the attacker’s C&C server happens through HTTPS and in certain isolated cases, through MQTT (both HTTPS and MQTT are communication protocols used over the internet).

The spyware was spotted by Google engineers in September 2017.

It was found rather serendipitously when automatic scans done with Google Play Protect — the security scammer in the Google play Store app — came across an app infected by Tizi. The infected app was installed in a user’s device through the Google Play Store.

This led the Google team to look into the older versions of the apps on the Play Store. During this process, they found even more Tizi-infected apps, some of them going as far back as October 2015.

According to Google, they then uninstalled the Tizi apps from the infected devices using the Google Play Store app.

Meanwhile, data gathered by Google shows that most of the infected users were in African nations. However, it’s not clear if the author/distributor of Tizi is located in the African continent.

So far, there has been no significant effort to trick people into installing the apps in large numbers. Also, security researchers are of the view that the spyware was most probably used for targeted attacks against a limited number of people chosen for some unknown reason.

According to Google, Tizi’s capabilities are based on vulnerabilities seen only on older Android devices.

All the same, as an extra-precaution to keep your Android device safe from the malware, Google recommends the following steps:

• Check permissions: Be careful about apps that request permissions that strike you as unreasonable. For instance, a flashlight app would have no need to access anything related to sending SMS messages.
• Enable secure lock screen: Google recommends you to pick a pattern, PIN or password that’s easy for you to remember but which would be hard for anyone else to guess.
• Keep your device up-to-date: Having the latest security patches in your device is a great idea, says Google.
• Google Play Protect: Ensure that you have enabled Google Play Protect.

Firefox “Breach Alerts” Will Warn If You Visit A ‘Hacked’ Website

Mozilla Firefox is trying its best to get back in the browser game. It recently overhauled is browser inside out with the Firefox Quantum and how it is planning to add extra features to the privacy focused browser. The team at Mozilla have teamed up with the website “Have I Been Pwned” to bring a safety feature that will warn you when you are about to visit a website that has been hacked or suffered a data breach. If you are familiar with the “Have I Been Pwned” service, you know that it is a website where you can enter your email id and verify if your credentials on any website you might have used to login have been stolen by hackers. 

 ​

The implementation of this security feature is in its early stages, and we mean very early stages. If you are adventurous you can use the Developer Edition of Firefox and download the GitHub resource to activate it. Both Mozilla and the team from “Have I Been Pwned” are tested various ways in which there services can be integrated. It is expected that the final feature will be a overlay screen which will display a warning if you are visit a website that is on the “Have I Been Pwned” blacklist. Just like every other security warning on Firefox there will be a “Know More” link where users can read about the details of the security risk and as always users will be allowed the access the questionable website if they agree to take the risk.

This feature is still under development and is expected to be rolled out to the public by next year. Website owners are giving this a mixed response. Some think that this will help instill faith and make sure that a website is 100% secure while others point out the flaws with the “Have I Been Pwned”’ system. They say if the website has suffered a breach in the past which has since been rectified by the website administrator, the website still remains on the “Have I Been Pwned” blacklist and when Firefox users see a warning they shall hesitate to visit the website even if it has been deemed safe.

Source: Github (Firefox)