North Korea Targeting Defectors with Android Malware Attacks
With most malware campaigns, the goal is to infect as many people as possible. That’s not the case with the latest attack uncovered by researchers at McAfee. The company’s mobile research team reports that North Korea has been caught tinkering with Android malware again, but this time it’s using both Facebook and Google Play to target North Korean defectors living in South Korea.
According to McAfee, North Korea’s Sun Team hackers perpetrated the attack over the last several months. They likely infected around 100 targets, which isn’t a huge number compared with most malware campaigns. However, these were all highly targeted infiltrations to gather intelligence on political opponents. There are currently around 30,000 North Korean defectors living in the south.
The hackers used Facebook to distribute links to the malicious apps, focusing on populations and individuals who would have information about defectors. They created convincing fake profiles, often using images stolen from South Korean users as profile photos. Their posts asked the targets to download and test some Android apps hosted in the Play Store. These apps, however, were not what they appeared.
McAfee researchers found three apps uploaded by Sun Team hackers: 음식궁합 (Food Ingredients Info), Fast AppLock, and AppLockFree. All three were listed as “unreleased” in the Play Store, which kept them from garnering unwanted attention. The hackers only wanted to send specific targets to the listings. Upon installation, the apps would ask for access to contacts, SMS data, and local files before sending it all to the malware operators. This data could lead to more targets for future malware attacks, including both defectors and those who help them escape North Korea. McAfee tied the apps together as part of a single attack from the use of identical developer accounts, emails, and IP addresses.
Luckily, McAfee believes Sun Team to be low on technical skill. The malware attempts to gain control of the target devices, but it uses publicly available sandbox escape, privilege escalation, and code execution exploits. Most devices are patched to block these attacks. So, McAfee suggests Sun Team doesn’t have the technical skill at this time to find new zero-day attacks on Android.
The researchers alerted Google and Facebook to the operation. Google has removed the malicious unreleased apps from the Play Store, and Facebook nuked the fake accounts. McAfee recommends users avoid installing apps that are unreleased or obscure to make sure they aren’t being phished.
Continue reading
Huawei Sells Honor Brand Amid Tightening Trade Restrictions
(Credit: Kevin Frayer/Getty Images)Huawei has been battered by US trade restrictions in the last few years, and it’s taking a toll on the company’s long-term stability. Experts don’t expect a radical change when the new US administration comes to power next year, so Huawei is beginning to take drastic action. It has sold its Honor…
Report: Apple Ignored its Partners’ Repeated Violations of Chinese Labor Laws
Apple has reportedly turned a blind eye to repeated violations of Chinese labor law in its partners' factories over the past six years.
NASA Begins Assembling Spacecraft to Study Enormous Metallic Asteroid
Next year, this piece of hardware will ride a SpaceX rocket into orbit, and then it's off to the asteroid belt to study its namesake, the metal-rich asteroid 16 Psyche.
Norton Adds Crypto-Mining to Norton 360 for Some Reason
Norton wants to be your trusted provider for crypto mining — for the few minutes you leave its software installed, anyway.