SWITCH Security-Blog

SWITCH-CERT IT-Security Blog

Mobile Malware


Rogue Mobile App

Rogue mobile apps are counterfeit apps designed to mimic trusted brands or apps with non-advertised malicious features. In both cases, the goal is that unaware users install the app in order to steal sensitive information such as credit card data or login credentials.

The common way to install apps is to use the official app store. By default, neither Android nor Apple’s iPhone allow users to install apps from unknown sources. However, this does not mean we can just trust the official app store. SWITCH-CERT has been monitoring Apple’s App Store and Google Play for some time and noticed that many rogue apps are able to sneak into Google Play especially.

Google Play

Attackers are abusing the weak app testing procedure of Google to sneak their rogue apps into Google Play. One can find counterfeit apps of Swiss brands on a regular basis. Typically, the apps reside on Google Play for some time until it is removed because of take down requests from security researchers. Until that happens, unaware users are likely to install such apps and put their data at risk.

The screenshot below shows apps found when searching for Bluewin. During the last months, Bluewin has been a common target for rogue counterfeit apps. The red circle indicates the rogue app.

Play Store result for the search key word “Bluewin”

Continue reading


The November/December 2018 issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report is available!

The topics covered in this report are:

  • SiSyPHuS gives Windows 10 low marks for data protection and security
  • Vivy app suffering from multiple diseases: security researchers uncover several vulnerabilities in the patient data app
  • Facing court: Chinese facial recognition unfairly lands big entrepreneur in hot water
  • Not exactly cuddly: data protection authority imposes first GDPR fines after hacking attack

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.

Did you miss our previous Security Report? Click here to go to the archive.


The Sep/Oct 2018 issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our SWITCH Security Report has just been released.

The topics covered in this report are:

  • Turning Good instead of Breaking Bad? Hacking to fend off other hackers
  • What do a firefighter and Google Chrome 69 have in common?
  • 15 months later: new attacks, same old vulnerability
  • Peekaboo exploits vulnerability in surveillance cameras in a major way

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.

Did you miss our previous Security Report? Click here to go to the archive.

 


A new issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report is available!

The topics covered in this report are:

  • An own goal and serious foul: Spanish football league’s app turns 10 million users into involuntarily spies
  • Amazon Rekognition – useful security and convenience tool or total surveillance for pennies?
  • An underestimated risk: the number of malware attacks on smartphones and tablets is exploding
  • Phishing with the stars: scammers take advantage of our celebrity obsession and the crypto craze to cause harm to users

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.


Top 1000 .ch Domain Names

UPDATE 19.02.2019:

From February 2019 on there will be a few small changes. A co-worker, Antoine, has discovered a flaw in the current measurement of the top 1000 .ch domain names which has been removed by now. Since we only counted the number of distinct IP addresses per domain for both IP versions, using IPv6 one can easily send queries from a whole /64 range which results in approximately 1.8*10^19 different addresses. Being a private customer of the Swiss ISP Init7 even gives you an entire /48 range. Like that you can easily push a domain name to the top! In order to prevent this from happening we will now count the distinct number of ASes per domain.

Additionally, we will provide 2 lists from now on. One that contains a ranking based on ALL queries, i.e. including queries that have returned NXDOMAIN, and one whithout those NXDOMAIN queries. Previously, we just provided the former. Continue reading


The May/June 2018 issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report has just been released.

The topics covered in this report are:

  • Microsoft will never contact you by phone: support scam continues to gain momentum
  • «Efail» between hype and disaster: the security world needs to learn how to communicate
  • Sonic waves on the attack, recent incidents are reason to prick up your ears
  • Waterholing attacks: infrastructure is and remains a target

The Security Report is available in both English and German.

»»  Download the English report.      »»  Download the German report.

Did you miss our previous Security Report? Click here to go to the archive.

 


The March/April 2018 issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report has just been released.

The topics covered in this report are:

  • The dark side of the Data Force: Facebook, Cambridge Analytica, and the pressing question of who is using whose data for what
  • News from the world of state trojans: Microsoft’s analysis of FinFisher
  • Russian APT28 hackers’ month-long infiltration of the computer network of Germany’s federal government
  • Bitcoin bounty or close encounter: bizarre side-effects of cryptomining

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.

Did you miss our previous Security Report? Click here to go to the archive.

 


Additional DNSSEC Training with PowerDNS on May 7 and 8

We announced 3 one day DNS trainings in the end of February and all three trainings where fully booked within 24 hours. We are happy to see so much demand for DNSSEC in Switzerland.
We managed to add two more dates for the DNSSEC training together with PowerDNS
The training will be given at the following dates in Zurich:

7.5. Zurich, SWITCH
8.5. Zurich, SWITCH

The one day training will give you an introduction into DNSSEC and show you how to sign DNS zones on an autoritative DNS server.
We will use PowerDNS for the practical and hands on part. PowerDNS contains support for DNSSEC, enabling the easy serving of DNSSEC secured data, with minimal administrative overhead.

Agenda:

• Short introduction to DNSSEC
• how DNSSEC works
• keys / signatures / NSEC / NSEC3
• Working with DNSSEC and the PowerDNS Authoritative server
• Short overview over PowerDNS Authoritative server backends (MySQL, PostgreSQL, BIND, pipe, …)
• DNSSEC signing
• Pre-signed zones
• CDS
• Zone transfers
• Utilities (pdnsutil)
• The PowerDNS ALIAS record (and its future)

Required skills: Unix system administrator skills and DNS server know how.The training will be delivered in english.

More information and registration here:

https://www.eventbrite.com/e/dnssec-training-zurich-may-7-tickets-44474772241
https://www.eventbrite.com/e/dnssec-training-zurich-may-8-tickets-44474795310


A Day in the Life of nic.ch

Ever wondered what the DNS traffic looks like on a usual day on a .ch name server? This article briefly sketches the landscape of systems querying .ch domains. To be exact, the following statistics and statements are based on a small subset of the overall data since the underlying sources just consist of 2 out of 8 name servers, i.e. a.nic.ch and b.nic.ch.  Overall the .ch zone consists of 8 name servers distributed all over the world. While some of them are setup as anycast network, others are set up traditionally as unicast servers located in a single data center.

We capture the DNS traffic as pcaps and subsequently process and store it with the help of Entrada which relies on HDFS and Impala. Currently, we operate a Hadoop cluster with 7 data nodes which provides us with a good basis for future in-depth analysis.

The following sections discuss two statistics that we publish on www.nic.ch in greater detail.

Who queries the name servers?

To start with, let’s have a look at who queries our name servers. Figure 1 shows the top 10 countries in terms of generated DNS traffic observed during week 4 of 2018. Additionally, the share of distinct IP addresses per country is displayed with a second bar. Since the original DNS traffic does not contain explicit information about the country where the query originates from this information is being added by Entrada with the help of the Maxmind database. To have a more representative image of the DNS landscape, Google resolvers and OpenDNS resolvers are excluded from this statistic.  Although from the queries themselves one cannot be sure about the nature of the querying system, for convenience, throughout this article we’ll call those systems resolvers.

top_ten_countries.png

Figure 1

Continue reading


5 Comments

DNSSEC training with PowerDNS in Switzerland

SWITCH is organising a one day DNSSEC training together with PowerDNS

The training will be given at the following dates:

9.4. Zurich, SWITCH
10.4. Bern, Uni
11.4. Carouge HESGE

The one day training will give you an introduction into DNSSEC and show you how to sign DNS zones on an autoritative DNS server.
We will use PowerDNS for the practical and hands on part. PowerDNS contains support for DNSSEC, enabling the easy serving of DNSSEC secured data, with minimal administrative overhead.

Agenda:

• Short introduction to DNSSEC
• how DNSSEC works
• keys / signatures / NSEC / NSEC3
• Working with DNSSEC and the PowerDNS Authoritative server
• Short overview over PowerDNS Authoritative server backends (MySQL, PostgreSQL, BIND, pipe, …)
• DNSSEC signing
• Pre-signed zones
• Zone transfers
• Utilities (pdnsutil)
• The PowerDNS ALIAS record (and its future)

Required skills: Unix system administrator skills and DNS server know how.The training will be delivered in english.

More information and registration here:

Zurich: https://www.eventbrite.com/e/dnssec-training-zurich-tickets-43350331007
Bern: https://www.eventbrite.com/e/dnssec-training-bern-tickets-43592055010
Carouge: https://www.eventbrite.com/e/dnssec-training-carouge-tickets-43592840359

Update 28.2.2018: All three trainings are fully booked after only 24 hours. We are happy to see so much interest in DNSSEC in Switzerland. Waitlist is now open.


A new issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report is available!

The topics covered in this report are:

  • Meltdown and Spectre: security meltdown directly from the processor
  • Leaks, fakes and cryptocurrency hacks: business models of a different kind
  • Italianitá in the smartphone – state trojan monitors smartphone users
  • Kaspersky shut out of Lithuania as well
  • Strava leaks – fitness secrets of a different kind

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.


A new issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report is available!

The topics covered in this report are:

  • Dresscode for apps in the Google Play Store: malicious
  • Quad9 – does it offer a data protection-friendly alternative to Google DNS?
  • Uber’s customer and driver data on a highway to the Dark Net
  • An earful of espionage: when headphones become listening devices

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.


1 Comment

Breaking security controls using subdomain hijacking

Users obtain a domain name to establish a unique identity on the Internet. Domain names are not only used to serve names and addresses of computers and services but also to store security controls, such as SPF or CAA records. Many of the Internet protocols were designed at a time where built-in security was not a requirement. The IETF continues to standardize protocol extensions to address today’s security needs.

For some protocols security is added with controls stored in your domain names zone file. In order to have the desired effect, the pre-condition is of course that your domain name is secure. In other words, the security of your application that makes use of controls in DNS is only as secure as the security of your domain name.

Hijacking a domain name because of weak credentials at the registrar may get the job done but this is far from stealthy and will likely not last long. In many cases it is sufficient to hijack an abandoned subdomain. Taking over abandoned subdomains may be unnoticed by the owner for a very long period of time making it also very useful for targeted attacks.

Picture 1: update.ft.com has been hijacked and the content from the ft.com front page is mirrored with a fake article about subdomain hijacking. Note: the website is not online anymore, Financial Times has been notified to remove the abandoned record from their zone file. A Certificate Transparency (CT) log proves that a TLS certificate has been issued for this demo site.

Continue reading


A new issue of our SWITCH Security Report is available!

Dear Reader!

A new issue of our bi-monthly SWITCH Security Report is available!

The topics covered in this report are:

  • Attack of the digital dolphins: hacking Alexa, Siri and their friends via ultrasound
  • The anti-antivirus programme: US government bans agencies from installing Kaspersky software on their computers
  • A hack of ‘epic proportions’ at Equifax
  • Science fiction 4.0 – how to hack a computer with a drop of saliva

The Security Report is available in both English and German.

»»  Download the english report.      »»  Download the german report.

Did you miss our previous Security Report? Click here to go to the archive.


1 Comment

Money for Nothing and Coins for Free

written by Antoine Neuenschwander

Beginning in mid-September 2017, we started seeing a new abuse scheme on .ch and .li domains. The websites in question were running on outdated software and inevitably, hackers exploited some well-known vulnerability in order to inject malicious code. At this point we would usually expect an exploit kit in the website’s content with the purpose of infecting the victim’s machine with malware. In these cases however, the Javascript inject often looked somewhat like the following:

This code is designed to run in the background of the victim’s browser and immediately starts an endless loop of intensive computations at full pace, effectively turning the browser into a hash-crunching mule for the sake of distributed mining of cryptocoins, with profits going directly to the hacker.

Continue reading