Search This Blog

Powered by Blogger.

Blog Archive

Labels

About Me

Showing posts with label Apps. Show all posts

Stalkerware: How Scammers Might Be Tracking Your Phone and What You Can Do

 


Spyware applications designed to secretly monitor people’s phones are becoming more common. These programs, known as stalkerware, can track private messages, calls, photos, locations, and other personal data without the user’s knowledge. Often installed without permission, they operate silently in the background, making them difficult to detect. In many cases, they even disappear from the home screen to avoid suspicion.  

How Stalkerware Works

Stalkerware exploits built-in features of a phone to collect information. It can monitor calls, read texts, access notifications, and track locations. Since these apps run continuously in the background, they can slow down the device, cause overheating, and increase data usage. Because they often disguise themselves with names like “System Service” or “Device Health,” users may not realize they are installed.  

Warning Signs of Stalkerware  

It can be hard to tell if your phone has been infected with spyware, but certain unusual behaviors may indicate its presence. These include:  

• Your phone becoming slow or lagging unexpectedly  

• Overheating, even when not in use  

• Unusual spikes in data usage  

• Strange apps with broad permissions appearing in your settings  

If you notice any of these issues, it’s important to check your device for unauthorized applications.  


How to Find and Remove Stalkerware  

If you suspect someone is spying on your phone, take the following steps to locate and delete the tracking software:  

1. Activate Google Play Protect – This built-in security tool scans apps and helps detect harmful software. You can turn it on in the Play Store under "Play Protect."   

2. Check Accessibility Settings – Many spyware apps request special permissions to access messages, calls, and notifications. Review your phone’s accessibility settings and remove any suspicious apps.  

3. Inspect Device Admin Permissions – Some spyware disguises itself as essential system software to gain control over your phone. Check the “Device Admin” section in your settings and disable any unfamiliar apps.  

4. Review Notification Access – Spyware often requests access to notifications to track messages and alerts. If an app you don’t recognize has these permissions, it may be monitoring your activity.  

5. Delete Suspicious Apps – If you find an unknown app with excessive access to your personal data, disable and uninstall it immediately.  


How to Protect Your Phone from Spyware

Before removing stalkerware, be cautious—if someone installed it to monitor you, they might get alerted when it’s deleted. If you believe you’re in a risky situation, seek help before taking action. To prevent spyware infections in the future, follow these security tips:  

1. Use a Strong Screen Lock – Set a PIN, password, or fingerprint lock to prevent unauthorized access.  

2. Enable Two-Factor Authentication (2FA) – Adding an extra layer of security helps protect your accounts.  

3. Avoid Unverified Apps – Download applications only from trusted sources like the Google Play Store or Apple App Store.  

4. Check Background Activity – Regularly review your phone’s app permissions and remove anything that looks suspicious.  

By staying alert and taking the right precautions, you can protect your personal data from being tracked without your knowledge. If you ever suspect your device has been compromised, act quickly to secure your privacy.

Experts Warn Criminals Could Exploit Jogging Apps for Targeting People

 

Experts caution that users of running apps should heighten their privacy settings to thwart potential stalkers and other malicious actors from accessing sensitive information regarding their activities. 

While platforms like Strava enable joggers and hikers to share route details and performance metrics with friends and followers, tech company Altia raises concerns about the possibility of criminals constructing a detailed profile of users' routines, including their start and end points, potentially exposing their home addresses. Altia advises users to review their security settings, ensuring that sensitive information isn't shared publicly by default and recommending a switch to private settings if necessary.

Highlighting the surge in stalking and harassment offenses, Altia underscores the significance of safeguarding personal data on fitness apps. These apps, utilizing GPS technology, can meticulously track users' movements, map out their routes, and gather various performance metrics, including pace, time, elevation gain, heart rate, and calories burned. 

With the popularity of apps like Strava soaring during the pandemic, Altia urges users to be vigilant, especially professionals in sensitive fields like security, law enforcement, banking, or the legal sector, who may inadvertently expose confidential information through their running activity.

Altia emphasizes the importance of maximizing app security settings and exercising caution regarding followers' activities and interactions. Users are advised to scrutinize their followers and assess whether their engagement seems genuine, as potential criminals could exploit the data for various purposes, including identifying secure or restricted locations like workplaces. 

By prioritizing privacy settings and remaining vigilant, users can mitigate the risk of their data falling into the wrong hands while enjoying the benefits of fitness-tracking apps safely.

Is Your Android Device Tracking You? Understanding its Monitoring Methods

 

In general discussions about how Android phones might collect location and personal data, the focus often falls on third-party apps rather than Google's built-in apps. This awareness has grown due to numerous apps gathering significant information about users, leading to concerns, especially when targeted ads start appearing. The worry persists about whether apps, despite OS permissions, eavesdrop on private in-person conversations, a concern even addressed by Instagram's head in a 2019 CBS News interview.

However, attention to third-party apps tends to overshadow the fact that Android and its integrated apps track users extensively. While much of this tracking aligns with user preferences, it results in a substantial accumulation of sensitive personal data on phones. Even for those trusting Google with their information, understanding the collected data and its usage remains crucial, especially considering the limited options available to opt out of this data collection.

For instance, a lesser-known feature involves Google Assistant's ability to identify a parked car and send a notification regarding its location. This functionality, primarily guesswork, varies in accuracy and isn't widely publicized by Google, reflecting how tech companies leverage personal data for results that might raise concerns about potential eavesdropping.

The ways Android phones track users were highlighted in an October 2021 Kaspersky blog post referencing a study by researchers from the University of Edinburgh and Trinity College. While seemingly innocuous, the compilation of installed apps, when coupled with other personal data, can reveal intimate details about users, such as their religion or mental health status. This fusion of app presence with location data exposes highly personal information through AI-based assumptions.

Another focal point was the extensive collection of unique identifiers by Google and OEMs, tying users to specific handsets. While standard data collection aids app troubleshooting, these unique identifiers, including Google Advertising IDs, device serial numbers, and SIM card details, can potentially associate users even after phone number changes, factory resets, or ROM installations.

The study also emphasized the potential invasiveness of data collection methods, such as Xiaomi uploading app window histories and Huawei's keyboard logging app usage. Details like call durations and keyboard activity could lead to inferences about users' activities and health, reflecting the extensive and often unnoticed data collection practices by smartphones, as highlighted by Trinity College's Prof. Doug Leith.

XLoader macOS Malware Variant Disguised as 'OfficeNote' Productivity App

 

A fresh variant of the Apple macOS malware known as XLoader has emerged, disguising its malicious intent through an office productivity app named "OfficeNote," according to cybersecurity experts from SentinelOne. 

In an analysis released on Monday, researchers Dinesh Devadoss and Phil Stokes revealed that the new form of XLoader is packaged within a regular Apple disk image, named OfficeNote.dmg. The application it contains bears the developer signature "MAIT JAKHU (54YDV8NU9C)."

XLoader, initially spotted in 2020, is categorized as an information stealer and keylogger that operates under the malware-as-a-service (MaaS) model. 

It follows in the footsteps of Formbook. While a macOS variant of XLoader emerged in July 2021, distributed as a Java program in the form of a compiled .JAR file, its execution was limited by the absence of the Java Runtime Environment in modern macOS installs.

To circumvent this constraint, the latest version of XLoader employs programming languages like C and Objective C. The disk image file carrying the malware was signed on July 17, 2023, a signature that has since been revoked by Apple.

SentinelOne reported discovering multiple instances of the malicious artifact on VirusTotal throughout July 2023, indicating a wide-reaching campaign. The researchers noted that the malware is advertised for rent on criminal forums, with the macOS version priced at $199 per month or $299 for three months.

Interestingly, this pricing is steeper than that of the Windows versions of XLoader, which are available for $59 per month or $129 for three months.

Once initiated, the seemingly harmless OfficeNote app displays an error message claiming it cannot be opened due to a missing original item. In reality, it surreptitiously installs a Launch Agent in the background to ensure its persistence.

XLoader's functionality centers around the collection of clipboard data and information stored within directories associated with web browsers like Google Chrome and Mozilla Firefox. However, Safari appears to be exempt from its targeting. 

Additionally, the malware is engineered to introduce sleep commands, delaying its execution and evading detection by both manual and automated security measures.

"XLoader continues to present a threat to macOS users and businesses," the researchers concluded.

"This latest iteration masquerading as an office productivity application shows that the targets of interest are clearly users in a working environment. The malware attempts to steal browser and clipboard secrets that could be used or sold to other threat actors for further compromise."

Fear Grip Users as Popular Diabetes App Faces Technical Breakdown

 A widely used diabetes management software recently experienced a serious technical failure, stunning the users and leaving them feeling angry and scared. The software, which is essential for assisting people with diabetes to monitor and manage their blood sugar levels, abruptly stopped functioning, alarming its devoted users. Concerns regarding the dependability and security of healthcare apps as well as the possible repercussions of such failures have been raised in response to the occurrence.

According to reports from BBC News, the app's malfunctioning was first brought to light by distressed users who took to social media platforms to express their frustration. The app's sudden failure meant that users were unable to access critical features, including blood glucose monitoring, insulin dosage recommendations, and personalized health data tracking. This unexpected disruption left many feeling vulnerable and anxious about managing their condition effectively.

The Daily Mail highlighted the severity of the situation, emphasizing how the app's failure posed a potential threat to the lives of its users. Many individuals with diabetes rely on the app to regulate their insulin levels, ensuring they maintain stable blood sugar readings. With this vital tool out of commission, users were left in a state of panic, forced to find alternative methods to track their glucose levels and administer appropriate medication.

The incident has triggered an outpouring of anger and fear from the affected users, who feel let down by the app's developers. One user expressed their frustration, stating, "I have come to depend on this app for my daily diabetes management. Its sudden breakdown has left me feeling helpless and anxious about my health." Others echoed similar sentiments, emphasizing the app's importance in their daily routines and the detrimental impact of its sudden unavailability.

The situation has also raised broader concerns regarding the reliability and security of healthcare apps. As these digital tools increasingly become a fundamental part of managing chronic conditions, their dependability and robustness are of paramount importance. This incident serves as a reminder of the potential risks associated with relying solely on technology for critical health-related tasks.

Furthermore, the incident sheds light on the need for developers to prioritize thorough testing and regular maintenance of healthcare apps to prevent such disruptions. App developers and healthcare providers must collaborate closely to ensure the seamless functioning of these tools, considering the impact they have on the well-being of individuals with chronic conditions.

CoWIN App Data Leak Claims: Minister Denies Direct Breach

 

Amidst concerns over a potential data breach in India's CoWIN app, the Union Minister, Rajeev Chandrasekhar, has stated that the app or its database does not appear to have been directly breached. The CoWIN app has been widely used in India for scheduling COVID-19 vaccinations and managing vaccination certificates.

The clarification comes in response to recent claims of a data leak, where personal information of individuals registered on the CoWIN platform was allegedly being sold on the dark web. The Union Minister assured the public that the government is taking the matter seriously and investigating the claims.

According to the Ministry of Health and Family Welfare, preliminary investigations suggest that the data leak may not have originated from a direct breach of the CoWIN app or its database. However, the government has initiated a thorough inquiry to determine the source and nature of the alleged data leak.

Data security and privacy have been significant concerns in the digital era, particularly in the healthcare sector where sensitive personal information is involved. As the COVID-19 vaccination drive continues, ensuring the protection of citizens' data becomes paramount. Any breach or compromise in the CoWIN system could erode public trust and confidence in the vaccination process.

The CoWIN platform has been subject to rigorous security measures, including data encryption and other safeguards to protect personal information. Additionally, the government has urged citizens to remain cautious and avoid sharing personal details or vaccine-related information on unauthorized platforms or with unknown individuals.

It is important for individuals to stay vigilant and follow official channels for vaccine registration and information. The government has emphasized the importance of using the official CoWIN app or website, which are secure platform for vaccine-related activities.

As investigations into the alleged data leak continue, the government is working to enhance the security measures of the CoWIN platform. Strengthening cybersecurity protocols and regularly auditing the system can help prevent unauthorized access and potential data breaches.

The incident serves as a reminder of the ongoing challenges in maintaining data security in the digital age. It highlights the need for constant vigilance and proactive measures to safeguard sensitive information. The government's response to these claims underscores its commitment to addressing data security concerns and ensuring the privacy of citizens.

As the vaccination drive plays a crucial role in controlling the spread of COVID-19, maintaining public trust in the CoWIN platform is imperative. By addressing any potential vulnerabilities and reinforcing data protection measures, the government aims to assure citizens that their personal information is safe and secure during the vaccination process.

Despite worries about a data leak in the CoWIN app, the Union Minister's statement suggests that neither the app nor its database appears to have been directly compromised. The government's examination of the situation serves to underline its dedication to data security and privacy. Maintaining the integrity and security of systems associated with vaccines continues to be a high priority while efforts to battle the epidemic continue.

Three Commonly Neglected Attack Vectors in Cloud Security

 

As per a 2022 Thales Cloud Security research, 88% of companies keep a considerable amount (at least 21% of sensitive data) in the cloud. That comes as no surprise. According to the same survey, 45% of organisations have had a data breach or failed an audit involving cloud-based data and apps. This is less surprising and positive news. 

The majority of cloud computing security issues are caused by humans. They make easily avoidable blunders that cost businesses millions of dollars in lost revenue and negative PR. Most don't obtain the training they need to recognise and deal with constantly evolving threats, attack vectors, and attack methods. Enterprises cannot avoid this instruction while maintaining control over their cloud security.

Attacks from the side channels

Side-channel attacks in cloud computing can collect sensitive data from virtual machines that share the same physical server as other VMs and activities. A side-channel attack infers sensitive information about a system by using information gathered from the physical surroundings, such as power usage, electromagnetic radiation, or sound. An attacker, for example, could use statistics on power consumption to deduce the cryptographic keys used to encrypt data in a neighbouring virtual machine.  

Side-channel attacks can be difficult to mitigate because they frequently necessitate careful attention to physical security and may involve complex trade-offs between performance, security, and usability. Masking is a common defence strategy that adds noise to the system, making it more difficult for attackers to infer important information.

In addition, hardware-based countermeasures (shields or filters) limit the amount of data that can leak through side channels.

Your cloud provider will be responsible for these safeguards. Even if you know where their data centre is, you can't just go in and start implementing defences to side-channel assaults. Inquire with your cloud provider about how they manage these issues. If they don't have a good answer, switch providers.

Container breakouts

Container breakout attacks occur when an attacker gains access to the underlying host operating system from within a container. This can happen if a person has misconfigured the container or if the attacker is able to exploit one of the many vulnerabilities in the container runtime. After gaining access to the host operating system, an attacker may be able to access data from other containers or undermine the security of the entire cloud infrastructure.

Securing the host system, maintaining container isolation, using least-privilege principles, and monitoring container activities are all part of defending against container breakout threats. These safeguards must be implemented wherever the container runs, whether on public clouds or on more traditional systems and devices. These are only a few of the developing best practices; they are inexpensive and simple to apply for container developers and security experts.

Cloud service provider vulnerabilities

Similarly to a side-channel attack, cloud service providers can be exposed, which can have serious ramifications for their clients. An attacker could gain access to customer data or launch a denial-of-service attack by exploiting a cloud provider's infrastructure weakness. Furthermore, nation-state actors can attack cloud providers in order to gain access to sensitive data or destroy essential infrastructure, which is the most serious concern right now.

Again, faith in your cloud provider is required. Physical audits of their infrastructure are rarely an option and would almost certainly be ineffective. You require a cloud provider who can swiftly and simply respond to inquiries about how they address vulnerabilities:

NordVPN Identifies the Most Risky Websites for Users' Privacy and Security

When you browse the web on a regular basis, it can be quite dangerous, but it becomes even more dangerous when you access certain types of sites. It should come as no surprise that porn, streaming, and video hosting websites top the list of services posing the greatest risk to users' privacy and security. 

Malware attacks, invasive ads, and heavy web tracking were among the threats. That is the exclusive data gathered by NordVPN, one of the best VPN services available. In December 2022 alone, the VPN provider was able to block over 344 million web trackers, 341 million intrusive ads, and 506,000 malware infections thanks to its Threat Protection tool.

"The online world is challenging people in every single move they make," said NordVPN cybersecurity advisor Adrianus Warmenhoven.

"Want to read an article? Dozens of ads and pop-ups are ready to immediately cover your screen. Another privacy threat – malware – is lurking for you on websites and in files you are about to download. Websites you browse are also full of third-party trackers that analyze your browsing history to find out what you do online. It depends on you to stop it."

NordVPN researchers wanted to know how these cyber threats were getting to users. They did this by analysing aggregated data collected by their Threat Protection system. While this did not include any personally identifiable information about users, it did assist them in depicting the scenario that everyone faces on a daily basis online.

Malware is perhaps the most concerning of these threats. This is due to the ease with which such malicious software can infiltrate a device and damage or compromise tonnes of users' sensitive data. Adult content sites contain the most malware, including viruses, ransomware, spyware, and other threats. During the coverage period, over 60,000 domains were blocked. Cloud storage and entertainment platforms are next in line, with approximately 70,000 infected platforms discovered between the two categories.

Intrusive ads are any pop-ups or other ad pages that appear without being requested. These not only annoy people's online experiences, but they are also excellent at gathering information about users without their knowledge. As expected, free streaming platforms are the most involved, with more than 55 minion domains affected. Adult content and shopping websites appear to be close behind.

These findings highlight the importance of using a reliable ad-blocker every time you browse the web, especially when visiting certain types of websites.

"Ad blockers are essential for both security - because they block ads that can infect people’s devices - and privacy because annoying ads rely on collecting data from web activity and violating people’s privacy," explains Warmenhoven. "Also, if a website is loading slower than usual, you can blame intrusive ads. Free apps filled with unwanted ads could also drain your device’s battery faster.” 

Web trackers are another major cyber threat because they compromise users' online anonymity. Video hosting services were the sites with the most web trackers. The NordVPN Threat protection tool blocked over two billion domains. Tracking was also high in cloud storage, web email, and information technology sites. As per Nord, Hong Kong and Singapore have the most web trackers in the world, with an average of 45 and 33 trackers per website. Other countries with high tracking rates include the United States, Australia, the United Kingdom, Spain, and France.

NordVPN Threat Protection is a system that safeguards users from the aforementioned online threats. It accomplishes this by scanning all files you download and blocking all sites containing malware and dangerous ads before you open them.

Threat Protection is available on all NordVPN apps. This means that there is no additional cost to enjoy a safer online experience. All you have to do is follow these simple steps:
  • Launch the latest NordVPN app on your preferred device.
  • Click the shield icon on the left side of your screen.
  • Activate the Threat Protection toggle.