Tuesday, September 24, 2013

Fake Software, unauthorized SMS messages

Today, the most common business model for Android malware attacks is to install fake apps that secretly send expensive messages to premium rate SMS services. Recent examples have included phony versions of Angry Birds Space, Instagram, and fake Android antivirus products. In May 2012, UK’s mobile phone industry regulator discovered that 1,391 UK Android users had been stung by one of these scams.

The regulator fined the firm that operated the payment system involved, halted fund transfers, and demanded refunds for those who’d already paid. However, UK users represented only about 10% of this malware’s apparent victims it has been seen in at least 18 countries. Currently, one family of Android malware, Andr/Boxer, accounts for the largest number of Android malware samples we see, roughly one third of the total. Linked to .ru domains hosted in the Ukraine.

Andr/Boxer presents messages in Russian and has disproportionately attacked Eastern European Android users who visit sites where they’ve been promised photos of attractive women. When they arrive at these sites, users see a webpage that is carefully crafted to entice them to download and install a malicious app.
For example, the user might be prompted (in Russian) to install a fake update for products such as Opera or
Skype. Or, in some cases, a fake antivirus scan is run, reports false infections, and recommends the installation of a fake antivirus program. Once installed, the new app begins sending expensive SMS messages. Many of these Trojans install with what Android calls the INSTALL_PACKAGES permission. That means they can download and install additional malware in the future.

Monday, September 23, 2013

Quantum Computer

A quantum computer is any device for computation that makes direct use of distinctively quantum mechanical phenomena, such as superposition and entanglement, to perform operations on data.

In a classical computer, information is stored as bits; in a quantum computer, it is stored as qubits. The basic principle of quantum computation is that the quantum properties can be used to represent and structure data and that quantum mechanisms can be devised and built to perform operations with this data. Although quantum computing is still in its infancy, experiments have been carried out in which quantum computational operations were executed on a very small number of qubits.

Research in both theoretical and practical areas continues at a frantic pace, and many national government and military funding agencies support quantum computing research to develop quantum computers for both civilian and national security purposes, such as cryptanalysis. If large-scale quantum computers can be built, they will be able to solve certain problems exponentially faster than any of our current classical computers.

Quantum computers are different from other computers such as DNA computers and traditional computers based on transistors. Some computing architectures such as optical computers may use classical superposition of electromagnetic waves, but without some specifically quantum mechanical resources such as entanglement, they have less potential for computational speed-up than quantum computers. The power of quantum computers Integer factorization is believed to be computationally unfeasible with an ordinary computer for large integers that are the product of only a few prime numbers.

By comparison, a quantum computer could solve this problem more efficiently than a classical computer using Shor's algorithm to find its factors. his ability would allow a quantum computer to "break" many of the cryptographic systems in use today, in the sense that there would be a polynomial time (in the number of bits of the integer) algorithm for solving the problem. In particular, most of the popular public key ciphers are based on the difficulty of factoring integers, including forms of RSA.

These are used to protect secure Web pages, encrypted email, and many other types of data. Breaking these would have significant ramifications for electronic privacy and security. The only way to increase the security of an algorithm like RSA would be to increase the key size and hope that an adversary does not have the resources to build and use a powerful enough quantum computer. It seems plausible that it will always be possible to build classical computers that have more bits than the number of qubits in the largest quantum computer.

Saturday, September 21, 2013

Malware and Ransomware

Kits lead to an explosion in malware for OS X and mobile
Given the popularity of mobile computing, we should perhaps be surprised that cybercriminals have taken so long to extensively exploit this field. In 2012, however, we’ve seen the number of mobile threats go up dramatically. As we look at them in more detail, we see the large amount of Windows based malware owes its existence to the easy availability of malware kits in the underground market. In 2013, there is a good chance ransomware kits will take the lead from malware kits. Now the first ransomware kits are being marketed in the underground.

Ransomware continues to expand to mobile devices
Ransomware on Windows PCs has more than tripled during the past year. Attackers have proven that this “Business Model” works and are scaling up their attacks to increase profits. One way ransomware is different from other types of malware such as backdoors, keyloggers and password stealers is that attackers do not rely on their victims using the infected systems for financial transactions to separate them from their money. Instead these criminals hijack the users ability to access data, communicate or use the system at all. The victims are faced with either losing their data or paying a ransom in the hope of regaining access.

One limitation for many malware authors seeking profit from mobile devices is that more users transact business on desktop PCs rather than on tablets or phones. But this trend may not last; the convenience of portable browsers will likely lead more people do their business on the go. Attackers have already developed ransomware for mobile devices.