Exodus spyware exposes 'sorry' state of Android security

Android Angst; Government Gaffe

The sky is falling. At least, that’s what some conclude, after hearing about Exodus, a family of targeted malware discovered in the official Google Play app store.

By imitating legit apps, Exodus exfiltrates data from countless apps and Android services. It appears to be a lawful surveillance program that escaped from its tight, court-approved targeting of Italian suspects.

But Google says malware like this is vanishingly rare. In this week’s Security Blogwatch, we let my people go.


Read more: techbeacon.com/security/exodus-spyware-exposes-sorry-state-android-security

Facebook Forces Users to Give Email Password (wait, what?)

Here’s Facebook’s latest unbelievable scandal: The company has been demanding that some users enter their email passwords, so they can be “verified.”

That’s right, their email password. Facebook claims it’s all above board: It’s for security, y’see—people can totally trust us. But critics say it trains users to do dangerous things.

And Facebook is said to be harvesting the users’ contacts without permission. All this just a month after the company was caught red-handed misusing other security identifiers. Yikes.

Facebook also claims that users can instead verify their email an alternate way, but the UX for that seems to be a blackest-of-Vantablack “dark pattern.” In today’s SB Blogwatch, we can’t believe our eyes.


Read more: securityboulevard.com/2019/04/facebook-forces-users-to-give-email-password-wait-what

Office Depot and Support.com to Pay $35M for Fake Malware Scan ‘Scam’

Feds win technical victory against an alleged nine-year plan to fool customers. The Federal Trade Commission (FTC) claims Office Depot and Support.com deliberately lied to consumers, saying their PCs were infected with malware.

However, the scanning tool they used didn’t actually scan anything, according to the FTC. It merely asked a few questions, such as, “Does your PC frequently crash?” And if the customer answered “Yes” to any question, they’d be told the PC needed a $300 fix.

The companies settled out of court for $35 million, without admitting liability. In today’s SB Blogwatch, we feel fine.


Read more: securityboulevard.com/2019/04/office-depot-and-support-com-to-pay-35m-for-fake-malware-scan-scam

Microsoft Hurts Charming Kitten (aka the APT35 Iran Hacking Group)

Microsoft has damaged a hacking group thought to be run by the Iranian military. APT35—also known as Charming Kitten, Ajax and Phosphorus—has now lost control of 99 internet domains it was using in spear-phishing attacks on journalists and activists.

Redmond’s finest had to ask a court to grant it control of the malicious Purr-sian domains, such as outlook-verify.net. Now it is able to prevent web users from being phished and can collect valuable intelligence on APT35’s naughty tactics.

Go back to sleep, tiny cat. In today’s SB Blogwatch, we destroy your furniture.


Read more: securityboulevard.com/2019/03/microsoft-hurts-charming-kitten-aka-the-apt35-iran-hacking-group

ASUS ShadowHammer backdoor: Was China to blame?

ASUS laptops infected by the “ShadowHammer” malware were targeted by the People’s Republic of China. At least, that’s the implication of a Kaspersky Labs’ researcher.

Mind you, Kaspersky is alleged to be rather close to a certain other state. So a pinch of salt might be indicated.

Whoever’s responsible, there are worrying implications for the future of state-sponsored cyber-ops. In this week’s Security Blogwatch, everything looks like a nail.


Read more: techbeacon.com/security/asus-shadowhammer-backdoor-was-china-blame