Threat Report

In this week’s report we are covering two very malicious programs. If you have a BYOD policy you may want to pay attention to this first piece of research. Security researchers at Check Point have discovered samples of Glancelove, an Android-targeting malware, in a false campaign originated by Hamas that takes advantage of the 2018 World Cup. According to researchers, the group is distributing Glancelovethrough fake Facebook page and profiles with photos of attractive women who promote the malware in the form of a dating app available from the Google Play Store. The 2nd piece of interesting malware we found is related to GPS and vehicle that rely on it for daily transportation. A team composed of researchers from Virginia Tech, the University of Electronic Science and Technology of China, and Microsoft Research recently released their findings on GPS Spoofing Hack, an attack vector that can send Google Maps users the wrong direction. GPS Spoofing involves replacing a user’s intended destination with a “ghost location.” Instead of connecting to legitimate satellite systems, the cyber-criminal behind the attack forces the victim’s software to connect to their own equipment, allowing the hacker to implement false GPS data.

Malware: Glancelove This Glancelove dating application asks for permission for the device’s network connection, contacts, SMS, camera, and storage. Upon receiving permission, it contacts its command and control (C&C) server to download the final payload. This Glancelove malware is capable of recording calls, track location, open microphone, SMS theft, take photos, storage mapping, steal contacts, and steal images. Researchers mention that these mobile chain attacks are mainly successful because the targets are hand-picked, and the malware can continually install crucial components if needed. Two similar malicious applications used by the Hamas group are Golden Cup and Wink Chat applications.

For more information there are a few links below:

Links: GlobalSecurityMag News Observer

Some Mitigation Strategies: Make sure to monitor your employee and guest wifi networks Intrusion detection systems (IDS) would detect communication C2 for payload download Web Filtration would detect the use of malicious urls or unknown sites 24x7 Security Monitoring for malicious behavior and immediate incident response.

Malware: GPS Spoofing Hack Researchers used a HackRF One software defined radio, a Raspberry Pi, a portable power source, and an antenna. The attack could be hosted remotely with the spoofing equipment installed under the victim’s car. Researchers concluded that a seasoned and logical driver who is familiar with their route and destination would notice the change in their Google Maps application. However, if the location and route are unfamiliar, a user might not realize that they’ve been deceived. According to researchers, their experiment only failed when they were testing the luxury car Tesla 2014 Model S. They stated that this was because Tesla uses an advanced u-blox navigation chip, which contains an anti-spoofing function.

Links: Forbes

Some Mitigation Strategies: u-blox navigation chip, which implements some anti-spoofing function Intrusion detection systems (IDS) to monitor for malicious communication 24x7 Security Monitorings to check for GPS consistency with locations of vehicles.

We'd love to hear your thoughts. Find us on Twitter, LinkedIn or write in to hello@perchsecurity.com

Next: Threat Report Tuesday July 10th 2018