Warning - Millions of Xiaomi Phones Vulnerable, Remote Hacking

Millions of Xiaomi smartphones are vulnerable to a dangerous remote code execution (RCE) vulnerability that could grant attackers complete control of handsets.

The vulnerability, now patched, exists in MIUI – Xiaomi's own implementation of the Android operating system – in versions prior to MIUI Global Stable 7.2 which is based on Android 6.0.

The flaw, discovered by IBM X-Force researcher David Kaplan, potentially allows attackers with privileged network access, such as cafe Wi-Fi, to install malware remotely on the affected devices and fully compromise them.

Researchers found some apps in the analytics package in MIUI, which can be abused to provide malicious ROM updates remotely through a man-in-the-middle attack.

"The vulnerability we discovered allows for a man-in-the-middle attacker to execute arbitrary code as the highly privileged Android 'system' user," researchers say.

Researchers say they discovered vulnerable analytics packages in at least four default apps provided by Xiaomi in its MIUI distributions, one of those apps being the default browser app.

The flaw allows an attacker to inject a JSON response to force an update by replacing the link and MD5 hash with a malicious Android application package containing malicious code, which is executed at the system level.

Since there is not any cryptographic verification of the update code, the analytics package (com.xiaomi.analytics) will replace itself with "the attacker-supplied version via Android's DexClassLoader mechanism."

In order words, the analytics package neither uses HTTPS to query an update server for updates, nor it downloads the package over HTTPS, thus allowing attackers to modify the updates.

The custom ROM ships on devices manufactured by developer Xiaomi – World's third largest smartphone maker with over 70 Million devices shipped just last year alone – and is also ported to over 340 different handsets including Nexus, Samsung, and HTC.

Since the company has patched the flaw and released a over-the-air update, users are strongly recommended to update their firmware to version 7.2 as soon as possible in order to ensure they are not vulnerable to this issue that plagues Millions of Xiaomi devices.

Critical - Print Spooler Bug allows hacker to hack any version of Windows

Microsoft's July Patch Tuesday offers 11 security bulletins with six rated critical resolving almost 50 security holes in its software.

The company has patched a security flaw in the Windows Print Spooler service that affects all supported versions of Windows ever released, which if exploited could allow an attacker to take over a device via a simple mechanism.

The "critical" flaw (CVE-2016-3238) actually resides in the way Windows handles printer driver installations as well as the way end users connect to printers.

The flaw could allow an attacker to install malware remotely on victim machine that can be used to view, modify or delete data, or create new accounts with full user rights; Microsoft said in MS16-087 bulletin posted Tuesday.

Users who are logged in with fewer user rights on the system are less impacted than users who operate with administrative user rights, such as some home accounts and server users.

Microsoft said the critical flaw could be exploited to allow remote code execution if an attacker can conduct a man-in-the-middle (MiTM) attack on a system or print server or set up a rogue print server on a target network.

The critical flaw was discovered and reported by the researchers at security firm Vectra Networks, who disclosed some details on the vulnerability, but didn't publish their proof-of-concept (POC) code.

You can watch the video that shows the hack in action:

In corporate networks, by default network administrators allow printers to deliver the necessary drivers to workstations or systems connected to the network. These drivers are silently installed without user interaction and run with full privileges under the SYSTEM user.

According to researchers, attackers can replace these drivers on the printer with malicious files that could allow them to execute code of their choice.

More worrisome: If the printer is behind a firewall, attackers can even hack other device or computer on that particular network, and then use it to host their malicious files.

Watering Hole Attacks via Printers

Like servers, multiple computers are also connected to printers in an effort to print documents as well as download drivers. So, this flaw allows a hacker to execute watering hole attacks technically using printers.

Watering hole attacks, or drive-by downloads, are used to target businesses and organizations by infecting them with malware to gain access to the network.

"Rather than infecting users individually, an attacker can effectively turn one printer into a watering hole that will infect every Windows device that touches it," said Vectra chief security officer Gunter Ollmann.

"Anyone connecting to the printer share will download the malicious driver. This moves the attack vector from physical devices to any device on the network capable of hosting a virtual printer image."

This flaw (CVE-2016-3238) is by far the most dangerous vulnerability of the year, which is easy to execute, provides different ways of launch attacks, and affects a huge number of users.

A second related vulnerability, CVE-2016-3239, in MS16-087 bulletin is a privilege escalation flaw that could allow attackers to write to the file system.

A security bulletin for Microsoft Office, MS16-088, includes patches for seven remote code execution (RCE) vulnerabilities, 6 of them are memory corruption flaws, which affects Microsoft Office, SharePoint Server as well as Office Web Apps.

The flaws can be exploited by specially crafted Office files, allowing attackers to run arbitrary code with same privileges as the logged in user.

Bulletin MS16-084 addresses flaws in Internet Explorer and MS16-085 in Microsoft Edge. The IE flaws include RCE, privilege escalation, information disclosure and security bypass bugs.

Edge flaws include a handful of RCE and memory corruption flaws in the Chakra JavaScript engine, as well as an ASLR bypass, information disclosure, browser memory corruption, and spoofing bugs.

Bulletin MS16-086 addresses a vulnerability in the JScript and VBScript engines in Windows, which could allow an attacker to execute remote code execution flaw, affecting VBScript 5.7 and JScript 5.8.

Rest five bulletins rated as important address flaws in Windows Secure Kernel Mode, Windows Kernel-Mode Drivers, the .NET framework, the Windows Kernel, and Secure Boot process.

Users are advised to patch their system and software as soon as possible.

Beware ! it could be Malicious to download Pokemon Go Game for Android

"Pokémon Go" has become the hottest iPhone and Android game to hit the market in forever with enormous popularity and massive social impact. The app has taken the world by storm since its launch this week.

Nintendo's new location-based augmented reality game allows players to catch Pokémon in the real life using their device's camera and is currently only officially available in the United States, New Zealand, UK and Australia.

On an average, users are spending twice the amount of time engaged with the new Pokémon Go app than on apps like Snapchat. In fact Pokémon Go is experiencing massive server overload in just few days of launch.

Due to the huge interest surrounding Pokémon Go, many gaming and tutorial websites have offered tutorials recommending users to download the APK from a non-Google Play link.

In order to download the APK, users are required to "side-load" the malicious app by modifying their Android core security settings, allowing their device's OS to install apps from "untrusted sources."

Pokémon Go is Installing DroidJack Malware

Security researchers have warned users that many of these online tutorials are linked to malicious versions of the Pokémon Go app that install a backdoor on Android phones, enabling hackers to compromise a user's device completely.

Security firm Proofpoint has discovered the malicious app, or APK, that has been infected withDroidJack – a Remote Access Tool (RAT) that can hack any Android device by opening a silent backdoor for hackers.

Just less than 3 days after Nintendo initially released the game in Australia and New Zealand on July 4, the malicious app was uploaded to an online malware detection repository.

Since Android core security settings normally prevent the installation of untrusted third-party apps from "unknown sources," side-loading should have never been done by a user.

"This is an extremely risky practice and can easily lead users to install malicious apps on their own mobile devices," researchers at Proofpoint wrote in a blog post. "Should an individual download an APK [Android application package] from a third-party that has been infected with a backdoor, like the one we discovered, their device would then be compromised."

Here's How to Prevent Yourself

Fortunately, there are several ways to check if you have downloaded the malicious version of the Pokémon Go app.

The infected version of the Pokémon Go app would have been granted more system permissions, so one way to differ between the two is to compare the permissions of your app to those of the legitimate one.

To do so, Go to the Settings → Apps → Pokemon GO and check the game's permissions.

If you find that the game has asked for permissions like directly call phone numbers, edit and read your SMSes, record audio, read Web history, modify and read your contacts, read and write call logs, and change network connectivity, then you should uninstall the game right away, since it is infected with DroidJack.

You can also compare the game's SHA-1 hash – a long string of characters used to verify if a file was infected with or modified by a malicious third-party – to make sure the game matches the hash of the legitimate version.

The Bottom Line:

Instead of downloading available applications from unknown third party stores, wait for the Pokémon Go app to launch in your country.

However, downloading apps from third parties do not always end up with malware or viruses, but it certainly ups the risk. So, it's the best way to wait in order to avoid compromising your device and the networks it accesses.

Antivirus firm Avast to BUY AVG for $1.3 Billion

Antivirus company Avast Software is planning to acquire Dutch rival AVG Technologies for $1.3 Billion in cash.

Avast announced today that it would buy Amsterdam-based AVG Technologies for $25 per share in an all-cash transaction valued at $1.3 Billion in an aim to expand its presence in the emerging markets.

With more than 230 Million users worldwide, Avast provides free and paid security software packages for both PCs as well as mobile devices to businesses and individuals.

The deal between the two popular security software companies will provide Avast with 400 Million endpoints -- devices that have some form of Avast or AVG application installed. Around 160 Million of those are mobile.

However, AVG technologies was in controversies for updating its policy that clearly said that the company will be allowed to collect and sell users' "non-personal data" to online advertisers in order to "make money" from their "free offerings" so they can keep them free.

With access to a large number of devices, Avast will be granted more opportunities in Internet antivirus and security-related business, giving the company a bigger pool of data on malware to offer better security products.

"We believe that joining forces with Avast, a private company with significant resources, fully supports our growth objectives and represents the best interests of our stockholders," AVG CEO Gary Kovacs said in a statement.

The deal will also provide Avast with an expanded geographical reach in its primary business as well as the growing number of Internet of Things -- physical devices connected to the Internet, Avast said in a statement.

The offer of $25 per share on AVG represents a 33 percent premium to its closing price Wednesday on the NY Stock Exchange. Avast will fund the transaction using cash on hand and debt financing.

This is the next major tech acquisition in last few months. Just last month, Microsoft made its biggest acquisition by acquiring LinkedIn, the social network for professionals, for $26.2 Billion in cash.

Facebook Launches OpenCellular - An open source Wireless Access Platform

Big technology companies are in the race of bringing Internet connectivity to unconnected parts of the world through flying drones, high-altitude balloons, and laser beams, but Facebook has announced a far less expensive method to provide connectivity to rural areas.

Facebook CEO Mark Zuckerberg announced Wednesday the creation of a new open-source wireless communication platform called OpenCellular that can be easily deployed in remote locations by anyone.

OpenCellular is a doorbell-sized hardware device that could be attached to a pole or tree at a range of heights from where it can deliver a wireless network, from 2G cell-phone networks to higher speed LTE, and Wi-Fi networks like those inside your home, or local coffee shop.

The device is designed to work in rural locations in conditions, including high winds, extreme temperatures, and harsh climates.

But, wait! This doesn't mean that Facebook is rolling out its own broadband services.

Facebook to Open-Source the Designs and Software of OpenCellular

The social networking plans to open source the designs for this device so that service providers, researchers, and others can use its designs and control software for free to build their own boxes that are cheap to purchase and maintain.

"We designed OpenCellular as an open system so anyone—from telecom operators to researchers to entrepreneurs—can build and operate wireless networks in remote places," Zuck said. "It's about the size of a shoe box and can support up to 1,500 people from as far as 10 kilometers away."

Facebook has tested the new system at its headquarters in Menlo Park, California and, so far, it has been able to successfully use the device to send and receive text messages, make voice calls and access relatively slow 2G data connections.

OpenCellular is Zuckerberg's latest attempt to push its goal of worldwide Internet access, aiming to connect the next 4 Billion people across the world without Internet access and nearly 700 million people without cellular service.

Facebook's Free Basics -- an initiative to provide free access to certain Internet websites, including Facebook -- was banned in India from earlier this year due to the violation of Net Neutrality principles, while Egypt followed suit in April.

Besides OpenCellular, Facebook's other global connectivity initiatives include its high-bandwidth Internet laser beams, solar-powered aircraft Aquila and unmanned solar-powered Internet-distributing plane.

The initial version of OpenCellular's platform will be available this summer, but meanwhile, Facebook is testing out the devices at its headquarters and planning outdoor tests with its initial OEMs and Telecom Infra Project (TIP) partners.