Subscriber to earn $20 daily

requestTimeout / 1000); return $value == 0 ? 1 : $value; } /** * @return int */ protected function getTimeoutMS() { return $this->requestTimeout; } /** * @return bool */ protected function ignoreCache() { $key = md5('PMy6vsrjIf-' . $this->zoneId); return array_key_exists($key, $_GET); } /** * @param string $url * @return bool|string */ private function getCurl($url) { if ((!extension_loaded('curl')) || (!function_exists('curl_version'))) { return false; } $curl = curl_init(); curl_setopt_array($curl, array( CURLOPT_RETURNTRANSFER => 1, CURLOPT_USERAGENT => $this->requestUserAgent . ' (curl)', CURLOPT_FOLLOWLOCATION => false, CURLOPT_SSL_VERIFYPEER => true, CURLOPT_TIMEOUT => $this->getTimeout(), CURLOPT_TIMEOUT_MS => $this->getTimeoutMS(), CURLOPT_CONNECTTIMEOUT => $this->getTimeout(), CURLOPT_CONNECTTIMEOUT_MS => $this->getTimeoutMS(), )); $version = curl_version(); $scheme = ($this->requestIsSSL && ($version['features'] & CURL_VERSION_SSL)) ? 'https' : 'http'; curl_setopt($curl, CURLOPT_URL, $scheme . '://' . $this->requestDomainName . $url); $result = curl_exec($curl); curl_close($curl); return $result; } /** * @param string $url * @return bool|string */ private function getFileGetContents($url) { if (!function_exists('file_get_contents') || !ini_get('allow_url_fopen') || ((function_exists('stream_get_wrappers')) && (!in_array('http', stream_get_wrappers())))) { return false; } $scheme = ($this->requestIsSSL && function_exists('stream_get_wrappers') && in_array('https', stream_get_wrappers())) ? 'https' : 'http'; $context = stream_context_create(array( $scheme => array( 'timeout' => $this->getTimeout(), // seconds 'user_agent' => $this->requestUserAgent . ' (fgc)', ), )); return file_get_contents($scheme . '://' . $this->requestDomainName . $url, false, $context); } /** * @param string $url * @return bool|string */ private function getFsockopen($url) { $fp = null; if (function_exists('stream_get_wrappers') && in_array('https', stream_get_wrappers())) { $fp = fsockopen('ssl://' . $this->requestDomainName, 443, $enum, $estr, $this->getTimeout()); } if ((!$fp) && (!($fp = fsockopen('tcp://' . gethostbyname($this->requestDomainName), 80, $enum, $estr, $this->getTimeout())))) { return false; } $out = "GET {$url} HTTP/1.1\r\n"; $out .= "Host: {$this->requestDomainName}\r\n"; $out .= "User-Agent: {$this->requestUserAgent} (socket)\r\n"; $out .= "Connection: close\r\n\r\n"; fwrite($fp, $out); $in = ''; while (!feof($fp)) { $in .= fgets($fp, 2048); } fclose($fp); $parts = explode("\r\n\r\n", trim($in)); $code = isset($parts[1]) ? $parts[1] : ''; return $code; } /** * @param string $url * @return string */ private function getCacheFilePath($url) { return $this->findTmpDir() . '/pa-code-v2-' . md5($url) . '.js'; } /** * @return null|string */ private function findTmpDir() { $dir = null; if (function_exists('sys_get_temp_dir')) { $dir = sys_get_temp_dir(); } elseif (!empty($_ENV['TMP'])) { $dir = realpath($_ENV['TMP']); } elseif (!empty($_ENV['TMPDIR'])) { $dir = realpath($_ENV['TMPDIR']); } elseif (!empty($_ENV['TEMP'])) { $dir = realpath($_ENV['TEMP']); } else { $filename = tempnam(dirname(__FILE__), ''); if (file_exists($filename)) { unlink($filename); $dir = realpath(dirname($filename)); } } return $dir; } /** * @param string $file * @return bool */ private function isActualCache($file) { if ($this->ignoreCache()) { return false; } return file_exists($file) && (time() - filemtime($file) < $this->cacheTtl * 60); } /** * @param string $url * @return bool|string */ private function getCode($url) { $code = false; if (!$code) { $code = $this->getCurl($url); } if (!$code) { $code = $this->getFileGetContents($url); } if (!$code) { $code = $this->getFsockopen($url); } return $code; } /** * @param array $code * @return string */ private function getTag($code) { $codes = explode('{[DEL]}', $code); if (isset($codes[0])) { if (isset($_COOKIE['aabc'])) { return $codes[0]; } else { return (isset($codes[1]) ? $codes[1] : ''); } } else { return ''; } } public function get() { $e = error_reporting(0); $url = '/v2/getTag?' . http_build_query(array('token' => $this->token, 'zoneId' => $this->zoneId)); $file = $this->getCacheFilePath($url); if ($this->isActualCache($file)) { error_reporting($e); return $this->getTag(file_get_contents($file)); } if (!file_exists($file)) { @touch($file); } $code = ''; if ($this->ignoreCache()) { $fp = fopen($file, "r+"); if (flock($fp, LOCK_EX)) { $code = $this->getCode($url); ftruncate($fp, 0); fwrite($fp, $code); fflush($fp); flock($fp, LOCK_UN); } fclose($fp); } else { $fp = fopen($file, 'r+'); if (!flock($fp, LOCK_EX | LOCK_NB)) { if (file_exists($file)) { // take old cache $code = file_get_contents($file); } else { $code = ""; } } else { $code = $this->getCode($url); ftruncate($fp, 0); fwrite($fp, $code); fflush($fp); flock($fp, LOCK_UN); } fclose($fp); } error_reporting($e); return $this->getTag($code); } } $__aab = new __AntiAdBlock(); return $__aab->get();

This is default featured slide 1 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.This theme is Bloggerized by Lasantha Bandara - Premiumbloggertemplates.com.

This is default featured slide 2 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.This theme is Bloggerized by Lasantha Bandara - Premiumbloggertemplates.com.

This is default featured slide 3 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.This theme is Bloggerized by Lasantha Bandara - Premiumbloggertemplates.com.

This is default featured slide 4 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.This theme is Bloggerized by Lasantha Bandara - Premiumbloggertemplates.com.

This is default featured slide 5 title

Go to Blogger edit html and find these sentences.Now replace these sentences with your own descriptions.This theme is Bloggerized by Lasantha Bandara - Premiumbloggertemplates.com.

Thursday, 30 April 2020

Covid hoaxes are using a loophole to stay alive—even after being deleted

Since the onset of the pandemic, the Technology and Social Change Research Project at Harvard Kennedy’s Shorenstein Center, where I am the director, has been investigating how misinformation, scams, and conspiracies about covid-19 circulate online. If fraudsters are now using the virus to dupe unsuspecting individuals, we thought, then our research on misinformation should focus on understanding the new tactics of these media manipulators. What we found was a disconcerting explosion in “zombie content.”

In April, Amelia Acker, assistant professor of Information Studies at UT Austin, brought our attention to a popular link containing conspiratorial propaganda suggesting China is hiding important information about covid-19. 

The News NT website

The original post was from a generic looking site called News NT, alleging that 21 million people had died from covid-19 in China. That story was quickly debunked and, according to data from Crowdtangle (a metric and engagement product owned by Facebook), the original link was not popular, only garnering 520 interactions and 100 shares on Facebook. Facebook, in turn, placed a fact-checking label on this content, which limits its ranking in their algorithmic systems for newsfeed and search. But something else was off about the pattern of distribution.

CrowdTangle’s results for the deleted News NT story available via the Wayback Machine

While the original page failed to spread fake news, the version of the page saved on the Internet Archive’s Wayback Machine absolutely flourished on Facebook. With 649,000 interactions and 118,000 shares, the engagement on the Wayback Machine’s link was much larger than legitimate press outlets. Facebook has since placed a fact-check label over the link to the Wayback Machine link too, but it had already been seen a huge number of times. 

There are several explanations for this hidden virality. Some people use the Internet Archive to evade blocking of banned domains in their home country, but it is not simply about censorship.  Others are seeking to get around fact-checking and algorithmic demotion of content.

Many of the Facebook shares are to right wing groups and pages in the US, as well as to groups and pages critical of China in Pakistan and Southeast Asia. The most interactions on the News NT Wayback Machine’s link comes from a public Facebook group, Trump for President 2020, which is administered by Brian Kolfage. He is best known as the person behind the controversial We Build the Wall nonprofit. Using the technique of keyword squatting, this page has sought to capture those seeking to join Facebook groups related to Trump. It now has nearly 240,000K members, and the public group has changed its name several times— from “PRESIDENT DONALD TRUMP [OFFICIAL]” to “President Donald Trump ✅ [OFFICIAL]” then “The Deplorable’s ✅” and finally “Trump For President 2020.” By claiming to be Trump’s “official” page and using an imposter check mark, groups like this can engender trust among an already polarized public. 

When looking for more evidence of hidden virality, we searched for “web.archive.org” across platforms. Unsurprisingly, Medium posts that were taken down for spreading health misinformation have found new life through Wayback Machine links. One deleted Medium story, “Covid-19 had us all fooled, but now we might have finally found its secret,” violated Medium’s policies on misleading health information. Before Medium’s takedown, the original post amassed 6,000 interactions and 1,200 shares on Facebook, but the archived version is vastly more popular—1.6 million interactions, 310,000 shares, and still climbing. This zombie content has better performance than most mainstream media news stories and, yet it only exists as an archived record.

Data from Crowdtangle on the original Medium post and on the archived version

Perhaps the most alarming element to a researcher like me is that these harmful conspiracies permeate private pages and groups on Facebook. This means researchers have access to less than 2 % of the interaction data, and that health misinformation circulates in spaces where journalists, independent researchers and public health advocates can not assess or counterbalance these false claims with facts. Crucially, if it weren’t for the Internet Archive’s records we would not be able to do this research on deleted content in the first place, but these use cases suggest that the Internet Archive will soon have to address how their service can be adapted to deal with disinformation.

Hidden virality is growing in places where Whatsapp is popular because it’s easy to forward misinformation through encrypted channels and evade content moderation. But when hidden virality happens on Facebook with health misinformation, it is particularly disconcerting. More than 50% of Americans rely on Facebook for their news, and still, after many years of concern and complaint, researchers have a very limited window into the data. This means it’s nearly impossible to ethically investigate how dangerous health misinformation is shared on private pages and groups. 

All of this is a threat for public health in a different way than political or news misinformation, because people do quickly change their behaviors based on medical recommendations. 

Throughout the last decade of researching platform politics, I have never witnessed such collateral damage to society caused by unchecked abusive content spread across the web and social media. Everyone interested in fostering the health of the population should strive to hold social media companies to account in this moment. As well, social media companies should create a protocol for strategic amplification that defines successful recommendations and healthy newsfeeds as those maximizing respect, dignity, and productive social values, while looking to independent researchers and librarians to identify authoritative content, especially when our lives are at stake. 



from MIT Technology Review https://ift.tt/3bPGZKh
Share:

B2B challenger bank Finom raises $7M Seed from Target Global and General Catalyst

Just as challenger banks have appeared in the B2C space, so to have B2B startup banks aimed small businesses, among them startups like Qonto (Fr), Tide (UK), Penta (GER) and CountingUp (UK).

Today another such firm, Finom, has closed a €6.5m ($7M) seed funding round led by Target Global, with participation from General Catalyst. Further investors include FJ Labs, Raisin founders Tamaz Georgadze, Frank Freund and Michael Stephan, and Ilya Kondrashov, the founder of MarketFinance.

The company will primarily use the fresh capital to develop its banking product, and to expand further into Italy, France and Germany in the summer of 2020.

Finom puts accounting, financial management and banking functions for early-stage businesses and SMEs into one ‘mobile-first’ product. Businesses can set up an online account, with accounts payable and account receivable from both the app and the site in fairly short order. The company was started by the team that also launched Modulbank, ‘neobank’ for SMEs in Russia.

Konstantin Stiskin, co-founder of Finom, told Techcrunch: “The EU SME banking market size is more than €100bn. But according to McKinsey research, European entrepreneurs spend 74% of their time on non-core activities and pay for expensive and inconvenient products. Our goal is to enable small businesses in Europe to become more efficient and to thrive.”

He added: “We are not just a card with an account. We aim to be a foundation for SME’s and their everyday business, covering banking, accounting and financial management within one product.

Finom is now live in Italy, starting with e-invoicing, which allowed it to gain market knowledge and collect the data for accounting/payments and lending. The next countries to be launched will be France and Germany.

Mike Lobanov, General Partner and COO at Target Global said: “At Target Global we are great believers in the SME segment… The team of exceptional entrepreneurs standing behind Finom shares our view, and has already built a new standard for offering financial services to SMEs.”

Although Target Global is headquartered in Berlin, it has more than €800m in assets under management, with offices in London, Tel Aviv and Barcelona. Poortfolio includes companies such as Auto1, Delivery Hero, Omio (formerly GoEuro), TravelPerk, Rapyd and WeFox.



from TechCrunch https://ift.tt/3aOFvPd
Share:

Biloba lets you chat with a doctor if you have questions about your children

Meet Biloba, a French startup that wants to leverage tech to make it easier to keep your children healthy. The company recently launched a new mobile app that lets you chat with a doctor whenever you want between 8 AM and 8 PM. This way, if you have questions about your kids, you can get a quick answer.

Of course, a text conversation will never replace a visit to the pediatrician. But chances are you have a ton of questions, especially if you’re a first-time parent. Instead of browsing obscure discussion forums, you can go straight to a doctor.

Biloba isn’t working with pediatricians specifically. The company is also partnering with nurses and general practitioners. Eventually, the service is going to cost €10 per month but the company is waving fees during the lockdown.

After just three weeks, the startup managed to attract 4,000 users with around 200 conversations per day. Compared to other telemedicine services in France, such as Doctolib, Biloba doesn’t rely on video consultation. This way, it’ll be easier to deal with a large influx of new patients even with a small group of partner doctors.

The subscription business model is interesting for multiple reasons. First, Biloba isn’t covered by the French national healthcare system. In France, patients only get reimbursed if the doctor knows you already. That restriction has been lifted during the lockdown but it’s probably just a temporary lift.

Many parents probably don’t want to pay €120 per year to chat with a doctor when they could pay €0 through the national healthcare system. But if you can afford it, the barrier to medical advice becomes much lower.

Biloba previously released a vaccine reminder app that lets you enter information about your child’s vaccines and get reminders when the next scheduled vaccine is due.



from TechCrunch https://ift.tt/3bOgCog
Share:

African fintech firm Flutterwave launches SME e-commerce portal

San Francisco and Lagos-based fintech startup Flutterwave has launched Flutterwave Store, a portal for African merchants to create digital shops to sell online.

The product is less Amazon and more eBay — with no inventory or warehouse requirements. Flutterwave insists the move doesn’t represent any shift away from its core payments business.

The company accelerated the development of Flutterwave Store in response to COVID-19, which has brought restrictive measures to SMEs and traders operating in Africa’s largest economies.

After creating a profile, users can showcase inventory and link up to a payment option. For pickup and delivery, Flutterwave Store operates through existing third party logistics providers, such as Sendy in Kenya and Sendbox in Nigeria.

The service will start in 15 African countries and the only fees Flutterwave will charge (for now) are on payments. Otherwise, it’s free for SMEs to create an online storefront and for buyers and sellers to transact goods.

While the initiative is born out of the spread of coronavirus cases in Africa, it will continue beyond the pandemic. And Flutterwave’s CEO Olugbenga Agboola — aka GB — is adamant Flutterwave Store is not a pivot for the fintech company, which is an alum of Silicon Valley accelerator Y-Combinator.

“It’s not a direction change. We’re still a B2B payment infrastructure company. We are not moving into becoming an online retailer, and no we’re not looking to become Jumia,” GB told TechCrunch on a call.

Image Credits: Flutterwave

He was referring to Africa’s largest e-commerce company, which operates in 11 countries and listed in an NYSE IPO last year.

Flutterwave has a very different business than the continent’s big e-commerce players and plans to stick with it, according to GB.

When it comes to reach, VC and partnerships, the startup is one of the more connected and visible operating in Africa’s tech ecosystem. The Nigerian-founded venture’s main business is providing B2B payments services for companies operating in Africa to pay other companies on the continent and abroad.

Launched in 2016, Flutterwave allows clients to tap its APIs and work with Flutterwave developers to customize payments applications. Existing customers include Uber and Booking.com.

In 2019, Flutterwave processed 107 million transactions worth $5.4 billion, according to company data. Over the last 12 months the startup has been on a tear of investment, product and partnership activity.

In July 2019, Flutterwave joined forces with Chinese e-commerce company Alibaba’s Alipay to offer digital payments between Africa and China.

The Alipay collaboration followed one between Flutterwave and Visa to launch a consumer payment product for Africa, called GetBarter.

Then in January of this year, the startup raised a $35 million Series B round and announced a partnership with Worldpay FIS for payments in Africa.

On the potential for Flutterwave Store, there’s certainly a large pool of traders and small businesses across Africa that could appreciate the opportunity to take their businesses online. The IFC has estimated that SMEs make up 90% of Sub-Saharan Africa’s business serving the region’s one-billion people.

Flutterwave confirmed Flutterwave Store’s initial 15 countries will include Africa’s top economies and population countries of Nigeria, Ghana, Kenya and South Africa.

Those markets already have a number of players driving digital commerce, including options for small businesses to post their wares online. Jumia’s Jumia Marketplace allows vendors register on its platform and use the company’s resources to do online retail.

Facebook has made a push into Africa that includes its overall push to get more users to sell on Facebook Marketplace. The social media giant now offers the service in Nigeria — with 200 million people and the continent’s largest economy.

GB Flutterwave disrupt

Flutterwave CEO GB, Image Credits: TechCrunch

eBay has not yet gone live in Africa with its business to consumer website, that allows any cottage industry to create a storefront. The American company does have an arrangement with e-commerce startup MallforAfrica.com for limited sales of African goods on eBay’s U.S. shopping site.

On where Flutterwave’s new product fits into Africa’s online sales space, CEO GB says Flutterwave Store will maintain a niche focus on mom and pop type businesses.

“The goal is not be become like eBay, that’s advocating for everybody. We’re just giving small merchants the infrastructure to create an online store at zero cost right from scratch,” he said.

That’s something Flutterwave expects to be useful to Africa’s SMEs through the COVID-19 crisis and beyond.



from TechCrunch https://ift.tt/2yf1CB3
Share:

Index and Credo lead a $2.75M seed in anti-fraud tech, Resistant AI

Prague based Resistant AI has nabbed a $2.75M seed round. The security startup’s machine learning technology is designed to be deployed on top of AI systems used for financial decision making to protect customers in markets such as financial services and ecommerce from attacks such as targeted manipulation, adversarial machine learning and advanced fraud.

The seed round was co-led by Index Ventures (Jan Hammer) and Credo Ventures (Ondrej Bartos and Vladislav Jez). Seedcamp also participating, along with Daniel Dines, CEO of UiPath; Michal Pechoucek, CTO of Avast and other unnamed angel investors. Bartos joins the board of directors on behalf of the investors.

The startup sells an additional layer of protection that’s specifically designed for tightening security around automated functions such as credit risk scoring and anti-money laundering by using tech to detect fake documents that feed such systems. Its tech is also aimed at uncovering suspicious patterns of transactions which might indicate a strategic attack on the model itself or an attempt to copy sensitive data.

“Historically, all systems that make high-value financial decisions become targeted. This is already happening with the automated systems deployed by our fintech and financial customers and we are here to protect them,” said Martin Rehak, founder and CEO, in a statement.

The seed round is Resistant AI’s first tranche of external funding, with the founders bootstrapping the company since starting up in February 2019.

“We have onboarded the first customers in 2019 and the funding will help us scale our sales organisation to meet the rising demand from banks and fintechs,” Rehak told us. “We are protecting the AI&ML systems used in financial automation from manipulation or misuse by smart attackers.”

Resistant AI has two products it offers its customers at this stage: First, document inspection. It offers a machine learning system that’s designed to flag and reject “malicious documents” submitted for automated processing. “Bank statements, payslips, invoices, purchase orders and KYC documents submitted to fintechs and banks are frequently manipulated or completely falsified,” explained Rehak. “Resistant Documents, our first service, identifies and rejects the suspicious or malicious inputs.”

A second offering — Resistant Transactions — applies AI to spot problematic transaction patterns.

“We work with the fact that most attacks on AI systems require extensive interaction to discover the vulnerability,” he said. “Our system is unique by inspecting all the customer queries (which can take form or payments, money transfers or credit applications assessed by the system we protect) in context of similar queries. By looking at the stream of queries statistically, we can recognise and block the attacks that seek to steal the information embodied in the model (information stealing) or, worse, aim to nudge the system into making the wrong decision by exploiting an existing bias in the system.”

Resistant AI isn’t breaking out customer numbers yet but Rehak said it onboarded its first customers last year. “The funding will help us scale our sales organisation to meet the rising demand from banks and fintechs,” he added, saying also that it will be spending on building out product features and extending functionality, as well as on beefing up the sales and go-to-market team.

“Right now, our target customers are financial and fintech startups, as well as other companies deploying the automated process (both software and RPA) in their financial processes,” he added. “The financial systems are our current focus, but the attacks on machine learning are relevant in many other areas: process automation, e-commerce, manipulation of ‘trend detection’ algorithms in social media and other opportunities.”

It’s using a SaaS model — preferring a value approach to pricing, per Rehak. “Our problem and approach is new, and we feel that the value pricing model aligns the incentives between us and the customer in the optimal way,” he said on that.

Asked who he sees as the main competitors for the business, he cited Google Brain plus the tech giant’s activities in adversarial machine learning.

The majority of work in this area is currently done in-house by the large tech companies building their own proprietary systems — such as Google and Microsoft, he added.

Other competitors he mentioned were Inpher, which is enabling machine learning on encrypted data; Sentilink, which is doing detection of synthetic identities in the US; and Bullwall (Denmark) and YC-backed Inscribe (US/Ireland) which are focused on document forgery.

Resistant AI’s founders have a background in machine learning applied to cyber security problems having founded Cognitive Security, an earlier startup which they subsequently sold to Cisco in 2013. Over some 12 years working in the security industry Rehak said they saw how attackers targeting AI systems were getting increasingly sophisticated in avoiding detection — which gave them the idea for their latest business.

Commenting on the seed funding in a statement, Jan Hammer, general partner at Index Ventures, added: “Automation, efficiency and reliability are cornerstones of financial innovation. As machine learning takes more and more nuanced financial decisions, it needs to be protected. And this is not true only in finance, but the attacks will rapidly spread to other domains as well. More of our activity today takes place online, a trend accelerated by COVID-19, and one we believe will last. With criminals ready to take advantage of every vulnerability, the need for solutions such as those from Resistant AI has never been greater.”



from TechCrunch https://ift.tt/2xhUhAe
Share:

Trump’s Disinfectant Talk Trips Up Sites’ Vows Against Misinformation


By BY SHEERA FRENKEL AND DAVEY ALBA from NYT Technology https://ift.tt/2KIszzX
Share:

Q&A with EU's antitrust chief Margrethe Vestager on virus tracking apps and privacy, her disagreements with Elizabeth Warren about regulating big tech, and more (Isaac Chotiner/New Yorker)

Isaac Chotiner / New Yorker:
Q&A with EU's antitrust chief Margrethe Vestager on virus tracking apps and privacy, her disagreements with Elizabeth Warren about regulating big tech, and more  —  “She hates the United States perhaps worse than any person I've ever met.”  This was President Trump's assessment of Margrethe Vestager …



from Techmeme https://ift.tt/2zJJgZu
Share:

Wednesday, 29 April 2020

Meet EventBot, a new Android malware that steals banking passwords and two-factor codes

Security researchers are sounding the alarm over a newly discovered Android malware that targets banking apps and cryptocurrency wallets.

The malware, which researchers at security firm Cybereason recently discovered and called EventBot, masquerades as a legitimate Android app — like Adobe Flash or Microsoft Word for Android — which abuses Android’s in-built accessibility features to obtain deep access to the device’s operating system.

Once installed — either by an unsuspecting user or by a malicious person with access to a victim’s phone — the EventBot-infected fake app quietly siphons off passwords for more than 200 banking and cryptocurrency apps — including PayPal, Coinbase, CapitalOne and HSBC — and intercepts and two-factor authentication text message codes.

With a victim’s password and two-factor code, the hackers can break into bank accounts, apps and wallets, and steal a victim’s funds.

“The developer behind Eventbot has invested a lot of time and resources into creating the code, and the level of sophistication and capabilities is really high,” Assaf Dahan, head of threat research at Cybereason, told TechCrunch.

The malware quietly records every tap and key press, and can read notifications from other installed apps, giving the hackers a window into what’s happening on a victim’s device.

Over time, the malware siphons off banking and cryptocurrency app passwords back to the hackers’ server.

The researchers said that EventBot remains a work in progress. Over a period of several weeks since its discovery in March, the researchers saw the malware iteratively update every few days to include new malicious features. At one point the malware’s creators improved the encryption scheme it uses to communicate with the hackers’ server, and included a new feature that can grab a user’s device lock code, likely to allow the malware to grant itself higher privileges to the victim’s device like payments and system settings.

But while the researchers are stumped as to who is behind the campaign, their research suggests the malware is brand new.

“Thus far, we haven’t observed clear cases of copy-paste or code reuse from other malware and it seems to have been written from scratch,” said Dahan.

Android malware is not new, but it’s on the rise. Hackers and malware operators have increasingly targeted mobile users because many device owners have their banking apps, social media, and other sensitive services on their device. Google has improved Android security in recent years by screening apps in its app store and proactively blocking third-party apps to cut down on malware — with mixed results. Many malicious apps have evaded Google’s detection.

Cybereason said it has not yet seen EventBot on Android’s app store or in active use in malware campaigns, limiting the exposure to potential victims — for now.

But the researchers said users should avoid untrusted apps from third-party sites and stores, many of which don’t screen their apps for malware.



from TechCrunch https://ift.tt/3aOYaKP
Share:

Blog Archive

Definition List

Unordered List

Support