FireEye Labs has recently discovered six variants of a new Android threat that steals text messages and intercepts phone calls. We named this sample set “Android.HeHe” after the name of the activity that is used consistently across all samples. Here is a list of known bot variants: MD5 VirusTotal Detection Ratio 1caa31272daabb43180e079bca5e23c1 1caa31272daabb43180e079bca5e23c1 2/48 2/48 8265041aca378d37006799975fa471d9 8265041aca378d37006799975fa471d9 1/47 1/47 2af4de1df7587fa0035dcefededaedae 2af4de1df7587fa0035dcefededaedae 2/45 2/45 2b41fbfb5087f521be193d8c1f5efb4c 2b41fbfb5087f521be193d8c1f5efb4c 2/46 2/46 aa0ed04426562df25916ff70258daf6c aa0ed04426562df25916ff70258daf6c 1/46 1/46 9507f93d9a64d718682c0871bf354e6f Read more...
Archive for 'January 2014'
JS-Binding-Over-HTTP Vulnerability and JavaScript Sidedoor: Security Risks Affecting Billions of Android App Downloads
January 16, 2014 7:45 PM By Yulong Zhang, Dawn Song, Hui Xue, Tao Wei
Third-party libraries, especially ad libraries, are widely used in Android apps. Unfortunately, many of them have security and privacy issues. In this blog, we summarize our findings related to the insecure usage of JavaScript binding in ad libraries.First, we describe a widespread security issue with using JavaScript binding (addJavascriptInterface) and loading WebView content over HTTP, which allows a network attacker to take control of the application by hijacking the HTTP traffic. We Read more...
Trends in Targeted Attacks: 2013
January 13, 2014 5:00 AM By Nart VilleneuveFireEye has been busy over the last year. We have tracked malware-based espionage campaigns and published research papers on numerous advanced threat actors. We chopped through Poison Ivy, documented a cyber arms dealer, and revealed that Operation Ke3chang had targeted Ministries of Foreign Affairs in Europe.
Read more...Tracking Malware with Import Hashing
January 23, 2014 8:20 PM By MandiantTracking threat groups over time is an important tool to help defenders hunt for evil on networks and conduct effective incident response. Knowing how certain groups operate makes for an efficient investigation and assists in easily identifying threat actor activity.
Read more...Mandiant Announces Merger with FireEye
January 2, 2014 9:14 PM By Helena BritoFireEye, the leader in stopping today's advanced cyber-attacks, announced today that it has acquired privately held Mandiant, the leading provider of advanced endpoint security products and security incident response management solutions. The acquisition, which recognizes the ever-increasing intensity of cyber-attacks and follows nearly two years of collaboration, creates the industry's leading advanced threat protection vendor with the ability to find and stop attacks at every stage of the attack life cycle. The transaction closed on December 30, 2013.
Read more...Leveraging the Power of Solutions and Intelligence
January 27, 2014 3:40 PM By Richard BejtlichWelcome to my first post as a FireEye™ employee! Many of you have asked me what I think of FireEye's acquisition of Mandiant. One of the aspects of the new company that I find most exciting is our increased threat intelligence capabilities. This post will briefly explore what that means for our customers, prospects, and the public.
Read more...Combining Intel Forces to Fight the Bad Guys
January 31, 2014 6:00 PM By Intel TeamWhat's the best way to get intelligence analysts to geek out? Let them sink their teeth into new piles of data! And that's exactly what's been happening here since the FireEye™ and Mandiant® intelligence teams joined forces. Our intel teams have been busy with show-and-tell, talking about the threat groups we're tracking and their latest tactics. We've been swapping best practices and peeking behind the curtain at the vast repositories of data and experience both have amassed.
Read more...Sign up for email updates
Get information and insight on today's advanced threats from the leader in advanced threat prevention.
