sloshnmosh

Just say No to push notifications!

There is a huge problem with spammy push notifications that trick users into accepting push notifications by using fake media players and fake CAPTHAs that if accepted will push all manner of SPAM on victims devices that say they have multiple viruses that pull up Google play store app to some bogus Cleaner/antivirus apps.

The push notifications are hosted on Cloudfront using AdMaven and AdFly and AppNexxus.

I have been trying to report these criminals for a couple of years now with no luck.

Cloudfront refuses to take down the script that AdMaven uses and AdMaven, AdFly, AppNexxus and Proppelerads all ignore multiple attempts to contact.

Have you gone to the VA?

I know our local Vetrans hospital has a small sleep study room for diagnosis and will supply CPAP to those in need.

Walgreens has always tried to harvest every single penny they could squeeze from their customers, mainly by selling the customers PII to anyone and everyone, so this is no big surprise to me.

It reminds me of the obnoxious talking gas pumps that play ads while you’re filling your car.

At first there used to be a “mute” button to where you could silence the crap and all the plastic was worn away from everyone mashing it trying to shut it up.

Now I no longer see any option to mute the ads.

I hate ads with a passion and won’t allow them to run on my devices. Mainly for security and privacy but the aggravation they cause is palpable.

Whenever I work on someone else’s computer and open a web browser I am in shock that people can even concentrate with all the garbage on the screen.

I heard that ads were able to circumvent DNS by using canonical names.

But uBlock origin and PiHole both do CNAME inspection to block this.

Is there other ways that ads are circumventing DNS ad-blockers such as PiHole?

I came here to say the same. I even purchased a LAN throwing star to look to see if my Asus router was sending anything to TrendMicro but never did get around to it.

But I will now for sure.

Google is complicit in this by their refusal to ban larger app developers that create malicious apps. Google may kick the malicious app off the play store for a couple weeks and make the developer remove the malware (or obfuscate it better) but then allows the app(s) back to the play store.

The software being used to push this malware is from Propeller ads and more recently AdMaven but is protected by Russian DDoS services.

Be VERY careful on accepting push notifications!

There is a huge malvertising campaign targeting mobile users (especially Android) that tricks users into accepting push notifications with fake CAPTCHAs or fake media player buttons that push malicious ads and mobile malware and can even lead to botnet activity.

The risk versus value is too high.

Hmmm. My tinfoil hat tells me that Comcast may be doing this to tie users Twitter accounts to their real names and addresses.

Excellent article!

What’s also very interesting is that the article links to page from TrendMicro about malicious Android apps using Java’s version of SSH to infiltrate internal corporate networks.

TrendMicro’s own Android app ALSO contained the same Java SSH sdk.

I was hoping this was an article about packing different executables into images like I saw on Twitter.

+1 for the zerohedge comment.

A few months ago something happened over at Zerohedge.. The site became unviewable with JavaScript disabled so I stopped going to the site. But it looks like they’ve had a change of heart and can now be viewed with JavaScript disabled.

But it also seems like the content has changed from what it used to be.

Did they change ownership or is it just my imagination from taking a break from their site when it became dependent upon JavaScript?

Fun fact..

The first 4 smartphones I ever owned all came with preinstalled malware or malware was added after a “security update”

One of the people I follow on Twitter collects old electronics and I’ve seen him do some pretty interesting hacks to boot his vintage devices without using the long-dead original battery. I’ve seen him use 2 different rechargeable battery packs used for development boards attached to the battery terminals of an older laptop and even seen him using a screwdriver tip with leads attached to fit inside the female power port of an older device.

I don’t know his exact Twitter handle but you can find him under “foone”

As the recent NSO/Pegasus scandal has proved, there is no need to add backdoors into our cellphones.

If someone is suspected of a crime a warrant can be issued by a judge and the suspects phone compromised under lawful control of law enforcement.

What Apple is wanting to do is pre-crime where everyone is considered suspect until proven otherwise.

Avast should be avoided completely. They have truly lost their way and have become more of a privacy/security risk than anything.

Did you know that Avast has a “confidential collaborator” known as Psafe that has an antivirus/cleaner app on Google Play called DFNDR that has been tricking users into installing their bogus app through scareware popunder fake virus warnings for over 8 years straight.

The DFNDR app was funded by the Chinese Qihoo and early versions of the app used to harvest users social media data and send data to Chinese servers. DFNDR also was not forthcoming with AV-test about it’s antivirus detectction engine.

It uses Avast’s detection engine and when AV-test found out the DFNDR app was no longer included in its testing.

The app itself is filled with trackers and several advertising SDK’s which take over the users device.

I have communicated with Psafe in private emails to show them the source of the fake virus warnings so that they could be stopped. Psafe requested I not go public with my findings for 30 days which I granted.

The fake virus warnings never stopped, not even on the sites I gave Psafe as examples.

Avast for it’s part banned me for life from their forums without warning.

Look at the user reviews of the DFNDR app on the Play Store to see for yourself.

Avast is nothing bat data harvesting ad agency at this point.

I’ve been tracking a massive mobile malvertising and drive-by malware download operatition for the last several months.

The malvertising company is abusing a script found on GitHub called: “alerty” hXXps://github.com/undead2/alerty#readme

Are you sure about that? Facebook has been caught several times doing shady surveillance type stuff on its users. The VPN app that is mentioned in the thread is one. There was another incident years ago when Facebook users were forced to download antivirus software from their “trusted partners” and scan their PC’s before they were allowed to login to their FB accounts. People that had been flagged for scanning tested some theories and found that it had nothing to do with the users computer as their partner that shared the same device could login to their FB account on the same machine without having to run an AV scan.

There’s not a lot of information out there about that incident.

We have a Crisis Response Team in my city and it has been blessing.

I believe they are actually part of the fire department or under their leadership but I could be wrong.

The most important thing about the crisis response team is time and patience.

The team is trained in descalation and are able to spend hours with a person in crisis.

They will sit and listen to the person, give them rides if need be and also make contact with people even if they aren’t in crisis to build trust and reliability.

Most of the time that’s all that someone really needs is just someone that will take the time to really listen.

I will also add that there is a definite need for a police presence in my city as well.

I contacted Amazon to report an advertiser out of Tel Aviv that was using JavaScript hosted on CloudFront to fingerprint user's devices and if an Android device was detected a fake media player or fake CAPTCHA would trick user's into accepting push notifications for fake virus warnings to install questionable apps from the Play Store.

This script also pushed ads for a fake AdBlock app that was a dropper for banking trojan apps.

Amazon refused to do anything about it.

More info:

https://forum.xda-developers.com/t/massive-mobile-advertisin...

Hmmm, my pihole is blocking me from viewing the site.

I’d check the logs but my cat is on my keyboard.

I do have cloudfront blocked which breaks many things, not sure yet if it’s related.

OMG! Yes!!

I was a master at this back in the day, and even better at StarGate (Defender2)

One of the things about StarGate was that you could write almost a whole sentence if you beat the high score instead of just your initials.

I was in fierce competition with my friend and we would troll each other by writing horrible stuff on the high score for everyone in the arcade to see.

Another development board I’ve been looking at communicates with your old Android phone to use the phones built in sensors called SensoDuino.

Has anyone on HN have experience with the SensoDuino?

https://www.instructables.com/SensoDuino-Turn-Your-Android-P...

Thanks @adbachman, I’ve been looking at similar items like this for a home automation project that doesn’t rely on Google or Amazin

I’ve seen an Android app (DFNDR antivirus/cleaner) take over Androids package manager before the user has even opened the application or agreed to any terms of service.

If you download the app from Google Play and try and clear the cache or storage of the app it brings up its own cache cleaner and doesn’t allow to purge the storage or cache of the DFNDR app.

This app is also heavily advertised by fake virus warnings to trick users into installing and many users have complained of receiving fake virus warnings right after they’ve uninstalled the app.

That is exactly how watering-hole websites work, they create a site critical of the attacker.

I uploaded the url to “urlscan(.)io” and it STILL doesn’t load.

I’m examining the scripts now.

However, there is a blob of JavaScript that doesn’t load into urlscan. Highly suspect.

Is this some watering hole?

No kidding. I’m not enabling JavaScript to view some random website.

Especially if it mentions NSO Grouo!

Scraping for bikini pics?

Reminds me of this lawsuit against Facebook:

https://www.wired.com/story/facebook-six4three-bikini-app-la...

I live near that area and had heard and seen a drone above my house in the very early morning before dawn a month ago.

I first heard a sound like a swarm of bees overhead but looked up to see the drone.

It took off southbound at a high rate of speed in the same flight path that the police helicopters use.

I have no idea if this is related but I thought it was very odd for a drone to be flying at that time over a heavily populated area near the University of Arizona.