Weekly Summary : Android tel URi and Malaysia Grey Cloud
Posted: October 2nd, 2012 | Author: xanda | Filed under: IT Related | Tags: Android, exabytes, redkit, samsung, USSD | No Comments »What a busy week so here is my late update.
I’ve been asked by my wife on this weird javascript pattern. I’m not managed to download the content of the php file due to it has been removed, and some of them were giving me infinite loop of 302. Someone tweet me and ask me to set the referrer as the URL of the ‘infected’ website. A few hours later, I’ve saw a blog post “Redkit Exploit Kit: upgrades in anti-forensics.” popping up from my RSS reader. Mystery solved!
You might have heard about remote USSD attack has been discussed last week. This ‘vulnerability’ exist due to improper handling of “tel:” URi in Android. It affects many phones and according to this entry, it has been verified on not only Samsung Galaxy S3, but also on an HTC One X (running HTC Sense 4.0 on Android 4.0.3) and a Motorola Defy (running Cyanogen Mod 7 on Android 2.3.5). Patch has been released to address this issue and Android 4.1 has been verified not vulnerable to this vulnerability. Alternatively, users can use TelStop or Auto-Reset Blocker to prevent tel URi to be executed without user prompt.
A little update from Malaysia landscape. Exabytes has announced that their cloud server has been compromised and some virtual machines and data have been deleted. Official announcement can be found here.
Thats all.. Stay safe