Connect with us

Featured

Fake Google Play apps steal Instagram credentials

Published

on

Instagram users have recently been the target of new credential-stealing apps appearing on Google Play store. ESET explains how it was done and how to protect yourself.

Instagram users have been the target of several new credential stealing apps, appearing on Google Play as tools for either managing or boosting the number of Instagram followers.

unnamed

Figure 1: The malicious apps on Google Play

Under the detection name Android/Spy.Inazigram,  13 malicious applications were discovered in the official Google Play store.  The apps were phishing for Instagram credentials and sending them to a remote server.

While they appear to have originated in Turkey, some used English localization to target Instagram users worldwide.  Altogether, the malicious apps have been installed by up to 1.5 million users. Upon ESET’s notification, all 13-apps were removed from the store.

How do they operate?

All the applications employed the same technique of harvesting Instagram credentials, and sending them to a remote server.  To lure users into downloading, the apps promised to rapidly increase the number of followers, likes and comments on one’s Instagram account.

Ironically, the compromised accounts were used to raise follower counts of other users, as is explained later in the article.

unnamed-1

Figure 2 – “Instagram followers” promising to boost Instagram engagement

As shown in the following screenshot from ESET’s analysis of one of these apps, “Instagram Followers”, it requires the user to log in via an Instagram lookalike screen. The credentials entered into the form are then sent to the attackers’ server in plain text.  After having entered the credentials, the user will find it impossible to log in, as explained in an “incorrect password” error screen.

unnamed-2unnamed

Figure 3 – Instagram login lookalike screen
Figure 4 – “Incorrect password” error preventing the user from logging in

The error screen also features a note suggesting the user visits Instagram’s official website and verifies their account in order to sign in to the third-party app.  As the victims are notified about unauthorised attempt to log in on their behalf and promoted to verify their account as soon as they open Instagram, the note aims to lower their suspicion in advance.

unnamed-2

Figure 5 – official Instagram notification about unauthorized login attempt

If the attackers are successful and the user doesn’t recognise the threat upon seeing their Instagram’s notification, the stolen credentials can be put to further use.

What happens to stolen credentials?

You might ask yourself: What use is there for a couple of (hundred thousand) stolen Instagram credentials.

Apart from an opportunity to use compromised accounts for spreading spam and ads, there are also various “business models” in which the most valuable assets are followers, likes and comments.

In ESET’s research, we’ve traced the servers to which the credentials are sent off and connected these to websites selling various bundles of Insatgram popularity boosters.

unnamed-1

Figure 6 – websites selling Instagram followers

The following scheme explains how this works:

unnamed-3

How to protect yourself?

If you have downloaded one of these apps, you will find one of its icons under your installed applications.  You will also have seen a notice from Instagram about someone attempting to log into your account, as shown in Fig 4.  Finally, your Instagram account might appear to have increased following and follower numbers, or you might be getting replies to comments you never posted.

In order to clean your device, uninstall the above mentioned apps found in your Application Manager or use a reliable mobile security solution to remove the threats for you.

To secure your Instagram account, change your Instagram password immediately.  In case you use the same password across multiple platforms, change these as well. As malware authors are known to access other web services using the stolen credentials, you are advised to use a different password on each of your accounts.

To prevent getting your social media accounts compromised, there are a couple of things to keep in mind when downloading third-party apps from Google Play:

Do not insert your sensitive information into untrusted login forms of third-party apps. To verify  whether an app is to be trusted, check the popularity of its developer by number of installs, ratings and, most importantly, content of reviews.

However, don’t be too quick to jump to conclusions, as many of the ratings and reviews can’t be trusted.  When in doubt, opt for high-quality apps marked as Top Developer or found in the Editor’s Choice category.

Last but not least, use a reputable mobile security solution to protect your device.

Featured

CES: And thanks for all the beer!

Last week, the Las Vegas expo showed off its fun side with state-of-the-art technologies for making and enjoying beer, writes BRYAN TURNER

Published

on

From craft beer-making machines to robots that pour beer, CES had more beer than usual in Las Vegas last week. And even free beer if you found the right stand. Stampede’s saloon-style booth offered beer to visitors who tried out its latest drones, virtual reality, and other gaming products. No beer tech, though.

Here are some of the beer technologies that stood out:

LG HomeBrew – Craft beer made at home

LG’s HomeBrew craft beer-making machine,  debuted at CES 2019, brings the brewing process home thanks to single-use capsules,  a self-cleaning feature, and an algorithm optimised for fermentation. 

Like a Nespresso coffee machine, the beer maker uses capsules, which contain malt, yeast, hop oil and flavouring. At the press of a button, LG HomeBrew automates the whole procedure from fermentation and carbonation to ageing. A companion app lets users check HomeBrew’s status at any time during the process, from their handsets.

The beer machine not only offers a simple way to make craft beer, but also enhances the quality of beer it makes. The fermentation algorithm intelligently controls the fermenting process with precise temperature and pressure control. It automatically sanitises itself, using nothing more than hot water, ensuring everything is hygienically clean for the next batch.

Designed with discerning beer lovers in mind, HomeBrew allows for in-home production of batches of more than 4 litres of beer in a variety of styles. The following five distinctive, flavoured beers are available now: 

  • Hoppy American IPA
  • Golden American Pale Ale
  • Full-bodied English Stout
  • Zesty Belgian-style Witbier
  • Dry Czech Pilsner

The only catch? It takes about two weeks to make, depending on the beer type.

“LG HomeBrew is the culmination of years of home appliance and water purification technologies that we’ve developed over the decades,” said Dan Song, president of LG Electronics Home Appliance & Air Solutions Company. “Homebrewing has grown at an explosive pace, but there are still many beer lovers who haven’t taken the jump because of the barriers to entry, like complexity, and these are the consumers we think will be attracted to LG HomeBrew.”

Click here to read about the party speaker that holds beer and robots that pour beer.

Previous Page1 of 3

Continue Reading

Featured

CES: Alienware gets Legend-ary

Published

on

At CES in Las Vegas last week, Dell’s Alienware released a family of high-end, thin, light, and affordable machines for both amateur and professional gamers – and a new identity.

Alienware marked CES 2019 as a brand milestone with the debut of a new design identity, Alienware Legend. It aims to set a new bar of excellence for what gamers want most – performance and function. Alienware says it evaluated multiple concepts and chose one that was the biggest and boldest departure from its current look.

Alienware Legend, says the company, stays true to the brand’s core design tenets, taking cues from its deep roots in sci-fi culture and its early industrial designs, to distinguish the brand from the rest of the industry. The new Legend design is optimised with cutting-edge thermal cooling technology to achieve and sustain overclocking power, improved AlienFX lighting, and ultra-thin screen borders. It also unveiled a new “three-knuckle hinge” design that reduces the overall dimension while creating a stronger assembly, all combining to yield a better gaming experience.

“We’re excited to come to this year’s CES with some truly groundbreaking products, next-gen software and strategic partnerships that will bring more people to experience PC gaming and advance the industry,” said Frank Azor, vice president and general manager of Alienware. “The legend design answers the call for more and better from our gaming community, and the new G Series laptops will make PC gaming even more accessible to those looking for high-performance gaming at a cost they can appreciate.”

Click here to read about Alienware Legend in action with the Area-51m and m-series laptops

Previous Page1 of 3

Continue Reading

Trending

Copyright © 2018 World Wide Worx