Android Pay no longer works for devices with system-less root

It used to be that the “system-less root” approach could allow Android users to gain root access and do their tweaks, but still retaining use of secure payment features like Android Pay. Ordinarily, gaining root access would have meant forfeiting these features – they won’t work when device security is breached, as in gaining root. System-less root was a workaround for this, but only until yesterday, it seems.

A Reddit user “npjohnson1” reports that SafetyNet, the server-side security feature that checks for breaches in devices, now detects system-less root and has made Android Pay not usable. The user says that the Android Pay app will still open, still try to run a transaction, and even give you either a green light for transactions or an error message sometimes. But he assumes that SafetyNet has already detected system-less root on his Nexus 6P.

root_systemless

The user gives ideas on how the Android Pay app can be brought back to usage, and it involves going through a full UNROOT. This means losing your system-less root, and usage of all other apps and features that require root access.

It was good while it lasted, and it lasted for a good bit of time too. But this was bound to happen at one point in time or another. You will just have to weigh the advantages, and which features you want – root, or Android pay?

SOURCE: Reddit

Tags: , , ,

IEEE Anti-Malware Support Service Goes Live

Through the collaborative effort of major players in the computer security industry, organizations now have two new tools for better malware detection.

As readers know all too well, the computer security industry today faces many challenges in detecting malware and effectively vetting the supply chain on behalf of providers and consumers of anti-malware software.

Until recently, developing common solutions has been hindered by the proprietary nature of much software, which requires comprehensive collections of “clean” software to ensure the development of malware detection tools that are effective and error-free. Unfortunately, this work runs up against the need to protect intellectual property (IP) embedded in software.

Meanwhile, with the advent of cloud-based services, intelligent “things” and Big Data, the urgency of the malware detection challenge has grown sharply.

What has been sorely needed is a neutral, trusted, nonprofit organization that can devise a means for players in computer security to share the relevant data to allow the creation and use of anti-malware support services to benefit the entire industry and, of course, a sizeable chunk of humanity.

I use the past tense on the computer security industry’s mutual needs because, as readers of Dark Reading may already know, such an organization – the IEEE Standards Association (IEEE-SA) – has undertaken this challenge and the results – our Anti-Malware Support Service (AMSS) – are now available.

Development of the AMSS began in 2009 and its two essential services went live late last year. I’ll use this blog to review what’s being offered and the thinking behind it because as more players subscribe, the stronger the results will be for all.

AMSS is a set of shared support services, created through the collaborative efforts of all the major players in the computer security industry. It enables individual computer security companies and the industry as a whole to respond more effectively and efficiently to rapidly evolving malware threats.

The purpose behind the AMSS is to take advantage of economies of scale to produce solutions for common challenges faced by computer security companies. As our heuristics become more aggressive and our cloud technologies become more dominant, it’s critical for us all to be working with a good corpus of clean files so that we don’t generate time-consuming and, therefore, costly false positives. 

In this project, we’ve overcome the understandable reluctance of computer security players to share their IP-bearing files to develop better malware detection. With the AMSS system, participants need only share metadata such as hashes and file names and version information — no proprietary IP is exposed in this process. The AMSS approach allows, in particular, cloud-based systems to incorporate that metadata to reduce the overall false positive rate.

CMX andTaggant

The IEEE-SA’s AMSS is comprised of two main services: the Clean File Metadata Exchange (CMX) and the Taggant System.

CMX provides real-time access to clean software metadata, even prior to the publication of the corresponding software, which helps reduce the number of false positives from anti-malware software. Currently, Microsoft is posting all operating system-related metadata from Windows XP through Windows 10. All new public data being created by Microsoft is also being posted on the CMX.

CMX users fall into two categories: “providers” and “consumers.”

“Providers” deliver the metadata at the time of final software application build for publicly released software and for internal corporate applications. Participation requires an invitation or an existing Class 3 Digital Code Signing Certificate. The CMX is being provided to “consumers” to retrieve the metadata for use in security product back-end systems or other processing.

The Taggant System we’ve developed places a cryptographically secure marker in the packed and obfuscated files created by commercial software distribution packaging programs or “packers.” The markers identify the specific packer user’s license key used to create the file. This allows users to gain reputation. It also allows for the blacklisting of license keys should they be used to create malware. The individual packer user (e.g. a malware author) can then be blacklisted and all files created by that packer user will be reported as suspicious in the Taggant System. A new version, Taggant V2, was developed to address the need for applying taggants to different types of files and objects. This will be used by the Clean Software Alliance to self-regulate the distribution of free and ad-supported software.

The Taggant System has two types of users: software packer vendors (SPVs) who are makers of commercial packing and obfuscation programs, and security software vendors (SSVs) who provide security solutions, validate taggants, and compare them to a blacklist of bad license keys. This requires licensing the use of the Taggant System IEEE Public Root Key and getting access to the blacklist.

The AMSS offers two fully operational services and delivers value for subscribers that include Microsoft. Consider subscribing by visiting the AMSS Web page where you will find more information, downloads, and the ability to submit information about your interest in our services. Collectively, we can overcome major challenges in computer security, with value for all.  

Igor Muttik, Vice-Chair, IEEE Industry Connections Security Group, Vice-Chair, IEEE Malware Working Group, also contributed to this article. 

Related Content: 

 

 

Mark Kennedy is a Distinguished Engineer in the Security Technology and Response (STAR) group, and has worked for Symantec for nearly 25 years, the last 16 in security. He is a named inventor on 49 issued patents. In conjunction with his work at Symantec, Mark serves on the … View Full Bio

More Insights

Security researcher finds ‘backdoor’ to MediaTek processors, open to hackers

Justin Case – handle for one of XDA’s more infamous and inflammatory, but really quite brilliant security researchers – has found a “backdoor” to a MediaTek processor that may be exploited by hackers if they knew about it. If that’s not enough of a problem, the researcher found out that the chipset manufacturer had no proper bug reporting mechanism in place that he had to get their attention via Twitter.

jcase_mtk

The backdoor is described by MediaTek themselves as a “de-bug feature created for telecommunication inter-operability testing in China.” But manufacturers were supposed to disable this backdoor upon shipping the devices. Wonder of wonders, some manufacturers didn’t. The code above was discovered in an Obi Alligator S454 device. Don’t worry, we’re not familiar with is as well – but the chipset it was using was a MediaTek MT6582, which worryingly is being used by some higher profile devices out there.

MediaTek has replied over Twitter that they will be showing this issue to their “Product Security Taskforce.” When asked why MediaTek does not have a proper bug-reporting method, they said, “We’re assessing how to garner users’ feedback in a more formal manner and will get back to you. Cheers.” Well, that will have to do for now. The official reply to this issue is quoted below:

“We are aware of this issue and it has been reviewed by MediaTek’s security team. It was mainly found in devices running Android 4.4 KitKat, due to a de-bug feature created for telecommunication inter-operability testing in China.”

“After testing, phone manufacturers should disable the de-bug feature before shipping smartphones. However, after investigation, we found that a few phone manufacturers didn’t disable the feature, resulting in this potential security issue.” – MediaTek Spokesperson

VIA: SlashGear

Tags: , , ,

White House sets dangerous precedent for future government workers, after refusing clearance for security expert Ashkan Soltani

Ashkan Soltani speaking at the Black Hat 2015 conference in Las Vegas, NV (Image: Black Hat)

Ashkan Soltani has left his position in the Obama administration two months after he was hired, because he was denied the security clearance “necessary to continue work” at the White House.

In a brief post on Twitter on Friday, Soltani declined to speculate on the reason why he was not cleared for classified work in government. “I’m told this is something that happens from time to time,” he said. “I passed the mandatory drug screening some time ago, and the FBI background check was still underway,” he added.

“There was also no allegation that it was based on my integrity or the quality of my work,” he added.

As noted by The Guardian, Soltani’s hiring back in December raised eyebrows among some in the executive branch for his prior journalistic work with The Washington Post. While he did not leak or publish any of the classified National Security Agency documents leaked by whistleblower Edward Snowden, it was Soltani’s job to ensure and maintain the security and integrity of the documents. As his former Washington Post colleague Barton Gellman said on Twitter, Soltani helped to make the “workspace far more secure.”

“Looks like the [national security] bureaucracy choked on a clearance,” said Gellman, who Soltani worked closely with, calling the move a “big loss of talent and integrity” for the White House.

Noting some of his achievements during his pre-government journalistic career, ACLU principal technologist Christopher Soghoian said that it was Soltani’s stories with the Washington Post that helped push Yahoo to turn on HTTPS web encryption, and revealed datacenter link tapping between Google datacenters.

“I suspect NSA hasn’t forgiven him,” said Soghoian in a tweet, a sentiment

It’s a running theme among the security research and reporting community. Techdirt’s Mike Masnick summed it up following the news when he said, “[Soltani] was supposed to help attract good techies to government. Blocking him does the exact opposite.”

Soltani has a long list of security research to his name. It was his work more than a half-decade ago that uncovered “zombie” cookies across several major ad networks, which led to a multi-million dollar settlement with the Federal Trade Commission (FTC). He later joined the commission as its chief technologist.

Widely respected across the security spectrum, Soltani’s appointment to the White House, where he would primarily focus on digital privacy matters, was expected to help bridge the ever-widening divide between government and the security community — especially at a time where there is deep-rooted mistrust between the two.

Following his departure, industry watcher and independent writer Alex Howard said in a tweet that the White House “needs people with [Soltani’s] skills and integrity in public service.” Someone of his caliber to approach the tough issues in government while listening to all parties is not easy to come by.

The big question is, now what?

For Soltani, he plans to go back to the west coast. But for the government, any possible replacement may face similar issues — some likely candidates may not apply for fear of finding out.

Just as the security community lost an advocate on the inside, the Obama administration lost someone keen to make positive change. Since the Snowden leaks, it’s not as though the government has a long list of security researchers lining up at its doors. Banishing a well-known and highly-respected security researcher into the unclassified cold sends a message that government isn’t willing to foster change, or accept that it needs help in securing the nation.

The Obama administration wants to invest $4 billion on educating a new breed of young computer scientists. But turning away one of the brightest minds in the security sector over an vindictive grudge sends an entirely different message.