Android Protection: 4 Common Android OS Issues, And How to Nip Them All

Google hit the goldmines with its development of Android. Seeing as this is the choice operating system on no less than 2 billion devices out there today, that is no overstatement.

However, the Android market is that big means it is a huge goldmine for hackers too. This is why the average Android user should be put on alert and always make a move to ensure their safety and security at all times.

If you’ve also got an Android device on your hands, here are some vulnerabilities you could be exposed to – and how to nip them all in the bud.

Issue #1 – System Vulnerabilities

No matter how great a piece of software is, there will be some bugs and leaks in the code.

This should be expected for a long body of code that will guide the entire operations of a device. That is not to mention the fact that this single canopy of code was developed by a team of coders, and there could be human errors from each and every part of the board.

When a big company like Google is developing, they try to make sure these issues are as minimal as possible. Even at that, though, it happens.

What to Do

-          System patches will always be sent out to fix issues, in the form of software updates. Google now publishes these security fixes once a month. Ensure you always download and install them as soon as you get them so you are always running on latest security protocols

-          Purchase your units from a manufacturer who has a track record of sending out security fixes. Do your research into this before committing to buying at all

-          Download and install system upgrade packs whenever they become available too.

Issue #2 – App Vulnerabilities

Applications are yet another way by which hackers could gain access to your data and information. The interesting thing here is that app vulnerabilities can happen in a variety of ways.

The first and most common stems from downloading apps from sources other than the Google Play Store. Since they were never on the store, there is a risk that they contain malicious codes that have not been screened out by Google’s engineering and development team.

On the other hand, even trusted apps on the Play Store can be compromised for the wrong reasons. Even WhatsApp was recently a target of such, so the possibility should not be ruled out

What to Do

-          Never sideload apps. If you are not getting the app through the official Play Store, you are better off not getting the app at all

-          Download app updates as soon as they are out. They could be there to fix patches in the system (like in the case of WhatsApp mentioned above)

Issue #3 – Public Wi-Fi connections

You must be wondering what this has to do with anything.

While public Wi-Fi networks bring the sure convenience of browsing the web without incurring data costs, they might be costing you more than you know.

Due to their lack of encryption, these networks have become a haven for hackers to pounce on. All the way from installing malware on the network (which gets into your device without your knowledge) to perpetrating man-in-the-middle attacks, there seems to be no end to how hackers can take minimal to complete control of your units this way.

What to Do

-          The most obvious answer is to stop connecting to public Wi-Fi networks altogether. They are not healthy for your data privacy

-          If you must connect to them, consider having a VPN installed on your Android phone to keep your connection encrypted.

Issue #4 – App Permissions

One thing that Google improved on the Android software from the v5 Lollipop is app permissions, and for good reasons too.

There was a time when apps could set the permissions they required to work on your device, and you had to agree to them. Now, you can edit the apps to have just the permissions you need.

That is helpful in ensuring an app doesn’t have too much access to your personal life and data than needed.

What to Do

-          Check all your apps and see that they have appropriate permissions to work, and no more. For example, a messaging app might require access to your contacts, but that is not same for a third-party camera app.

-          If an app fails to work unless you give it certain permissions (which it doesn’t need), uninstall it in favor of others. Trust us: The Play Store is full of alternatives than allowing yourself to be held ransom by one app.

Credits to @TechWarn.com

What You Should Know About Encrypting Your Data's

What You Should Know About Encrypting Your Data's 

Encryption is a topic that comes up with not only Android, but other smart devices. It's important to keep your data safe, and it's important to understand how it works. Encryption ensures that prying hands and eyes won't access your sensitive data, but what if encryption stopped you from accessing that data?

Android encryption isn't 100% foolproof, and it even works against the user if they aren't lucky. The last thing you'll want to do is factory reset your device because of bad encryption, but sometimes you don't have a choice. So your Android can hopefully stay safe in the future, let's go over some of the problems with Android encryption.

More About Android Encryption and How it Works

I won't spend too much time here about how Android encryption works, but I wanted to address it one more time. We've talked about encryption in full here, so please read more about it when you have the time.

After you know the results from when everything goes right, let's talk about the problems that happen when encryption goes wrong.

How did this work for you?What Can Go Wrong During the Encryption Process

While encrypted storage is a requirement on most devices on Android 6.0 and above, it's instead just an option on devices with earlier firmware. We've talked about the process here, and if you want to go through with it, the process can still go wrong if you aren't careful.

More than a few users have had the encryption screen hang after the phone reboots, or have had the encryption process stall halfway through. Turning off your Android during the encryption process will corrupt your data and force you to wipe your phone completely. This is devastating, so here are a few things to be aware of before encrypting:

Backup your Android's important data. If you something does go wrong, you need to make sure you have a backup to load for later. Remember that no matter what precautions you take to avoid an encryption problem, it can still fail. Always backup your Android.

Charge your phone to at least 80% or higher. I recommend that you get your Android to 100% battery before encrypting, but 80% is as low as I would go for the process.

Be patient. The encryption process will take at least an hour if not longer, so if you're worried everything is frozen, please wait a little longer before turning your Android off.

Performance will be slightly slower after encryption. What you gain in security you lose in speed. Imagine if you started keeping your calculator in a safe, it would take a few extra seconds to get it out each time when you want to use it.

If your Android is rooted, it's better to run stock firmware while encrypting. Once the encryption process is done, it's easy to root your Android again just like nothing has changed.

How did this work for you?How Do You Fix a Failed Encryption?

The short answer here is that you can't. If the encryption process fails at the start, halfway through, or when it's almost finished, your data is compromised. When your data is compromised, all you can do to fix it is to start over. This unfortunately means the only tool in your arsenal is a factory reset.

A factory reset isn't the end of the world as long as you have proper backups, but it's more of your time that's unfortunately wasted. After you've reset your Android, try the encryption process again after restoring your data. Follow the guidelines I set above, and then wait for the process to finish with hopefully no problems.

How did this work for you?Android Encryption Security Risks

Now that your Android's data is successfully encrypted, it sounds like you don't have anything to worry about anymore. With your data hidden, and locked away behind a password, pattern, or PIN, or even a fingerprint, no one should be able to access it except you.

Unfortunately, there are exploits that take advantage of Android's encryption system, letting someone brute force their way into your phone. It's a fault of the qualcomm system, and the way Android handles its encryption, but the specific issue I'm talking about has already been reportedly fixed through patches last year.

So why am I bringing up an exploit that's already been fixed? Exploits are discovered all the time, but they aren't always reported on depending on who finds them. It's important to remember that while it's important to take security measures like full disk encryption, your data isn't completely safe.

This isn't just true for Android encryption, but with any type of encryption, or password system. Because of this, it's important to have as many security measures as possible in place for anything you deem important.

How did this work for you?Conclusion

Android encryption has its problems, and its risk, but as long as you take the right precautions, even the biggest problems aren't a problem for long.

If you need help recovering information after a bad encryption, or need help with the process in general, please comment about it below! 

Featured Image Credit

Malicious Virus Attack on Android Phones in Disguise on the Google Play Store

Just as security experts have predicted, the source code of a potent Android banking trojan that was leaked online in mid-December 2016, is now being seen in live attacks on a regular basis.
At the time of writing, security researchers have observed three different campaigns that involved this trojan, which an unhappy customer leaked online on a Russian-speaking underground hacking forum on December 19, last year.
With the source code available to anyone, it took crooks around a month to craft their own version of this Android banking trojan and start distributing it online via malicious applications hosted on third-party app stores.
Three campaigns already detected
Dr.Web security researchers spotted this first campaign around mid-January 2016, and they say crooks only targeted the customers of several Russian banks.
A second and third campaign came to light over the past two weeks, after ESET researchers came across two separate apps on the official Google Play Store.
Both the second and third campaigns shared the same modus operandi, leading ESET researchers to believe they might be the work of the same group.
Crooks sneaked two infected apps inside Google's Play Store
For each of these latter campaigns, crooks took a legitimate Android weather app, embedded the banking trojan in its source code, repackaged the app, and successfully uploaded the app in the Play Store, passing Google's Bouncer security scanner.
According to ESET researchers, who discovered and reported the apps to Google's reviewers, the name of these two applications were Good Weather (cloned after the eponymous app) and Weather (cloned after the World Weather app).
For the second campaign, distributing the Good Weather malicious clone, attackers configured the banking trojan to show fake login pages for the apps of 22 Turkish banks.
Third campaign was the most sophisticated
The third campaign was a little bit more sophisticated and broad-reaching, as it was configured to targeted the mobile apps of 69 banks from the UK, Austria, Germany, and Turkey.
Furthermore, for the third campaign, the banking trojan was also configured to show unsolicited notifications that lured users into accessing their mobile apps but showed the fake login screen instead.
Detected by Dr.Web as Android.BankBot and by ESET as Trojan.Android/Spy.Banker, this Android banking trojan is a very advanced threat.
The malware includes more than just the ability to overlay fake logins on top of legitimate apps, as it can also lock the user's device via a ransomware-like behavior, and intercept SMS messages for the ability to bypass two-step verification operations.
C&C control panel source code leaked as well
Additionally, the banking trojan's leaked source code also included the C&C server's control panel, which any crook must have in order to control his malware after infecting victims.
According to ESET researcher Lukas Stefanko, the malware's backend featured a different version number for each of the first three campaigns, starting with version 1.0, and going through 1.1 and 1.2.
It is unknown if the same group is behind all three BankBot campaigns, but it's generally a sign of more trouble to come when crooks find a way to bypass Google's security scans and sneak malware in the Play Store.

The good news is that ESET intervened in time during the last two bankBot campaigns, shut down the crooks' C&C server, and had Google take down the apps, which weren't installed on more than 5,000 devices per app.
As we've seen in the past years, whenever crooks leak or intentionally open-source a malware family's source code, other crooks quickly jump on the opportunity to create their own brand of malware on someone else's work.
This has happened with the Zeus banking trojan, the GM Bot Android banking trojan, the EDA2 and Hidden Tear ransomware building kits, and is now happening with BankBot.