Intel Tiger Lake CPUs to come with Anti-Malware Protection

Intel’s Tiger Lake CPUs will come with Control-flow Enforcement Technology (CET), aimed at battling common control-flow hijacking attacks.

Intel’s upcoming class of mobile CPUs, code named “Tiger Lake,” will feature a long anticipated security layer, called Control-flow Enforcement Technology (CET), which aims to protect against common malware attacks.

CET protects against attacks on processors’ control flow, which refers to the order in which different functions calls are executed. Previously, attackers have targeted control flow in attacks where they hijack the processes and modify the instructions. This could potentially allow them to execute arbitrary code on victims’ systems.

“Intel CET delivers CPU-level security capabilities to help protect against common malware attack methods that have been a challenge to mitigate with software alone,” said Tom Garrison, vice president and general manager of Client Security Strategy and Initiatives with Intel, in a Monday post. “These types of attack methods are part of a class of malware referred to as memory-safety issues, and include tactics such as the corruption of stack buffer overflow and use-after-free.”

Intel’s upcoming Tiger Lake CPUs (which were first announced in January) are the first to come equipped with Intel CET, which will battle control-flow hijacking attacks by adding two types of protection.

The first is Indirect Branch Tracking (IBT), which defends against attacks called call-oriented programming or jump-oriented programming (COP and JOP). These types of code-reuse attacks occur when short code sequences that end in specific call and jump instructions are located and chained into a specific order, in order to execute attackers’ payloads. IBT prevents this by creating a new instruction, ENDBRANCH, which tracks all indirect call and jump instructions to detect any control-flow violations.

The second protection is shadow stack (SS). Shadow stack helps to defend against return-oriented programming (ROP) attacks. These types of attacks center around return instructions in a control flow, which are intended to fetch the address of the next instruction from the stack, and execute instructions from that address. In ROP attacks, an attacker abuses these return instructions to stitch together a malicious code flow.

Shadow stack (separate from the data stack) prevents this by adding return address protection. When shadow stacks are enabled, the CALL instruction on a processor pushes the return address on both the data stack and shadow stack and make sure that they match.

“JOP or ROP attacks can be particularly hard to detect or prevent because the attacker uses existing code running from executable memory in a creative way to change program behavior,” Baiju Patel, fellow with Intel’s client computing group, said. “What makes it hard to detect or prevent ROP/JOP is the fact that attacker uses existing code running from executable memory. Many software-based detection and prevention techniques have been developed and deployed with limited success.”

Intel published the first specification of CET in 2016. Various software makers have added support for the technology into their products, including Microsoft in its Hardware-enforced Stack Protection for Windows.

While CET is launching for Intel’s mobile lineup, the technology will soon be available on desktop and server platforms, according to Garrison. The chip giant is now preparing for volume production of its Tiger Lake chipset, and expects to being shipping the processors to OEMs mid-year.

Source: Threatpost

Lamphone attack recovers secretive conversations via hanging light bulb

Lamphone attack allowed researchers to recover conversations from a distance of 25 meters (82 feet).

Earlier this year it was reported that hackers can exploit a critical vulnerability in Philips smart light bulbs to spread malware. Now, scientists at the Ben-Gurion University of the Negev, Israel, and Weizmann Institute of Science have identified that it is possible to use a light bulb’s vibration patterns and evaluate the amount of light emitted to spy on secret conversations from a remote location.
The spying can be conducted simply by observing a hanging light bulb visible from a window in the room.
Scientists Ben Nassi, Yaron Pirutin, Adi Shamir, Yuval Elovici, and Boris Zadov claim that the hanging bulb is the key to this attack, which they have dubbed “Lamphone” attack because it serves as a diaphragm and a transducer.
This means a hanging light bulb can be used by secret agents and spies to eavesdrop on confidential conversations by detecting vibrations from the bulb that result from naturally occurring air pressure fluctuations when sound waves hit its surface. By measuring the changes in the hanging bulb’s output, snippets of conversations can be picked up including music.
The researchers based their research on the principle that objects vibrate when sound waves hit their surface. They used a setup comprising of a telescope to get a close-up view of the room where the light bulb was present, and an electro-optical sensor mounted on the telescope.
The purpose of the sensor was to convert light into electrical current, that is, to transform the analog output to a digital signal.

Furthermore, by using a laptop researchers could process the incoming optical signals and recovered sound data. By using powerful sensors, the researchers noted, it was possible to record the light variations, and the sound waves hitting the light bulb could be reverse engineered to retrieve the audio.
However, the Lamphone technique has its fair share of limitations. For instance, an attacker would require a direct line of sight to the light bulb, and bulbs that are decorated with covers or other materials cannot be targeted.
Similarly, conversations in windowless rooms cannot be spied upon, and for the attack to be successful the conversation has to be very loud, or else, the speaker should be closer to the light bulb.
In their experiments [PDF], the researchers were able to recover conversations from a distance of 25 meters, and they could recover both human conversation and room effects such as the music playing in the background.

Th fact that their experiment was successful is alarming for many companies as the technique can be used to spy upon unsuspecting users and retrieve audio from devices that offer similar functions as the microphone. These include vibration devices, speakers, motion sensors, magnetic hard disk drives, and even wooden tables.

Source: Hackred

Microsoft Joins Ban on Sale of Facial Recognition Tech to Police

Microsoft has joined Amazon and IBM in banning the sale of facial recognition technology to police departments and pushing for federal laws to regulate the technology.

Microsoft is joining Amazon and IBM when it comes to halting the sale of facial recognition technology to police departments. In a statement released Thursday by Microsoft President Brad Smith, he said the ban would stick until federal laws regulating the technology’s use were put in place.

“We will not sell facial recognition tech to police in the U.S. until there is a national law in place… We must pursue a national law to govern facial recognition grounded in the protection of human rights,” Smith said during a virtual event hosted by the Washington Post.

On Wednesday, Amazon announced a one-year ban on police departments using its facial recognition technology. In a short statement the company said it would be pushing for “stronger regulations to govern the ethical use of facial recognition technology.”

The actions by both tech behemoths dovetail actions by IBM earlier this week. In a statement by IBM’s new CEO Arvind Krishna, he said that it will no longer offer general purpose facial recognition or analysis software “for mass surveillance, racial profiling, violations of basic human rights and freedoms, or any purpose which is not consistent with our values and Principles of Trust and Transparency.”

Krishna’s statements were part of a letter to Congress where he advocated policy reviews such as “police reform, responsible use of technology, and broadening skills and educational opportunities.”

The moves align with a broader demand for law enforcement reforms and calls for racial justice by social justice activists in the wake of the death of George Floyd by Minneapolis, Minnesota police and the weeks of protests that followed.

“It should not have taken the police killings of George Floyd, Breonna Taylor, and far too many other black people, hundred of thousands of people taking to the streets, brutal law enforcement attacks against protesters and journalists, and the deployment of military-grade surveillance equipment on protests led by black activists for these companies to wake up to the everyday realities of police surveillance for black and brown communities,” said Matt Cagle, technology and civil liberties attorney with the American Civil Liberties Union of Northern California in a statement to NBC News this week.

Source: Threatpost

Android WARNING: Terrifying malware discovered on Google Play Store.

Android users are being warned about a scary strain of malware discovered on Google Play Store apps.

Android is one of the most widely used pieces of software, with over two billion devices running the Google mobile OS each and every month.

And now Android users are being warned once again about a strain of malware discovered on Google Play Store apps.

Security researchers discovered a dangerous strain of malware on almost 25 apps on the Google Play Store.

The malware was dubbed Exodus and has some terrifying functionality with it capable of rooting devices and boasting advanced spying features.

Not only was Exodus capable of gathering phone numbers and sending it to external servers, it could severely compromise a device after rooting it.

With these phones Exodus was capable of extracting passwords, chat logs, contact details as well as creating local audio and video recordings.

To root devices Exodus used an exploit called DirtyCOW, which was patched by Google in 2016.

So any recently updated phone is thankfully immune to this, with Exodus then limited to gathering data available to other apps.

The existence of Exodus was revealed in a post online after an investigation by Security Without Borders and Motherboard.

After the Exodus discovery last month it’s been revealed that Exodus has also made its way onto iOS devices.

The malware was circulated via phishing sites after the Apple Developer Enterprise programme was “abused”.

In a post online IT security firm Lookout said: “For the past year, Lookout researchers have been tracking Android and iOS surveillanceware, that can exfiltrate contacts, audio recordings, photos, location, and more from devices.

“As has been previously reported, some versions of the Android malware were present in the Google Play Store.

“The iOS versions were available outside the app store, through phishing sites, and abused the Apple Developer Enterprise programme.”

Apple have been informed by Lookout and addressed the issue so as long a users’ iPhone is up-to-date they will be safe.

Google also have removed the almost 25 apps found on the Google Play Store which had Exodus malware on it.

Source: expressUK

Security Flaws in WPA3 Protocol Let Attackers Hack WiFi Password

It has been close to just one year since the launch of next-generation Wi-Fi security standard WPA3 and researchers have unveiled several serious vulnerabilities in the wireless security protocol that could allow attackers to recover the password of the Wi-Fi network.

WPA, or Wi-Fi Protected Access, is a standard designed to authenticate wireless devices using the Advanced Encryption Standard (AES) protocol and is intended to prevent hackers from eavesdropping on your wireless data.

The Wi-Fi Protected Access III (WPA3) protocol was launched in an attempt to address technical shortcomings of the WPA2 protocol from the ground, which has long been considered to be insecure and found vulnerable to KRACK (Key Reinstallation Attack).

Though WPA3 relies on a more secure handshake, known as Dragonfly, that aims to protect Wi-Fi networks against offline dictionary attacks, security researchers Mathy Vanhoef and Eyal Ronen found weaknesses in the early implementation of WPA3-Personal, allowing an attacker to recover WiFi passwords by abusing timing or cache-based side-channel leaks.

"Concretely, attackers can then read information that WPA3 was assumed to safely encrypt. This can be abused to steal sensitive transmitted information such as credit card numbers, passwords, chat messages, emails, and so on," the researchers say.

Vulnerabilities in WPA3 — Hacking WiFi Password

In a research paper, dubbed DragonBlood, published today, researchers detailed two types of design flaws in WPA3—first leads to downgrade attacks and second to side-channel leaks.

Since the 15-year-old WPA2 protocol has been widely used by billions of devices, widespread adoption of WPA3 won't happen overnight. To support old devices, WPA3 Certified devices offer a "transitional mode of operation" that can be configured to accept connections using both WPA3-SAE and WPA2.

Researchers find that the transitional mode is vulnerable to downgrade attacks, which attackers can abuse to set up a rogue AP that only supports WPA2, forcing WPA3-supported devices to connect using insecure WPA2's 4-way handshake.

"We also discovered a downgrade attack against SAE [Simultaneous Authentication of Equals handshake, commonly known as Dragonfly] itself, where we can force a device into using a weaker elliptic curve than it normally would use," the researchers say.

Moreover, a man-in-the-middle position is not needed to carry out downgrade attack. Instead, attackers only need to know the SSID of the WPA3- SAE network.

Researchers also detail two side-channel attacks—Cache-based (CVE-2019-9494) and Timing-based (CVE-2019-9494) attacks—against Dragonfly's password encoding method that could allow attackers to perform a password partitioning attack, similar to an offline dictionary attack, to obtain Wi-Fi password.

"For our password partitioning attack, we need to record several handshakes with different MAC addresses. We can get handshakes with different MAC addresses by targeting multiple clients in the same network (e.g. convince multiple users to download the same malicious application). If we are only able to attack one client, we can set up rogue APs with the same SSID but a spoofed MAC address."

Besides these, the duo also documented a Denial of Service attack that can be launched by overloading an "AP by initiating a large amount of handshakes with a WPA3-enabled Access Point," bypassing SAE's anti-clogging mechanism that is supposed to prevent DoS attacks.

Some of these vulnerabilities also affect devices using the EAP-pwd (Extensible Authentication Protocol-Password) protocol, which is also based on the Dragonfly password-authenticated key exchange method.

Head to the source link foe more information TheHackerNews

Microsoft Releases April 2019 Security Updates — Two Flaws Under Active Attack

Microsoft today released its April 2019 software updates to address a total of 74 CVE-listed vulnerabilities in its Windows operating systems and other products, 13 of which are rated critical and rest are rated Important in severity.

April 2019 security updates address flaws in Windows OS, Internet Explorer, Edge, MS Office, and MS Office Services and Web Apps, ChakraCore, Exchange Server, .NET Framework and ASP.NET, Skype for Business, Azure DevOps Server, Open Enclave SDK, Team Foundation Server, and Visual Studio.

None of the vulnerabilities addressed this month by the tech giant were disclosed publicly at the time of release, leaving the two recently disclosed zero-day flaws in Internet Explorer and Edge browsers still open for hackers.

However, two new privilege escalation vulnerabilities, which affect all supported versions of the Windows operating system, have been reported as being actively exploited in the wild.

Both rated as important, the flaws (CVE-2019-0803 and CVE-2019-0859) reside in the Win32k component of Windows operating system that could be exploited by attackers to run arbitrary code in kernel mode on a targeted computer.

Just last month Microsoft patched two similar vulnerabilities in the Win32k component that were also being exploited in targeted attacks by several threat actors including, FruityArmor and SandCat.

Besides this, Microsoft also released updates to patch 13 critical vulnerabilities, and as expected, all of the critical-rated vulnerabilities lead to remote code execution attacks, except one elevation of privileges in Windows Server Message Block (SMB) Server.

All critical vulnerabilities primarily impact various versions of Windows 10 operating system and Server editions and reside in ChakraCore Scripting Engine, Microsoft XML Core Services, SMB Server, Windows IOleCvt Interface, and Windows Graphics Device Interface (GDI).

Many important-rated vulnerabilities also lead to remote code execution attacks, while others allow elevation of privilege, information disclosure, cross-site scripting (XSS), spoofing and denial of service attacks.

Users and system administrators are highly recommended to apply the latest security patches as soon as possible to keep cybercriminals and hackers away from taking control of their computers.

For installing the latest security updates, you can head on to Settings → Update & Security → Windows Update → Check for updates on your computer, or you can install the updates manually.

For addressing problematic update issues on Windows 10 devices, Microsoft last month also introduced a safety measure that automatically uninstalls buggy software updates installed on your system if your OS detects a startup failure.

Adobe also rolled out security updates today to fix 40 security vulnerabilities in several of its products. Users of the affected Adobe software for Windows, macOS, Linux, and Chrome OS are advised to update their software packages to the latest versions.

Source

WikiLeaks Founder Julian Assange Arrested

WikiLeaks founder Julian Assange has been arrested at the Ecuadorian Embassy in London—that's almost seven years after he took refuge in the embassy to avoid extradition to Sweden over a sexual assault case.

According to a short note released by London's Metropolitan Police Service, Assange was arrested immediately after the Ecuadorian government today withdraws his political asylum.

Assange has now been taken into custody at a central London police station, from where he will be presented before Westminster Magistrates' Court as soon as possible.

U.S. Department of Justice also confirmed today that Assange would face extradition proceedings for his alleged role in "one of the largest compromises of classified information in the history of the United States."

The indictment [unsealed today] alleges that in March 2010, Assange engaged in a conspiracy with Chelsea Manning, a former intelligence analyst in the U.S. Army, to assist Manning in cracking a password stored on U.S. Department of Defense computers connected to the Secret Internet Protocol Network (SIPRNet), a U.S. government network used for classified documents and communications.

Following his arrest on Thursday, Ecuadorian President Lenín Moreno tweeted, "In a sovereign decision, Ecuador withdrew the asylum status to Julian Assange after his repeated violations to international conventions and daily-life protocols."

However, WikiLeaks said Ecuador had acted illegally in terminating Mr Assange's political asylum "in violation of international law."

For more info head to the source link TheHackerNews

A Massive Ad Fraud Scheme Exploited Android Phones To Steal Millions Of Dollars

Last April, Steven Schoen receivedan email from someone named Natalie Andrea who said she worked for a company called We Purchase Apps. She wanted to buy his Android app, Emoji Switcher. But right away, something seemed off.

“I did a little bit of digging because I was a little sketched out because I couldn’t really find even that the company existed,” Schoen told BuzzFeed News.

The We Purchase Apps website listed a location in New York, but the address appeared to be a residence. “And their phone number was British. It was just all over the place,” Schoen said.

It was all a bit weird, but nothing indicated he was about to see his app end up in the hands of an organization responsible for potentially hundreds of millions of dollars in ad fraud, and which has funneled money to a cabal of shell companies and people scattered across Israel, Serbia, Germany, Bulgaria, Malta, and elsewhere.

Schoen had a Skype call with Andrea and her colleague, who said his name was Zac Ezra, but whose full name is Tzachi Ezrati. They agreed on a price and to pay Schoen up front in bitcoin.

“I would say it was more than I had expected,” Schoen said of the price. That helped convince him to sell.

A similar scenario played out for five other app developers who told BuzzFeed News they sold their apps to We Purchase Apps or directly to Ezrati. (Ezrati told BuzzFeed News he was only hired to buy apps and had no idea what happened to them after they were acquired.)

“A significant portion of the millions of Android phone owners who downloaded these apps were secretly tracked as they scrolled and clicked inside the application."

The Google Play store pages for these apps were soon changed to list four different companies as their developers, with addresses in Bulgaria, Cyprus, and Russia, giving the appearance that the apps now had different owners.

But an investigation by BuzzFeed News reveals that these seemingly separate apps and companies are today part of a massive, sophisticated digital advertising fraud scheme involving more than 125 Android apps and websites connected to a network of front and shell companies in Cyprus, Malta, British Virgin Islands, Croatia, Bulgaria, and elsewhere. More than a dozen of the affected apps are targeted at kids or teens, and a person involved in the scheme estimates it has stolen hundreds of millions of dollars from brands whose ads were shown to bots instead of actual humans. (A full list of the apps, the websites, and their associated companies connected to the scheme can be found in this spreadsheet.)

One way the fraudsters find apps for their scheme is to acquire legitimate apps through We Purchase Apps and transfer them to shell companies. They then capture the behavior of the app’s human users and program a vast network of bots to mimic it, according to analysis from Protected Media, a cybersecurity and fraud detection firm that analyzed the apps and websites at BuzzFeed News' request.

This means a significant portion of the millions of Android phone owners who downloaded these apps were secretly tracked as they scrolled and clicked inside the application. By copying actual user behavior in the apps, the fraudsters were able to generate fake traffic that bypassed major fraud detection systems.

“This is not your run-of-the-mill fraud scheme,” said Asaf Greiner, the CEO of Protected Media. “We are impressed with the complex methods that were used to build this fraud scheme and what’s equally as impressive is the ability of criminals to remain under the radar.”

“This is not your run-of-the-mill fraud scheme.”

Another fraud detection firm, Pixalate, first exposed one elementof the scheme in June. At the time, it estimated that the fraud being committed by a single mobile app could generate $75 million a year in stolen ad revenue. After publishing its findings, Pixalate received an email from an anonymous person connected to the scheme who said the amount that’s been stolen was closer to 10 times that amount. The person also said the operation was so effective because it works “with the biggest partners [in digital advertising] to ensure the ongoing flow of advertisers and money.”

In total, the apps identified by BuzzFeed News have been installed on Android phones more than 115 million times, according to data from analytics service AppBrain. Most are games, but others include a flashlight app, a selfie app, and a healthy eating app. One app connected to the scheme, EverythingMe, has been installed more than 20 million times.

Once acquired, the apps continue to be maintained in order to keep real users happy and create the appearance of a thriving audience that serves as a cover for the cloned fake traffic. The apps are also spread among multiple shell companies to distribute earnings and conceal the size of the operation.

The revelation of this scheme shows just how deeply fraud is embedded in the digital advertising ecosystem, the vast sums being stolen from brands, and the overall failure of the industry to stop it.

App metrics firm AppsFlyer estimated that between $700 million and $800 million was stolen from mobile apps alone in the first quarter of this year, a 30% increase over the previous year. Pixalate’s latest analysis of in-app fraud found that 23% of all ad impressions in mobile apps are in some way fraudulent. Overall, Juniper Research estimates $19 billion will be stolen this year by digital ad fraudsters, but others believe the actual figure could be three times that.

This scheme’s focus on Android apps also exposes the presence of fraud, malware, and other risks affecting Google’s mobile ecosystem and the users who rely on it. Experts say a scheme like this targets Android in part because of its huge user base, and because the Google Play store has a less rigorous app review process than Apple’s App Store. Android apps are bought and sold, injected with malicious code, repurposed without users’ or Google’s knowledge, or, as in this case, turned into engines of fraud. (Apple’s App Store is by no means immune to malicious attacks: A security researcher recently revealedthat a top paid app is secretly transmitting user browsing data to a server in China.)

Google told BuzzFeed News it quickly removes any apps that violate Play store policies and that last year it took down more than 700,000 apps that were in violation. It also emphasized its commitment to fighting ad fraud by implementing standards such as ads.txt.

“We take seriously our responsibility to protect users and provide a great experience on Google Play. Our developer policies prohibit ad fraud and service abuse on our platform, and if an app violates our policies, we take action,” said an emailed statement from a Google spokesperson.

The ad networks and ad exchanges used by the scheme include major players, such as those operated by Google, which means these companies earned commission if ads shown to bots went undetected. There is no evidence Google or any of the other companies knew the inventory was fraudulent.

After being provided with a list of the apps and websites connected to the scheme, Google investigated and found that dozens of the apps used its mobile advertising network. Its independent analysis confirmed the presence of a botnet driving traffic to websites and apps in the scheme. Google has removed more than 30 apps from the Play store, and terminated multiple publisher accounts with its ad networks. Google said that prior to being contacted by BuzzFeed News it had previously removed 10 apps in the scheme and blocked many of the websites. It continues to investigate, and published a blog post to detail its findings.

The company estimates this operation stole close to $10 million from advertisers who used Google's ad network to place ads in the affected websites and apps. It said the vast majority of ads being placed in these apps and websites came via other major ad networks.

Asked whether it reviews apps in the Play store on an ongoing basis, a company spokesperson pointed to a blog post from earlier this year that said, “Sometimes developers change the content or behavior of their app and associated app listing and marketing materials after initially approved, requiring ongoing reviews as new information becomes available that can alter the original policy judgment.”

The company would not say whether any apps in this scheme received a subsequent review after they changed ownership, or for any other reason.

Got a tip about ad fraud? You can email tips@buzzfeed.com. To learn how to reach us securely, go to tips.buzzfeed.com.

Amin Bandeali, the chief technology officer of Pixalate, told BuzzFeed News that app stores provide minimal ongoing review of apps and their developers, which makes them an easy target for fraudsters and other bad actors.

“App stores, perhaps unwittingly, are providing a gateway to connecting fraudsters with [advertising] inventory buyers and sellers,” he said. “While the stores present customer reviews, download numbers and other ‘quality’ metrics, they offer minimal services that vet the business practices, technology and relationships of the app companies.”

To identify key beneficiaries of this scheme, BuzzFeed News analyzed corporate registration records, domain ownership and Domain Name System data, Play store listings, and other publicly available information. It revealed that the network of apps and websites is linked to Fly Apps, a Maltese company with multiple connections to the scheme.

Corporate records obtained by BuzzFeed News show that Fly Apps is owned by two Israelis, Omer Anatot and Michael Arie Iron, and two Germans, Thomas Porzelt and Felix Reinel.

Anatot's LinkedIn profile lists him as the CEO of EverythingMe, a popular app owned by Fly Apps. In messages sent on WhatsApp, Anatot said he only manages EverythingMe and blamed the initial fraud identified by Pixalate on a firm he says they worked with, AdNet Express. He said his company paid AdNet Express to generate installations of its apps to help grow its user base, and that any fraud was the fault of their partner.

“They were buying installs for us for a short time,” he said. “Very soon it turns out these guys were 100% fraudulent traffic of bots pushing installs.”

It’s unclear if AdNet Express is a real company. It has virtually no online profile or reputation other than a very basic website, which does not list an address or phone number or cite any clients or projects. The domain ownership information for the site listed a fake US mailing address, as well as the email address “MatthewBStrack@teleworm.us.” That email address was generated using a service called Fake Mail Generator. The company’s two employees listed on LinkedIn cite no additional work experience or educational background on their profiles, and appear to have no other online presence.

BuzzFeed News sent an email citing Anatot’s claims to the address listed on the company’s website. “This is very interesting,” someone wrote back. “Today, i cannot speak but Friday.” They did not reply to subsequent emails.

Also, at some point after Anatot began communicating with BuzzFeed News, many of the websites in the scheme were taken offline. Several websites for shell companies were unpublished at the same time.

“You try to tie me into something I've no relationship to,” Anatot said in a message. “And if you go and publish that, you and the publisher will carry the legal liability. You really have no grounds for the things you tie me to.”

After receiving a detailed email with information connecting Fly Apps to apps and companies involved in the scheme, the company responded with a letter from its attorney that denied any involvement in, or knowledge of, the fraud identified by Pixalate. Fly Apps also denied it has any connections to the apps, websites, and companies identified in the overall fake traffic scheme.

“Please be advised that my client categorically denies these very serious and false allegations, which if published, would cause tremendous harm to it,” the letter, from Harder LLP, said. “Fly Apps’ applications are loved by many, and have a significant amount of users. Fly Apps is a reputable application developer, which has long been supported by advertising partners and advertising verification companies.”

The letter, which can be read in full here, omitted any reference to AdNet Express and instead blamed the fraud revealed by Pixalate on an unnamed third party that provided a "corrupted" software development kit. It did not address the fact that Protected Media detected fake traffic in many of these apps and websites beginning more than a year ago.

A subsequent set of questions from BuzzFeed News asked Fly Apps to comment on the fact that Google removed advertising accounts associated with websites and apps it found had received high levels of fraudulent traffic. The company, speaking through its lawyer, acknowledged that Google was recently in touch with Fly Apps about its account(s).

"A few days ago, Fly Apps received a Google notification concerning an issue with Adsense and is in the process of trying to obtain further information. Fly Apps is confident that it will resolve this issue in due time and notes that the Google notification did not mention any issues regarding bad traffic," said an emailed statement.

BuzzFeed also asked the company to comment on the fact many websites connected to the scheme went offline after Fly Apps learned of BuzzFeed News' interest, and many apps in the scheme have since been removed from the Play store by Google.

"Fly Apps cannot comment on applications and websites, online or offline, that are not related to Fly Apps," it said.

Here’s a breakdown of how a group of partners leveraged technical knowledge and connections within the advertising ecosystem, a network of shell companies with fake employee profiles, an army of bots, and more than 100 apps and websites to operate a scheme that an insider says stole hundreds of millions of dollars.

1. How The Fake Traffic Works

The first step to creating convincing fake traffic for this scheme is to acquire Android apps used by actual human users. The fraudsters study the behavior of the users and then create bots — automated computer programs — that mimic the same actions. The bots are loaded onto servers that contain specialized software that enables the bots to generate traffic within the specific apps.

In the case of websites in the scheme, the bots visit them using virtual web browsers that help present this traffic as human. In both cases, the fake traffic generates ad views, which in turn earns revenue.

The blending of real humans with bots helps defeat systems built to detect fake traffic, because the real traffic and fake traffic look almost exactly the same.

“These bots are unique to this operation, mimicking real user behavior. The traffic is therefore a mix of real users inside a real app, and fake traffic,” said Greiner of Protected Media. (Google's investigation also found that some of the fake traffic directed to properties in the scheme came from a botnet called "TechSnab.")

“It’s clear to us that the people orchestrating this scheme are both familiar with the ad tech industry and with the mainstream data science approach to detecting ad fraud,” he said.

Anatot previously ran a company, Install Labs LTD, that distributed adware and other software classified as “potentially unwanted programs” (PUP) by security and anti-virus firms due to them causing frustration for users, and often installing other programs without permission. He’s also an investor in Montiera, another company that distributed software classified as PUP. Like the Android apps and websites in this scheme, these PUP offerings relied on digital advertising to generate revenue.

Reinel and Porzelt previously ran a German hosting and server administration company called hostimpact.de. Between those three, they possess the background in advertising and server management necessary for this scheme.

It’s unclear what Iron did prior to Fly Apps, though as detailed below he is part owner of a Serbian company that develops mobile apps for Android, as well as other web products.

2. How The Fraud Was First Discovered

The scheme began to unravel this summer when data scientists at Pixalate detected something alarming in an Android app called MegaCast. The app’s pitch was that it enabled a user to play any video, regardless of format, on a streaming device. But behind the scenes, MegaCast was pretending to be something it wasn’t.

Pixalate found that MegaCast was at times displaying the unique ID of other apps in order to attract bids for ads. This meant ad buyers thought they were, for example, buying ads in the far more popular EverythingMe app when in reality they were showing up in MegaCast. (This is called “spoofing,” because MegaCast was pretending to be other apps.)

Pixalate identified roughly 60 apps being spoofed by MegaCast and estimated this one scheme could generate $75 million per year in fraudulent ad revenue. It documented ads from major brands such as Disney, L’Oréal, Facebook, Volvo, and Lyft being fraudulently displayed.

Pixalate revealed its findings in a June blog post, and MegaCast was soon removed from the Google Play store.

Fly Apps told BuzzFeed News that MegaCast was a victim of the spoofing scheme, and that it removed the app from the Play store because "its reputation has unfortunately been tarnished by recent events. Fly Apps will be creating a new and improved casting application."

Soon after Pixalate went public with its findings, an email arrived in its inbox from an email address at Mobilytics.org, an analytics company that helped facilitate the MegaCast fraud. (It was used to track how much money was being earned from ads placed with each spoofed app ID.)

“This email is directed to the top management team of Pixalate. For the obvious reasons, my name is not relevant now,” read the email.

The person offered to share their inside knowledge to fully expose the scheme and reveal how big it really is.

“Your estimation of $75 [million] accumulated damage is probably 10% of the real numbers.”

“I will explain you the technologies to create traffic on android, how to distribute it, how to sell the created traffic, the business structures needed, but most of all how to partner with the biggest partners to ensure the ongoing flow of advertisers and money,” the email said. (Contrary to what Anatot and Fly Apps claimed, this inside source said nothing about fraudulent app installs or a corrupted software development kit.)

“And by the way,” the message said, “your estimation of $75 [million] accumulated damage is probably 10% of the real numbers. But that just explains how unaware or just cooperative the industry is with this growing ‘business.’”

Pixalate replied to ask for more information, but never heard back. Soon, all replies to the email bounced back as a result of Mobilytics’s website being taken offline.

By then, BuzzFeed News had begun its own investigation of the ownership information and other details related to the spoofed apps. This dive into corporate records, domain registration information, DNS data, and other publicly available sources led to a startling conclusion: Rather than being victims of the MegaCast spoofing, the apps were all connected and therefore part of the same scheme. This aligned with what the anonymous Mobilytics employee hinted at. Protected Media’s subsequent discovery of the fake traffic generated by bots also confirmed what the source said.

Ultimately, this information led to the group of four men operating Fly Apps, which owns MegaCast, EverythingMe, and other applications.

3. Key Beneficiaries

Back in 2015, EverythingMe was one of the most promising Android apps in the Play store. It won a Webby Award, was featured by Google, amassed more than 10 million downloads, and raised more than $35 million in venture capital. EverythingMe is a “launcher” that helps organize apps and contacts, and surfaces relevant information based on when you’re using your phone.

In spite of its success, at the end of 2015, the company that created it announced it was shutting down and soon removed EverythingMe from availability. Without a hot startup behind it, the app was largely forgotten.

In 2016, the app was quietly sold to a new owner, according to a former EverythingMe executive who asked not to be named or quoted. They declined to say who bought it, citing a nondisclosure agreement. In early 2017 the EverythingMe Twitter account briefly sprung to life to tweet that “EverythingMe is back!” and promote a download link.

As of today, EverythingMe is the property of Fly Apps. On LinkedIn, Anatot, an Israeli, lists himself as CEO of EverythingMe. Corporate ownership records confirm that Anatot owns 25% of Fly Apps, along with three other men who each own the same share: Thomas Porzelt and Felix Reinel, two Germans; and Michael Arie Iron, an Israeli.

After hearing that a BuzzFeed News reporter was looking into his company, Anatot reached out by email: “I understand that you are looking into mobile apps advertising and assumed very wrong conclusions about me, my company and my partners.”

In a subsequent WhatsApp chat Anatot blamed the fraud detected by Pixalate on AdNet Express, a company that may not exist. He also downplayed his role and ownership stake in Fly Apps.

“My holiding [sic] in fly apps is private matter, but I can tell you that I'm a far minority holder,” he said, omitting the fact that he owns the same share as his three partners.

Anatot said that after he acquired EverythingMe, “Fly apps teamed up with me to supply the tech team and financing.” He said he does not have oversight of other Fly Apps products.

But additional details connect Anatot in other ways to at least one of his Fly Apps partners. Anatot runs a company called TinTin Consultingthat serves as his vehicle for investing in companies. His list of portfolio companies was removed from TinTin’s website after Anatot learned of BuzzFeed News’ interest in him. But before it was scrubbed, the site listed the Serbian-based mobile apps and software development company Kudos as one of his investments. Maltese corporate records show Anatot’s partner Iron owns 49% of that company.

Milos Kovacki, the founder and COO of Kudos, told BuzzFeed News the company never worked with Fly Apps or any of the shell companies involved in the scheme. But the LinkedIn profiles of two Kudos employees detail their work on MegaCast, the Fly Apps Android app that Pixalate found to be at the center of the spoofing scheme. Kovacki did not respond to subsequent questions.

BuzzFeed News also found multiple connections linking Fly Apps to other companies, websites, and apps in the ad fraud operation.

The Play store pages for EverythingMe, Restaurant Finder, and MegaCast all list the Malta address used by Fly Apps. That same address was also listed on the website of Mobilytics, the company that was central to the initial fraud discovered by Pixalate.

The letter from Fly Apps’ lawyer noted that this address is for a corporate registration agent in Malta, not an actual business office. However, a Google search for the address the exact way it’s written on these pages almost exclusively brings up results connected to apps owned by Fly Apps. That initial connection is not conclusive on its own, but quickly combines with others.

A key connector between Fly Apps and properties in the scheme is the email address lorentsen@yandex.ru. It was used to register the domain names for the websites of Fly Apps properties EverythingMe and Restaurant Finder. And it’s also the email address used to register the websites for 15 other apps implicated in the scheme, which in turn connect to eight shell companies.

A third connection between Anatot/FlyApps and companies or properties in the scheme is the MegaCast app. Anatot acknowledged to BuzzFeed News that MegaCast is owned by Fly Apps. But the since-removed MegaCast website listed a Bulgarian company called Messamta Project as its developer. Messamta’s corporate records list a Bulgarian address used by more than a dozen other apps in the scheme. It’s also the corporate registration address used by three additional Bulgarian shell companies that were publicly listed as the owners of these apps and websites: Osipo/Osypo, Ventus Trading, and Rasolant. As with the Malta address, it appears to be almost exclusively associated with companies and apps involved in the scheme.

Fly Apps’ lawyer argued this was simply another case of their client using the same service providers as other companies. However, the websites for Osypo and Rasolant were both taken offline after BuzzFeed News began communicating with Anatot. And as detailed below, there is overwhelming evidence that these and other related companies are nothing more than shells created to help execute the fraud scheme.

The Fly Apps website itself also provides a fourth connection. Its design and some of its text is a carbon copy of the website Loocrum.com, which describes itself as a mobile apps monetization platform. The code for the Fly Apps site even includes a reference to Loocrum, showing that at least some of its code was literally copied from that site.

The Loocrum website was registered last year by a person named Petar Popovich with the email address ppopovic588@gmail.com. That email address was also used to register the domain names of two shell companies involved in the scheme, Quaret and Visont. Petar Popovich is also the name of the Serbian citizen who registered Bulgarian shell companies in the scheme. (An email sent to that address went unanswered.)

A final connection of note is that the Restaurant Finder app, which belongs to Fly Apps, was removed from the Play store after Google began taking action against apps it determined had received fraudulent traffic as part of this scheme.

4. Connecting Apps And Companies

After Steven Schoen sold his app, Emoji Switcher, to We Purchase Apps, the new owner created a website for it, emojiswitcher.com. And just like the websites for EverythingMe and Restaurant Finder, that domain was originally registered to a “Jacob Lorentsen” of London using the email address lorentsen@yandex.ru. (An email sent to that address did not receive a reply.)

That same registration information appears in the whois records for 19 other domain names associated with Android apps in this scheme. These apps list at least eight different companies as their owner or developer: Lyrman, Osypo, Fly Apps, Morrum, Visont, Imoderatus, AEY Solutions, and Rasolant. And these companies in turn list addresses in Serbia, Cyprus, Latvia, Bulgaria, and Russia.

That single domain registration email address connects a web of apps and shell companies to one another, as well as directly to Fly Apps:

Another key connection between multiple apps and companies is the address in Bulgaria linked to Messamta Project. It appears in the Play store pages for 21 apps spread out among four companies.

Along with being the corporate address of Messamta, it shows up in records for Rasolant, which is publicly listed as the owner of 12 other apps involved in the spoofing attack first identified by Pixalate, as well as seven related websites identified by BuzzFeed News.

Osypo, which also uses the same Bulgaria address, is listed as the developer of four apps in the Play store that are part of the scheme. The company’s website, which like several others was deleted after BuzzFeed News began making inquiries, lists an additional seven apps in the scheme.

This single address connects multiple companies, apps, and websites, which again connect back to Fly Apps:

Other connections abound. For example, the Android game Surprise Eggs - Kids Game has a listing in the Play store that says it’s developed by a company called Visont, and the app’s website says the same. However, the domain registration information for the app's site lists its owner as Quaret Digital, a separate company that itself is the owner of 10 websites participating in the scheme. Its website was taken offline after BuzzFeed News began inquiries, but can be viewed here. (Visont’s website was also removed late last week. It was registered last year using the email address lorentsen@yandex.ru.)

On LinkedIn, at least one of Quaret’s purported employees uses a profile stolen from actor and Instagram influencer Sarah Ellen.

The domain registration and other technical details of the website for Surprise Eggs offer additional connections. The site uses an SSL certificate registered to the website TrackMyShows.tv. Track My Shows is an Android app in the scheme that has a website registered to lorentsen@yandex.ru. (An SSL certificate is used to certify the identity of a website being loaded in a web browser, and it also helps ensure a secure connection for the user. Websites typically to use a certificate connected to their specific domain, but sometimes site owners reuse a certificate across multiple properties.)

More than 15 additional websites involved in the scheme reused the same TrackMyShows.tv SSL certificate. Those apps claim to be owned by companies named Imoderatus, Morrum, Mout, AEY Solutions, Quaret Digital, Visont, and Rasolant, respectively. All of these seemingly separate apps/websites, belonging to different companies, are also hosted on the same server. As of this writing, 13 of the apps were recently removed from the Play store, likely as a result of Google's ongoing investigation.

In its legal letter, Fly Apps explained all of these connections by saying they “are the practical result from application developers using the same pool of common service providers within a specific industry.”

“They are not the result of any illicit conduct by Fly Apps in developing and setting up an intricate web of malicious applications to create fake traffic and steal hundreds of millions of dollar in advertising revenue,” it added.

5. Technical Connections and Common Customer Support

The technical elements of the apps provide more connections and evidence that they’re developed and managed centrally.

BuzzFeed News provided a list of apps to Armando Orozco, a senior malware intelligence analyst at Malwarebytes. He examined a sample of 13 belonging to different shell companies and found they “seem to be built in the same manner and mostly have the same ad sdk’s bundled in them — likely from the same developers/gang just submitting under different names.” (Ad SDKs, or software development kits, are programming libraries that enable an app to run specific types of ads in order to earn revenue. This means these apps were all using the same types of ads and ad providers to make money.)

He also examined EverythingMe, the Fly Apps application, and found it had the same unique ad identification code as other apps, and said it contained “very similar code chunks and strings.”

An additional connection between Fly Apps applications and the apps operated by shell companies can be found on their Play store pages. These supposedly separate developers repeatedly used the exact same phrase in response to user complaints about intrusive or overloaded ads: “we are trying to find the balance between clean user experience and funding our project!”

It’s used by Fly Apps to respond to complaints about EverythingMe and MegaCast. And it’s used to respond to complaints about apps in the scheme including Track My Shows, Cat Rescue Puzzles, Surprise Eggs - Kids Game, Pix UI Icon Pack 2 - Free Pixel Icon Pack, Surprise Eggs Vending Machine, and Twist Your Fingers, among others.

6. Shell Companies With Fake Employees, Fake Customers, Copied Text

In some cases, the websites of shell companies used in the scheme list the names and photos of employees, and link to LinkedIn profiles for them. But BuzzFeed News found multiple cases where stock photos were used for employees’ pictures. In other cases, searches for employee names only turn up results related to the companies, suggesting they are made-up names. Multiple shell company websites also reuse the same marketing text, word for word.

One Bulgarian company called Atoses Digital says on its websitethat it’s the developer of sites in the scheme including scandalcity.tv, webarena.tv, healthtube.info, and dailydally.tv. (It also claims to have worked on Glam, a once-hot fashion website that was sold last summer.)

The Atoses site lists eight employees, but BuzzFeed News found that at least half of the headshots are taken from stock image websites. The LinkedIn profiles of those employees list no employment or education experience other than their work at Atoses.

Many shell company sites also feature fake customer testimonials. The website for a company called TapTapVideo claims it helps monetize MegaCast, Twist Your Fingers, and Smart Voice Assistant, three apps found in the scheme. Its site includes customer testimonials, one of which is from a woman named “Gabriella Byrd.” The photo used for her is, in fact, a picture of a UX designer named Kristi Grassi.

“Yes, I'm aware this photo seems to be used all over,” Grassi told BuzzFeed News in an email after being alerted to its presence on the site. Grassi said her photo was uploaded to a site that allowed designers to use it in mock-ups. Since then it has been misused by others.

Similarly, Osypo’s since-removed website had three customer testimonials, but BuzzFeed News could not locate any information about the people and companies cited. (The site also uses a stock photo to represent its office.)

Along with fake employees and customers, the companies recycle the same text on their homepages. Kheus, Immoderatus, and Visont all say, “Before we start development process, we need to research subjects of the project, your competitors, the target audience of the project. Our research results in technical requirements and wireframes, determined together with the customer.”

The websites for Visont, Ellut, and Morrum say, “To meet your campaign objectives, our technology suite includes all forms of targeting including re-marketing, contextual, behavioral, geographic and dayparting.”

Osypo and Morrum also have identical text, including the statement that they provide “website development services that meet all your needs and are tailored according to the peculiarities of your business field.”

7. Video Websites With Plagiarized Content

Along with Android apps, BuzzFeed News identified more than 35 websites connected to the shell companies. Protected Media and Pixalate both found evidence of fraudulent traffic on a selection of the sites.

The vast majority of these websites present themselves as video content providers in lucrative verticals such as fashion, sports, or celebrity news. Many use the .tv domain suffix to reinforce their focus on video.

But the websites themselves rarely update their content and some displayed the same videos. Another sign that they’re empty vessels for fake traffic is the fact that the same sentence — “We deliver our services to to over 4 million households with set top boxes, and providing mobile video services that reach over 10 million subscribers” — is found on the About page of more than 20 sites in the scheme.

Two other sites in the scheme, 24gossip.net and topstories.fun, copied their About page text from the website Gossip Cop, a celebrity fact-checking website. (Both of those URLs were registered using an email address connected to Rasolant, while their websites publicly list the owner as Quaret Digital, further demonstrating how the shell companies are intertwined.)

Almost all of the websites listed in BuzzFeed News’ email to Anatot have since been taken offline.

A final sign that they’re fraudulent properties was noticed by Ian Trider, the director of real-time bidding operations for Centro, a platform used by brands and agencies to buy digital ads.

He told BuzzFeed News he banned several Quaret properties last year after noticing they included instructions in their website code that would stop Google from indexing the sites. This would have prevented the sites from attracting traffic from search. Less traffic means less revenue, so no legitimate ad-supported website would want that.

“Asking search engines to avoid indexing your site is not something you normally do as a for-profit publisher. You want the public to visit so you can make money through advertising," Trider said.

But search traffic seems less important when you can simply fabricate an audience.

Source: buzzfeedNews