{"id":220450,"date":"2017-07-19T16:59:02","date_gmt":"2017-07-19T14:59:02","guid":{"rendered":"https:\/\/mybroadband.co.za\/news\/?p=220450"},"modified":"2017-07-19T16:59:24","modified_gmt":"2017-07-19T14:59:24","slug":"ghostctrl-malware-for-android-records-you-and-reads-your-messages","status":"publish","type":"post","link":"https:\/\/mybroadband.co.za\/news\/security\/220450-ghostctrl-malware-for-android-records-you-and-reads-your-messages.html","title":{"rendered":"GhostCtrl malware for Android records you and reads your messages"},"content":{"rendered":"<p>Trend Micro has discovered malicious software for Android that can record audio and video captured from your device, read your text messages, and view your calls, <strong><a href=\"https:\/\/www.neowin.net\/news\/the-ghostctrl-android-malware-can-silently-record-your-audio-and-steal-sensitive-data\" target=\"_blank\" rel=\"noopener\">Neowin reported<\/a><\/strong>.<\/p>\n<p>Calling it GhostCtrl, Trend Micro reported that the malware is a variant of a publicly-available remote administration tool for Android called OmniRAT.<\/p>\n<p>In addition to spying on targets, GhostCtrl can ultimately become ransomware. It can\u00a0lock the screen, reset the password, root the device, and steal sensitive information.<\/p>\n<p>The malware appears to be part of an attack against Israeli hospitals where an information stealing worm called\u00a0RETADUP was recently discovered.<\/p>\n<p>Trend Micro said it found three variants of GhostCtrl.<\/p>\n<p>&#8220;The first stole information and controlled some of the device&#8217;s functionalities without obfuscation, while the second added more device features to hijack,&#8221; Trend Micro reported.<\/p>\n<p>&#8220;The third iteration combines the best of the earlier versions&#8217; features\u2014and then some. Based on the techniques each employed, we can only expect it to further evolve.&#8221;<\/p>\n<p>The latest version of the exploit includes the capabilities to track your\u00a0location and monitor your browsing history.<\/p>\n<p>Trend Micro offered the following general advice for users and enterprises to avoid infection by malicious software such as GhostCtrl:<\/p>\n<ul>\n<li>Keep devices updated.<\/li>\n<li>Regularly back up data in case of device loss, theft, or malicious encryption (i.e. ransomware infection).<\/li>\n<li>Apply the principle of least privilege\u2014restrict user permissions for staff&#8217;s own devices to prevent unauthorised access and installation of dubious apps.<\/li>\n<li>Implement an app reputation system that can detect and block malicious and suspicious apps.<\/li>\n<li>Employ encryption, network segmentation, and data segregation to limit further exposure or damage to data.<\/li>\n<\/ul>\n<h3 class=\"my-4\">Now read:\u00a0<a href=\"https:\/\/mybroadband.co.za\/news\/security\/215192-crashoverride-the-virus-that-took-down-part-of-a-power-grid.html\">CrashOverRide \u2014 The virus that took down part of a power grid<\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>Trend Micro has discovered malicious software for Android that can record audio and video captured from your device, read your text messages, and listen to your calls.<\/p>\n","protected":false},"author":23,"featured_media":190160,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_sma_x_autopost_status":"idle","_sma_x_autopost_error":"","_sma_x_post_id":"","_sma_x_attempts":0,"footnotes":""},"categories":[27,17934],"tags":[397,44694,3812],"class_list":["post-220450","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","category-smartphones","tag-android","tag-ghostctrl","tag-trend-micro"],"_links":{"self":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/220450"}],"collection":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/comments?post=220450"}],"version-history":[{"count":1,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/220450\/revisions"}],"predecessor-version":[{"id":220464,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/posts\/220450\/revisions\/220464"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media\/190160"}],"wp:attachment":[{"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/media?parent=220450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/categories?post=220450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mybroadband.co.za\/news\/wp-json\/wp\/v2\/tags?post=220450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}