{"id":10034,"date":"2022-12-09T10:54:25","date_gmt":"2022-12-09T10:54:25","guid":{"rendered":"https:\/\/techandbiz.com.ng\/tab-backup\/?p=10034"},"modified":"2022-12-09T10:54:51","modified_gmt":"2022-12-09T10:54:51","slug":"ncc-csirt-advises-factory-resetting-infected-devices-to-beat-xenomorph-malware","status":"publish","type":"post","link":"https:\/\/techandbiz.com.ng\/tab-backup\/2022\/12\/09\/ncc-csirt-advises-factory-resetting-infected-devices-to-beat-xenomorph-malware\/","title":{"rendered":"NCC-CSIRT Advises Factory-Resetting Infected Devices to Beat Xenomorph Malware"},"content":{"rendered":"

\u00a0<\/strong><\/p>\n

 <\/p>\n

A malware, XENOMORPH, that installs Trojan in banking apps on the Android platform to steal login details, raid bank accounts,\u00a0 and read the users SMS, has been flagged by the Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT). The Team suggests that owners of compromised devices take the extreme measure of doing factory resetting of infected devices.<\/p>\n

 <\/p>\n

NCC-CSIRT, citing Zscaler ThreatLabz, said, \u201cThe Todo: Day Manager hijacks your login info from banking apps, and can even read your SMS messages. It installs a banking trojan malware called Xenomorph that allows the app to intercept your two-factor verification codes (typically delivered over text) to raid your logins \u2013 and bank account.<\/p>\n

 <\/p>\n

\u201cXenomorph performs overlay attacks by exploiting accessibility permissions in Android, resulting in the overlaying of fraudulent login screens on banking apps aimed at exfiltrating credentials. The Android app makes itself intentionally difficult to delete. You need to search your phone for it immediately and uninstall it.”<\/p>\n

 <\/p>\n

\u201cIt starts with asking users to enable access permission. Once provided, it adds itself as a device admin and prevents users from disabling Device Admin, making it un-installable from the phone.\u00a0 If you haven’t given permission to the app, then you should be able to uninstall it safely. Otherwise, you may have to back up your files and then factory-reset your phone to clear the app completely,\u201d it advised.<\/p>\n

 <\/p>\n

In terms of potential solutions to the malware, NCC-CSIRT advised that \u201cSearch your phone for the app and uninstall immediately or backup your files and factory reset your phone.<\/p>\n

 <\/p>\n

\u201cOnly search for an app in the Google Play Store, pay close attention to the search results, look at the apps icons, note that fake apps almost always use the icon from the app they’re faking, then look at the developer\u2019s name and make sure it’s from the right developer.<\/p>\n

 <\/p>\n

Also, look at the app’s download count. If the app has a lot of downloads going into millions to hundreds of thousand that\u2019s a clue that it\u2019s the right app.\u00a0 Then, finally, look at the app’s description and screenshots to ensure that it doesn\u2019t contain multiple spelling or grammar mistakes or otherwise broken English.<\/p>\n

 <\/p>\n

\u201cMake use of Google Play Protect, which regularly scans your apps for malware and will alert you to uninstall rogue apps.\u201d<\/p>\n

 <\/p>\n

The CSIRT is the telecom sector\u2019s cyber security incidence centre set up by the NCC to focus on incidents in the telecom sector and as they may affect telecom consumers and citizens at large.<\/p>\n

 <\/p>\n

The CSIRT also works collaboratively with Nigeria Cybersecurity Emergency Response Team (ngCERT), established by the Federal Government to reduce the volume of future computer risk incidents by preparing, protecting, and securing Nigerian cyberspace to forestall attacks, and problems or related events.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

\u00a0   A malware, XENOMORPH, that installs Trojan in banking apps on the Android platform to steal login details, raid bank accounts,\u00a0 and read the users SMS, has been flagged by the Nigerian Communications Commission’s Computer Security Incident Response Team (NCC-CSIRT). The Team suggests that owners of compromised devices take the extreme measure of doing […]<\/p>\n","protected":false},"author":1,"featured_media":10035,"comment_status":"open","ping_status":"open","sticky":true,"template":"","format":"standard","meta":{"footnotes":""},"categories":[366,76,326,82,83],"tags":[],"class_list":["post-10034","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-economy","category-government","category-security","category-technology","category-technology-trends"],"_links":{"self":[{"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/posts\/10034","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/comments?post=10034"}],"version-history":[{"count":0,"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/posts\/10034\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/media\/10035"}],"wp:attachment":[{"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/media?parent=10034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/categories?post=10034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techandbiz.com.ng\/tab-backup\/wp-json\/wp\/v2\/tags?post=10034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}