8mo ago

PSA: always update your smartphone | Ratel RAT targets outdated Android phones in ransomware attacks

www.bleepingcomputer.com Ratel RAT targets outdated Android phones in ransomware attacks

An open-source Android malware named 'Ratel RAT' is widely deployed by multiple cybercriminals to attack outdated devices, some aiming to lock them down with a ransomware module that demands payment on Telegram.

Cybersecurity @sh.itjust.works

Kid @sh.itjust.works

8mo ago

Ratel RAT targets outdated Android phones in ransomware attacks

www.bleepingcomputer.com /news/security/ratel-rat-targets-outdated-android-phones-in-ransomware-attacks/

26 1

You're viewing a single thread.

24 comments

If only there was what to install. It's crazy that I have to essentially throw away a perfectly capable device because the manufacturer doesn't provide updates anymore. That if I want security updates.
- It's so stupid. All the phones newer than mine have less hardware features so if I replace it I'll have to find new ways of doing a bunch of things. I'm just accepting the risk at this point until manufacturers get their heads out of their asses and make something decent or my carrier stops supporting my phone. I'd have probably bought two more phones since I got this one if everything wasn't a downgrade from what I have currently.
  
  Yeah that's why I caved and bought a Sony Xperia 1 VI, yes it was very expensive, but at least it still does everything I want
  
  What about that one made you select it?
  
  Sd card slot, headphone jack, great front firing speakers, no hole punch selfie camera, good cameras and awesome battery life
- This is why I only buy unlockable devices that have open boot loaders. Making that decision up front means ROM support for a much longer time frame.
  
  From my understanding my phone should be unlockable, but I have no expertise when it comes to custom Android builds. Like, how do I know they are safe and don't come with some malware?
  
  I haven't done it in ages as I have a Pixel, but the norm used to be go to XDA Developers. Everything you need should be there. Guides, reputable links, etc.
  
  Nowadays people use the popular ROMs like Lineage (you might remember as cyanogenmod), or GraphineOS. There are a few others, too. But XDA is always a good resource.
- Yeah, it's a shame. Only Google seems to take updates seriously.
  
  Not sure why this is getting downvoted, because it's actually true. Google is the only Android phone manufacturer at the moment, that delivers 7 years of OS security updates + firmware updates, allows the user to unlock the bootloader and re-lock it with custom signing keys to retain full Android Verified Boot. And the ARMv9 MTE is the cherry on top.
  A modern Pixel with GrapheneOS is the best thing you can get right now for privacy, security and longevity.
  
  I completely agree with you. I think people downvoting me because "fuck Google" when in fact, hardware wise, is the best available to achieve privacy and security.
  
  My guess? Probably a mix of Google Evil (true), and not understanding you are talking about Pixels.
  I switched to Pixels after the whole Note 7 debacle. I even have the Note 7 t-shirt Best Buy gave out for those of us with pre-orders. It was really really shitty timing as I was traveling a lot for work and I am trying to remember if I even had a backup phone to use. I may have already traded my old phone in at the time, but had something in a drawer I could use.
  Evil Corp be damned, my phone just works. It doesn't lag. The pictures are awesome. Screen is nice. I just need all of this AI assistant shit to go away. I got it to STFU about it at least and my phone can go back to being a phone. Gemini can rot.
  
  I just need all of this AI assistant shit to go away.
  GrapheneOS doesn't have any of this BS.
  Despite what some people (who never used GOS and have idea how it works) say, everything except for Google Pay and a small portion of banking apps works just fine on it. You can check if your bank's app is supported: https://privsec.dev/posts/android/banking-applications-compatibility-with-grapheneos/
  If you need Google Play services, you can easily install them, and it will still be more private than on a standard Android device, thanks to a custom sandboxing mechanism.
  Security is just phenomenal, and I think it's fair to call GrapheneOS the most secure mobile operating system out there.
  It also enhances the longevity of your phone, because GrapheneOS provides feature updates as long as Google provides security updates. Some devices with the Stock OS (like e.g. the Pixel 6a) receive security updates for 5 years, but Google only provides feature updates for 3 years. GrapheneOS extends that period to 5 years as well.
  It's also super easy to install, and it's fully free & open source. It is truly amazing. I recommend watching this video to learn more about it: https://invidious.fi/watch?v=yTeAFoQnQPo
  
  That's the thing. I use Google Pay for 90% of the places I go and that isn't something I am willing to give up. Also, it looks like Amex isn't supported either. Google does 7 years of updates now.
  
  The GrapheneOS team is in talks with the European Commission to designate Google as a gatekeeper for mobile payments, because they only allow Google Pay on whitelisted operating systems, so there is some hope
- I wish security patches would be separated from "look at this new animation while closing the app1!1!1!" update honestly. Why is it so hard to do that?

24 comments