Normal view

There are new articles available, click to refresh the page.
Today — 5 July 2024Main stream

Leadership drama? Shotgun marriage with Reform? The Tory party’s next move will define its future | Henry Hill

5 July 2024 at 01:30

A reckoning is due – but thanks to voted-out contenders and internal divides, it’s not at all clear who will be leading it

I don’t know if it’s just the extent to which Conservative activists were gaslit by the polling and CCHQ’s abject campaign, but the mood among those I spoke to as the night progressed was oddly chipper, given the Tory party was set to receive the worst result in its long history.

But when it looked at one point as though it might return fewer than 70 seats, and there seemed to be the faint possibility of Sir Ed Davey as leader of the opposition, the 1997 result minus 20 or so seats suddenly didn’t look so bad.

Henry Hill is deputy editor of ConservativeHome

Guardian Newsroom: Election results special
On Friday 5 July, 7.30pm-9pm BST, join Hugh Muir, Gaby Hinsliff, John Crace, Jonathan Freedland and Zoe Williams for unrivalled analysis of the general election results. Book tickets here or at theguardian.live

Do you have an opinion on the issues raised in this article? If you would like to submit a response of up to 300 words by email to be considered for publication in our letters section, please click here.

Continue reading...

💾

© Photograph: Temilade Adelaja/PA

💾

© Photograph: Temilade Adelaja/PA

Yesterday — 4 July 2024Main stream

Apple Caves to Roskomnadzor Demands, Removes VPNs From Russia’s App Store

VPN Apps, Apps Removal, App Store

In a move that tightens Russia's grip on internet control, Apple has removed several Virtual Private Network (VPN) applications from the App Store in response to a request by Roskomnadzor, the country's federal media watchdog.

The deleted VPN apps belonging to ProtonVPN, Red Shield VPN, NordVPN, and Le VPN were popular tools used by Russians to bypass government-imposed internet censorship. Red Shield VPN and Le VPN confirmed the removals, sharing messages from Apple stating the apps were deleted per "demand from Roskomnadzor" for containing "content considered illegal in Russia."

VPNs creates encrypted tunnels for internet traffic, allowing users to access blocked websites and applications anonymously.

Apple offered little explanation, suggesting developers contact Roskomnadzor directly. Red Shield VPN, in turn, advised users to switch their Apple ID country to access the app and updates elsewhere. But the suggestion came not before it used some stern wordings against the Cupertino giant. It said:

"Apple's actions, motivated by a desire to retain revenue from the Russian market, actively support an authoritarian regime. This is not just reckless but a crime against civil society. The fact that a corporation with a capitalization larger than Russia's GDP helps support authoritarianism says a lot about the moral principles of that corporation." - Red Shield VPN

Red Shield said its services aims to provide free access to information and improving the world. But in the notification, Apple refers to Roskomnadzor's request to remove the app and claims that its app "solicits, promotes, or encourages criminal or clearly reckless behavior," which it strongly disagrees with.

A similar notice was sent to LeVPN as seen in the image below:

[caption id="attachment_80371" align="aligncenter" width="1024"] Apple Notice to LeVPN (Source: LeVPN)[/caption]

Banning and Removal of VPN Apps Not New

This is just the latest chapter in Russia's escalating efforts to control online information. The crackdown on VPN Apps and their services predates the Ukraine war but has intensified significantly since. Roskomnadzor executed large-scale blocks targeting VPN protocols like WireGuard, OpenVPN, and IPSec in August and September 2023.

According to Sergei Khutortsev, Director of Roskomnadzor's Public Communications Network Monitoring and Management Centre, 167 "malicious" VPN services and 84 applications have been blocked in just two years.

This aggressive censorship push extends beyond VPNs. Roskomnadzor is reportedly developing an AI-powered system to maintain a vast register of banned information, further solidifying its control over the Russian online landscape. Additionally, the agency compels telecom operators to block roughly 300,000 unregistered SIM cards weekly.

While Apple's compliance with Roskomnadzor's demands raises concerns about corporate responsibility in the face of authoritarian restrictions, it's a tactic with limited effectiveness. Tech-savvy users will undoubtedly explore alternative methods to access VPN services. The bigger worry lies with Roskomnadzor's growing arsenal of censorship tools and its potential to stifle free speech and the flow of information within Russia.

Before yesterdayMain stream

3 million iOS and macOS apps were exposed to potent supply-chain attacks

1 July 2024 at 19:43
3 million iOS and macOS apps were exposed to potent supply-chain attacks

Enlarge (credit: Aurich Lawson)

Vulnerabilities that went undetected for a decade left thousands of macOS and iOS apps susceptible to supply-chain attacks. Hackers could have added malicious code compromising the security of millions or billions of people who installed them, researchers said Monday.

The vulnerabilities, which were fixed last October, resided in a “trunk” server used to manage CocoaPods, a repository for open source Swift and Objective-C projects that roughly 3 million macOS and iOS apps depend on. When developers make changes to one of their “pods”—CocoaPods lingo for individual code packages—dependent apps typically incorporate them automatically through app updates, typically with no interaction required by end users.

Code injection vulnerabilities

“Many applications can access a user’s most sensitive information: credit card details, medical records, private materials, and more,” wrote researchers from EVA Information Security, the firm that discovered the vulnerability. “Injecting code into these applications could enable attackers to access this information for almost any malicious purpose imaginable—ransomware, fraud, blackmail, corporate espionage… In the process, it could expose companies to major legal liabilities and reputational risk.”

Read 16 remaining paragraphs | Comments

Cyber Trust Mark: The Impacts and Incentives of Early Adoption

1 July 2024 at 06:00
IoT, devices, cyber trust mark, trade-offs, users, deception devices Cato Networks BYOD tablet Mobile Devices for GDPR Compliance

The Cyber Trust Mark is a labeling initiative for consumer IoT devices in the United States that builds on work undertaken by the FCC and NIST, establishing data privacy and cybersecurity standards for connected devices.

The post Cyber Trust Mark: The Impacts and Incentives of Early Adoption appeared first on Security Boulevard.

Spotify Has a Cheaper Membership Plan It Doesn't Want You to Know About

25 June 2024 at 10:30

Spotify has stealthily launched a new membership plan for its individual users. I say stealthily because despite posting an announcement about it, the company is hardly going out of its way to let current subscribers know about the plan changes—probably because a lot of them would choose to siwtch if they knew they had the option. What's more, new users can't even sign up for the plan; you can only get it by joining and then "downgrading."

The new plan is a spin-off of the service’s Premium Individual membership, and is aptly named “Basic.” It's $1 cheaper than the typical Premium plan, $10.99 versus $11.99. (A dollar a month is not much, I know, but I’ll get to that). While the plan’s name might suggest an offering similar to the “free” version of the music streaming service, which features ads while you listen, Spotify says Basic grants you all the benefits of a standard Premium plan, minus only the option to listen to 15 hours of audiobooks per month.

For most people, losing that privilege honestly makes “downgrading” to the Basic plan worth it, even if only to save $12 a year. Here's why.

Streaming is experiencing price creep across the board

Spotify is just one of many streaming services that has continued to raise prices regularly—with its most recent bump coming earlier this month, when the company increased the cost of Premium from $10.99 to $11.99, and raised the price of Premium Duo and Premium Family. Despite the steady increases, though, Spotify hasn’t really added any new features to Premium in years.

In fact, the company even took a strange backward step with its first hardware release, Car Thing, which was discontinued earlier this year—and even shutting down its functionality, so even people who had bought and paid for it couldn't keep using it (though the company did offer refunds). Given that, the introduction of a cheaper paid plan that won’t necessarily deprive you of any useful features is a nice change of pace in today's increasingly expensive, ad-choked streaming landscape.

Most Spotify users don't listen to audiobooks

Now, you’ll notice I said “useful features.” Spotify made a big deal out of supporting audiobooks when it brought them to its service last year, and while I do love audiobooks—they’re a great way to read when you don’t have the time to sit down with an actual book (or ebook)—Spotify’s inclusion of audiobooks in its service isn’t exactly anything to write home about.

Yes, there are more than 250,000 titles in the catalog, but you’re only granted 15 hours of listening per month. If you listen to books of average length (around 10 hours, depending on the word count of the original work and the reading speed of the narrator), then you’ll be limited to listening to one book per month. If you listen to longer books, though—for the record, a book in the Game of Thrones series can run to as long as 47 hours—you won’t be able to complete the entire thing in a single month, which isn't the best user experience.

Moreover, Spotify's own reports indicate that only 25 percent of Spotify’s subscribers are taking advantage of its audiobook content at all. That means a good chunk of you reading this—myself included—are paying for something you don’t actively use. (Note that it isn't clear if Spotify’s reported figure accounts for active monthly listeners, or just the percentage of users who listened to audiobook content at least once.)

Basic gives you everything Premium, except audiobooks

At $10.99, Spotify’s new Basic plan costs as much as Premium used to, before the price hike earlier this month. That means if you don't mind sacrificing audiobooks (which you probably aren't listening to anyway, based on the numbers), you can effectively bypass the price hike. This also keeps the monthly cost of Spotify on par with Apple Music.

Once Spotify finally starts adding features like lossless audio, the price and feature difference between the plans may expand further. I could see Spotify introducing a completely new pricing tier for lossless audio, for example. But that's all in the hazy future. If you’re an active Spotify subscriber right now and you don’t listen to audiobooks on the platform, you have no reason not to downgrade to Basic—over the course of a year, it's like getting a month of the service for free, and then some.

How to sign up for Spotify Basic

As noted, you can't choose to sign up for Basic directly—it's not even listed on the site's "View all plans" info page. No, you have to either be an existing Premium member, or sign up for Premium and then downgrade your membership.

Once that requirement has been satisfied, to downgrade to the new Basic plan, you'll need to open Spotify on the web, then click on your profile image in the top-right hand corner of the page. Select Account, and then click on the Your Subscription section at the top. Next, click the Change plan button, then select Basic.

You'll need to go through a few confirmation screens—including a few where Spotify will try to sell you on the idea of paying $1 more each month to keep getting 15 hours of audiobook content. Once confirmed, though, your plan will change and you'll be on the cheaper option. 

If you're subscribed on Android, you can make the change directly in the app, but a Spotify rep confirmed to TechRadar that you'll need to use a browser to make the change if you're subscribed on iOS, as Spotify's iOS app doesn't support the option directly in the app.

Additionally, it appears Spotify is also offering new Basic versions of its Duo and Family plans (the Family Basic plan is $16.99 versus the regular $19.99, while pricing for the Duo plan isn't widely available yet). Spotify didn't cover either of those options in its official announcement, nor did it reveal that the feature is also apparently available to U.K. and Australian subscribers, at least according to what the representative told TechRadar.

Proton Drive Brings Automatic Photo Backups to iOS

25 June 2024 at 08:00

When phones also became cameras, many of us started taking photos every day. These photos might be of your pets, your food, or even special events like weddings and birthdays. Or maybe you've got more precious photos, perhaps of a family member who's no longer with you. Lots of photos mean lots of data management, and to protect your snapshots, you'll want to back them up.

But not all cloud storage is created equal, and while Apple’s built-in iCloud systems are perfectly useable, Proton has now updated the iOS version of its impressive cloud storage service with automatic photo backup, allowing you to protect your most precious memories with complete end-to-end encryption.

Proton Drive photo backup showcase
Credit: Proton

This newly released feature, previously only available on Android, comes just weeks after some users reported their old, deleted photos coming back to their iPhones after they updated to a new version of iOS. While Apple has fixed the issue now and does offer options for end-to-end encryption, it still raised some concerns about just how in control Apple users are when it comes to their own photos, and options like Proton Drive can give you a great alternative to iCloud without having to worry about sacrificing your privacy.

There are, of course, other non-Apple cloud storage options on the App Store. Google Photos, which comes pre-installed on Android phones, is probably the most well-known and used iCloud competitor. However, Proton Drive offers something that Google Photos doesn’t—complete end-to-end encryption.

Sure, your photos are protected with Google Photos, but Google still has access to your precious memories, as your photos aren’t encrypted until they are uploaded to Google’s servers. With Proton Drive, nobody but you and the people you share your content with have access to those files. That’s because Proton Drive encrypts your photos and their metadata right there on your phone before they transfer to Proton’s servers. This ensures only you have access to your data, making it one of the best options for users who want to protect their memories and privacy with the utmost care.

How to enable Photos backup in Proton Drive
Access the menu in the top-left hand corner, then tap Settings and toggle Photos backup to back your photos up to Proton Drive. Credit: Joshua Hawkins

Automatic photo backup is a feature that I've wanted to see in Proton Drive since I started using it several months ago, and Proton says that it has been one of the most requested features from its community, too. The feature rolled out last week, and you can enable the automatic camera uploads in the app by opening the app on your iPhone and accessing the hamburger menu in the upper left-hand corner (the icon that looks like three horizontal lines on top of each other). From there, simply tap on Settings and then toggle Photos Backup to on, and the app will start backing up your photos automatically each time you take a new one.

The addition of photo backup in Proton Drive makes it even easier to completely quit Google, something that privacy-focused individuals may want to consider, as Google and other online cloud services have access to your personal data when it is stored on their servers.

Rafel RAT Used in 120 Campaigns Targeting Android Device Users

24 June 2024 at 13:33
Android Rafel RAT ransomware

Multiple bad actors are using the Rafel RAT malware in about 120 campaigns aimed at compromising Android devices and launching a broad array of attacks that range from stealing data and deleting files to espionage and ransomware. Rafel RAT is an open-source remote administration tool that is spread through phishing campaigns aimed at convincing targets..

The post Rafel RAT Used in 120 Campaigns Targeting Android Device Users appeared first on Security Boulevard.

10 Apps for Encouraging Your Kids to Be More Active

21 June 2024 at 13:30

According to the U.S. Department of Health and Human Services, children between the ages of 6 and 17 should get at least an hour of moderate-to-vigorous physical activity every single day. But with so many distractions—from video games, to TV to tablets—that keep kids sedentary, clocking 60 minutes of exercise is easier said than done.

But what if you can capitalize off of that screen addiction to help get kids off the couch? Here are 10 apps that encourage users to engage in physical activity or even "gamify" exercise is a fun way.

NFL Play 60

Chances are your children are familiar with running games like Minion Rush or Subway Surfers. In these apps, players control characters who endlessly run, jump, and collect objects until they hit an obstacle. NFL Play 60 works on a similar basis: Your children choose a character that represents their favorite football team, but they have to run and jump in real life to collect coins they can use to upgrade their avatars. You can track their daily activity levels and create custom exercise plans. And yes, they must hold on to their devices while engaging in physical activity, so you may want to invest in an Otter Box case to prevent damage.

Available for: iOS / Android

Apple Fitness+

If your children have an Apple Watch and are looking for ways to close their rings, this subscription app offers plenty of unconventional workouts, such as dancing, yoga, and meditation, that are perfect for any age group. Also, if each family member wears an Apple Watch, you can all do the same workouts together. Each session has a trainer working at a lower intensity that kids can follow, and each instructor's optimism is infectious. Find out more about the app here.

Available for: iOS (obviously)

Sworkit

Perhaps best known for its founders snagging one of the largest deals on the reality show Shark Tank, this app offers workouts for kids, ranging from strength training, to cardio, to yoga and stretching, tailored to specific age groups. Instead of showing adults doing the exercises, kids perform each move, which range from bear crawls to jumping jacks. Kids can also set the length of the workout. While adults have to pay for a subscription, the youth workouts are free and can be accessed here.

Available for: iOS / Android

GoNoodle

Chances are your kids are already familiar with the dances accompanying catchy songs like "Banana, Banana, Meatball" and "Purple Stew," as teachers often play the short videos featured on the app to get students moving during class. Each of the over 300 songs and exercises is about physical activity and having fun, and they never seem to get old. Don't be surprised if you start singing "Clap It Out" after a few watches.

Available for: iOS / Android

Calm

You need to cool down after a workout, right? This popular relaxation app isn't just for adults. The Calm Kids section offers sleep stories with characters like Winnie the Pooh and Peter Pan and guided meditations featuring the Minions from Despicable Me. There are even videos utilizing movements to boost energy or relax muscles. However, you have to be a subscriber to access these features.

Available for: iOS / Android

Zombies, Run!

This app will track the details of your kid's run, much like Strava. What sets it apart is how it motivates users to move, which is (if the app's name didn't give it away) the natural fear of zombies. Headphones pipe in a story of a zombie apocalypse into your youngster's ears, and they'll have to speed up their movement to avoid having their brains eaten. There are now 10 seasons of stories to choose from, and developers recently added an expansion called Marvel Move that allows runners to run alongside their favorite comic book superheroes. You can try the app for free for a week, but only subscribers can access all the content. (Some moms and dads mention that the stories can be a little intense for younger runners, so parental discretion is advised.)

Available for: iOS / Android

Super Stretch Yoga

This simple-to-use app combines the charm of the current comic book craze (Super Stretch is a child superhero who uses a blanket for his cape) with animated characters and kids performing 12 gentle yoga poses for users to recreate. Additionally, it encourages its youthful users to take a moment to take deep breaths, reflect, and act with kindness.

Available for: iOS

Jump Jump Froggy

Much like NFL Play 60, this app combines gaming and physical movement. In one of the three modes, kids control frogs trying to catch flies and avoid the owls and snakes that are out to get them. Speaking of snakes, Situp Snake tracks how many situps one kid can do in a minute, encouraging them to set a new record each week. The Counting Challenge combines math and physical fitness as kids have to jump while counting ants. While the graphics aren't impressive, it will still engage younger kids.

Available for: iOS / Android

Walkr

Getting in your 10,000 steps can get boring fast. The award-winning Walkr app turns this daily movement goal into a space-age game that uses a phone's pedometer to keep track of a user's steps. There are more than 30 missions to complete, and movement is used to fuel players' spaceships so they can move on to the next mission. The drawback for some parents is the game has a social element, plus there are in-app purchases that could entice players to give themselves an edge.

Available for: iOS / Android

Fitivity

If you have a student-athlete who wants to improve their skills in their chosen sport, Fitivity offers workouts at all levels to help users improve their skills in everything from basketball to rugby.

Available for: iOS / Android

This App Lets You Set a Homepage for Safari on Your iPhone or iPad

21 June 2024 at 11:30

Safari, on mobile devices, does not offer a homepage. This isn't a big deal if you like the default new tab page, which shows links to your hand-picked "Favorites," tabs you have open on other devices, and a few more recommend pages. If you'd rather have your favorite search engine or landing page show up instead, though, you need an app called Homepage. This tool is completely free and does one thing: lets you set a homepage in Safari.

Open the application and you can type any URL for your homepage and hit "Save". Simple, right? You're not done: you need to enable the extension in Safari. Open System Settings and head to Safari > Extensions. Here you'll see that "Homepage" is turned off.

Screenshot of Safari extensions
Credit: Justin Pot

Tap Homepage and then make sure Allow Extension is turned on. Then tap Open New Tabs and make sure With "Homepage" is selected.

A screenshot of the extension settings for "Homepage"
Credit: Justin Pot

Now head to Safari and open a new tab. If everything was configured properly, you should see your chosen URL instead of the default "new tab" page. It's a simple thing, sure, but if you want your favorite webpage every time you open the browser, this is the best way to do it.

Use This Workaround to Send High Quality Photos and Videos on WhatsApp

20 June 2024 at 19:00

WhatsApp might be the most popular chat app in the world, but it hasn’t always been the best for sending photos and videos. The app traditionally had a 16MB limit on any media you sent, and, even still, compressed it to save space. That compression resulted in lower quality images and videos, which is frustrating in a time when smartphones have incredible cameras.

It's getting better, though. Mark Zuckerberg announced last year that WhatsApp supports high-quality photo sharing—although you might have missed the option if you weren’t looking for it. The update didn’t include support for HD videos, however, until the company quietly updated the app a week later.

HD quality is becoming the default

Fast forward to June 2024, and it seems WhatsApp is finally ready to commit to high-quality media: As reported by Android Police, Meta is now rolling out the ability to send high-quality photos and videos by default. That means that, once the update hits your app, your photos and videos should share in HD without you having to do anything. (Previously, you needed to hit the "HD quality" option to trigger this every time, which was frustrating for anyone who wanted to send their media in high quality with each send.)

You can check if you have this setting enabled from Settings > Storage and data > Media upload quality. Make sure "HD quality" is selected. WhatsApp will warn you that HQ quality media may take longer to send, and that it could be up to six times larger, which means it may put more stress and resources on your data plan. With this setting enabled, you should notice the HD option highlighted before you send your photo or video.

HD quality isn't uncompressed

However, “HD” media isn’t exactly what you might think it is. Videos max out at 720p, even if your original video was recorded in 1080p or 4K, which means WhatsApp is still compressing the video quite a lot. Still, it’s better than standard quality, which drops the resolution to around 480p. Likewise, WhatsApp still applies some compression to photos sent via the HD Quality setting, so even still, you won’t be able to send HD photos in their native resolution with this method.

Use this loophole to send full resolution photos and videos on WhatsApp

WhatsApp actually has a better solution for sending high-res content: Rather than send your videos as videos, send them as documents. This has been the best way to send full-res media for a while, as WhatsApp previously had a 100MB limit on documents, and just about anything can be a “document.” Recently, that limit jumped to 2GB per file, which makes it possible to send most (if not all) of your photos and videos in their full resolution to whoever you want in WhatsApp.

To send a video file via this method, open a WhatsApp conversation, tap the attachment icon (Android) or the (+) (iOS), choose “Document,” then choose the files you want to share. WhatsApp will send the files without compression, so you can share your content in its full quality (as long as it’s under 2GB). To preserve the quality of anything larger than 2GB, you’ll need to use another sharing method, like Dropbox or Google Drive.

Habo Is a Simple (and Free) Habit Tracking App

20 June 2024 at 11:00

We've talked a lot about the "don't break the chain" method of building habits over the years, where you visually mark the completion of a habit every day to help you build it. The classic method is to put an "X" on a paper calendar every day. The longer your streak goes on, the more motivated you are to keep it going—as anyone with Snapchat streak with a friend knows.

Paper is fantastic for this, granted, but some people prefer digital tools. That's why I like Habo, an open-source habit tracking app for Android and iPhone that couldn't be simpler. There are no ads and no upselling—it's just a way to help build habits. Once you've downloaded and opened the app, add as many habits as you like. The idea is that you will check things off as you do them.

Three screenshots of the application in action. The first shows the various statuses you can apply to a habit, including failure to complete and skipping. The second shows the advanced habit setting, which allow you to specify a routine and reward. The third shows the settings for the application.
Credit: Justin Pot

There's an indicator on the top of each habit that lets you know how many days your streak has lasted. And you can configure the settings to do things no paper calendar can, like reminding you about your habit every day at a particular time. For example: You want to start doing 20 pushups before lunch every day. You can set the application to send you a notification right at 11:55. You can also add specific details about your routine and the reward you'll give yourself after completing it.

What I really appreciate about this app is its simplicity—and the fact that it's completely free. Too many productivity tools become needlessly complicated as they pursue monetization. Habo does what you need it to do and nothing else.

You Can Get a Free Month of Audiobooks on Spotify Right Now

19 June 2024 at 12:30

To mark National Audiobook Month this June, Spotify's offering a month of free audiobooks. As long as you are on Spotify's free plan and have a U.S. account on the service, you can sign up for a free trial that will give you access to audiobooks for a month from the date you sign up. You won't be able to access audiobooks if your Spotify account is from other regions.

This trial includes up to 15 hours of audiobook listening and if you're wise with your choices, you could easily squeeze in two to three audiobooks. To sign up for this free trial, you can head over to Spotify's Audiobooks page. The promotion is valid through June 30, 2024. Once the trial expires, you'll be charged $9.99/mo for Spotify's Audiobook Access Plan. 

Even the paid plan limits you to 15 hours of listening per month and unused listening time expires at the end of the month. Spotify lets you top-up listening hours if you're willing to pay and hours you purchase expire 12 months after the date of purchase, which gives you more flexibility in terms of choosing when to listen to books.

Unlike Audible, Spotify limits your audiobook use by listening hours. Audible's plans offer "credits," which can be redeemed against books. One Audible credit gets you one book and you're free to purchase more books by paying the listed price. Audible's plans offer greater flexibility because you're able to return audiobooks you don't like and if you're into long books such as epic fantasy series, then one credit can get you access to 40+ hours of listening. At the time of writing, Audible is also available in far more regions and is accessible by a larger number of people.

Still, the hope is that Spotify catches up in terms of availability and can compete with Audible. If the competition for the audiobook market is strong, us consumers end up benefiting the most. These aren't the only two players in the audiobook space. We've got a list of the 10 best audiobook services for you to choose from.

Free VPN apps turn Android phones into criminal proxies

1 April 2024 at 13:58

Researchers at HUMAN’s Satori Threat Intelligence have discovered a disturbing number of VPN apps that turn users’ devices into proxies for cybercriminals without their knowledge, as part of a camapign called PROXYLIB.

Cybercriminals and state actors like to send their traffic through other people’s devices, known as proxies. This allows them to use somebody else’s resources to get their work done, it masks the origin of their attacks so they are less likely to get blocked, and it makes it easy for them to keep operating if one of their proxies is blocked.

An entire underground market of proxy networks exists to service this desire, offering cybercriminals flexible, scalable platfroms from which to launch activities like advertising fraud, password spraying, and credential stuffing attacks.

The researchers at HUMAN found 28 apps on Google Play that turned unsuspecting Android devices into proxies for criminals. 17 of the apps were free VPNs. All of them have now been removed from Google Play.

The operation was dubbed PROXYLIB after a code library shared by all the apps that was responsible for enrolling devices into the ciminal network.

HUMAN also found hundreds of apps in third-party repositories that appeared to use the LumiApps toolkit, a Software Development Kit (SDK) which can be used to load PROXYLIB. They also tied PROXYLIB to another platform that specializes in selling access to proxy nodes, called Asocks.

Protection and removal

Android users are now automatically protected from the PROXYLIB attack by Google Play Protect, which is on by default on Android devices with Google Play Services.

The affected apps can be uninstalled using a mobile device’s uninstall functionality. However, apps like these may be made available under different names in future, which is where apps like Malwarebytes for Android can help.

Recommendations to stay clear of PROXYLIB are:

Victims of novel attacks like PROXYLIB might notice slow traffic, because their bandwidth is in use for other purposes. And at some point their IP address may be blocked by websites and other services.

The researchers included a list of applications they uncovered as part of PROXYLIB. If you installed any of the apps on the list before they were removed from Google Play you will need to uninstall them.


We don’t just report on privacy—we offer you the option to use it.

Privacy risks should never spread beyond a headline. Keep your online privacy yours by using Malwarebytes Privacy VPN.

❌
❌