Hello, welcome to the Tuesday, August 15th, 2017 edition of the Sands and its Storm Center's Stormcast. My name is Johannes Ulrich and I'm recording from Jacksonville, Florida.

Quite often you may have asked yourself why anti-malware software isn't better in sort of identifying these generic obfuscation techniques that we often see with

malware. Well, today we have a nice diary with an example why that doesn't work. In this particular

case, the email that arrived though was malicious looking. It did use a lot of the tricks that we see in Malware and the landing

page that you went to when you clicked on the link. Well, it also used heavily obfuscated

JavaScript, but in the end, it just ended up to be spam. Now, you may consider this type of spam malicious as well, but by most

definition, there is a difference between spam and malware. And Malware engines try to not sort

of overstep their bounds in order to avoid being blamed for false positives. And we definitely had

plenty of them in the past as well. So interesting example, how not all obfuscated JavaScript

is outright malicious. In this case also we have again one of these new top level domains.

I think it was dot world showing yet again

that there's probably little need to resolve these domains and you may actually gain some

spam filter in this case or maybe even block the occasional piece of malware if you don't

resolve these new top-level domains.

And researchers at the University of Oxford have come up with an interesting new technique,

how malware could sneak its way into additional privileges on Android. Now, the paper really talks about Android, but the authors mention that

in principle the same technique is also possible on iOS. Essentially, what they're talking about

is that multiple applications on a phone will share common libraries. That's very common practice.

The particular library is only installed once and then shared between different applications.

But both the Android and the iOS permission system does not clearly differentiate between

permissions assigned to an application and a library.

So what happens is that a library that's used by multiple applications does gain the privileges

...