Norton Halt redirect

While trying to run Norton HALT @1:50pm 1/25/2014 eastern time received the following re direct message below: What is problem? is this a threat to my phone?
New Android Threat poses risk to App Signatures

By Richard Clooke on
July 12, 2013

16
30
Google +68

mobilesecurity.com [London, UK] Bluebox Security has discovered a serious Android vulnerability, which has now been publicly disclosed by the Jeff Forristal, CTO of Blubox, that allows cybercriminals to inject malicious code into legitimate apps without invalidating the digital signature.

As Symantec’s Security Response team explains in their latest blog, digital signatures are required by all Android apps – it ensures the app has not been tampered with, and that it comes from a legitimate app developer. If apps can be altered without their digital signatures being affected, there could be significant security implications – and clearly this is an issue that needs to be remedied as soon as possible.

This recently-discovered vulnerability appears to have been around for over 4 years – since the release of Android v1.6 – and suggests that up to 900 million devices could be affected! The most alarming element of this discovery, is that details of how to exploit the vulnerability are now available online, and are surprisingly straightforward to implement.

Whilst injecting malicious code into an app (or trojanizing) is a common tactic employed by cybercriminals, it was previously easy for these malicious apps to be discovered – as the altered digital signatures revealed that modifications had been made by someone other than the official publisher.

Symantec has now added detection for this condition to its new Norton™ Mobile Insight system, and users can protect themselves by installing Norton Mobile Security on their Android tablets and smartphones.

More details of the vulnerability will be shared in Jeff Forristal’s talk at this month’s Black Hat Conference USA, taking place at Caesar’s Palace in Las Vegas.

Hi garner.

 

Welcome to the Norton Community Forums. :smileyhappy:

 

Sorry but I am confused by exactly what you mean by your post, so cannot currently respond helpfully.

 

You have posted in the Norton Mobile Security (NMS) forum but say you were trying to run Norton Halt.  Do you have NMS installed?  If so what version?

 

When you say you were trying to "run" Norton Halt, what do you mean?  Were you installing it for the first time or was there some reason why you had opened the already installed app?  Norton Halt is designed to run in the background after you have installed it, so a reference to "trying to run" it is puzzling.

 

I also do not understand what you mean by receiving a "redirect message" how did you receive this?  Can you please explain a little more fully?

 

As for the report - what can I say?  It reports another threat to Android devices and advises that the latest versions of NMS protect you from this threat.  But how you got the report or who Richard Clooke is, I do not know.

 

I look forward to hearing a bit more.

Actually, it is version 5.0.0.108 dated December 17, 2013.
By “run” I selected Norton Halt from menu and expected a scan bar to be there , but instead a message came up stating a redirect to the message posted. This is for an Android RAZR HD . My question is why the redirect regarding this past threat.

Thanks for the response garner.

 

Sadly I remain puzzled and do not know why you ended up with that message.  If I am to help can you please be precise and answer the questions as I ask them.  Otherwise trying to work out what has happened on someone else's device, which will be running different software and may have an error is VERY difficult.

 

I take it from the lack of comment that you are not running NMS.  If you are concerned about security of your device I would recommend that you do install it or something similar.  There is a free "Lite" version available on Google Play called "Norton Security antivirus" which can be upgraded to a fully paid version if you choose.

 

Now back to Norton Halt (this is covered in a different forum (Other Mobile Products [for future reference the initial post were made in the NMS forum]) and I will ask to have it transferred there so that it gets a better airing, and increase the chances of you getting a helpful response.  A stub should remain here so that you can easily find it.

 

I remain puzzled about the redirect and so will try and work through exactly what happened.  Please help and advise if I get anything wrong.

 

As I am not sure exactly what you mean by the statement that you "select Norton Halt from the menu", what menu?  I assume that you selected the apps menu (probably the central button on the home screen) on your Android RAZR HD, and then selected the icon for Norton Halt from the list.  

 

1- If not that, what did you do?

 

2- Can you explain why you were doing this and what you wanted to achieve?

 

I then assume that the app (I have the same version) opened.  When mine does I see a screen headed Norton Halt with three panels, the first is, Master Key Exploit; the second is, Hidden Device Administrator Exploit; and the third is, USSD Exploit.  The first two have a "Scan" button, the third a "Turn off protection" button.  

 

3- Is this what you see or saw?  If not exactly what did you see?  Can you post a screen image?

 

If you need help in posting an image in the forum you might like to refer to this post.

 

Your reference to the message "stating a redirect to the message posted" still leaves me puzzled.  

 

4- Did this message come up in the notification bar, on a fresh screen or where?

 

The text you quote appears to be a page from MobileSecurity.com which is a Norton website.  So there is a nominal "Norton" link but I am still puzzling as to how you triggered it.  Hopefully your responses to the above questions will get us a little closer to the answer.

 

And again in response to your initial question, Norton do appear to consider this a risk to Android devices but they also believe that they have it covered through current releases of NMS.

 

I hope the above makes sense and look forward to hearing back from you.

 

Yes, I am running the version of NMS from the Google app store and in the version specified in last post and have a purchased subscription of NMS from Staples near home and installed on device. Updates arrive via Google market.

1-3 questions from your description I am running the exact same version of NMS as yourself an can not post an image of the redirect message as I do as you described in the post and a message “flashes” on the screen for a very short period the the text I posted pops in to a fresh screen next. HOPE,this answers your inquiry Thank you for your patients and time.

Hello again garner.

 

There appears to be some misunderstanding which I need to sort out.

 

First let me interpret what I perceive as your answers to my questions:-

 

1- If not that, what did you do?  - Answer - That was what I did.

 

2- Can you explain why you were doing this and what you wanted to achieve? -Answer - None

 

3- Is this what you see or saw?  If not exactly what did you see?  Can you post a screen image? - Answer - Yes, that is what I saw.

 

4- Did this message come up in the notification bar, on a fresh screen or where? Answer - After opening Norton Halt I see the initial screen as described and then "a message "flashes" on the screen for a very short period the the text I posted pops in to a fresh screen next."

 

If any of the above is incorrect please let me know.

 

Next to sort out what appears to be a misunderstanding about Norton Halt (Halt) and Norton Mobile Security (NMS).  These are two different apps.

 

Halt which can be found here on Google Play is currently on version 5.0.0.108, has an icon that looks like a hand and the start screen looks like this:-

 

Screenshot_2014-01-26-08-06-05.png

 

NMS which can be found here on Google Play is currently in version 3.8.0.1199, has an icon that looks like a padlock and has an opening screen like this:-

 

Screenshot_2014-01-24-12-21-31e.png

 

You appear to be referring to the two interchangeably but from the version number you quote and the recognition of the screen it appears that you are using Halt.

 

A - Can you confirm that you are using only Halt or have you both installed?

 

B- Can you confirm that the odd message flashed up when using Halt and not NMS?

 

Now back to trying to work out what happened assuming that you were running Halt....

 

C - How long ago had you first installed Halt and how frequently do you attempt to run it as you did on this occasion?

 

D- If you try the same thing again today, does the same message appear?  If it does please try and see what the flash screen says and note if you do anything after just opening the app, i.e. does this message appear after merely opening the app or once you select some other option.

 

Finally, apart from again recommending that you install NMS if you do not already have it, I note that you seem to be using the Firefox browser.  You should be aware that NMS does not support Firefox at present.  It only provides web protection on the default android browser and Chrome.  :smileysad:

 

I hope the above helps and look forward to hearing back.

Just received your reply in my inbox sorry for delay.
The problem as you describe it has apparently resolved itself as my version of Norton Halt was uninstalled .
went to use it and the icon had disappeared from my phone. So automatically assumed that it was remotely removed by Norton. Personally have not removed any APP’s from phone. its is gone from my phone who ever took it off. So am assuming the problem is solved.

Hello garner.

 

Thanks for coming back, I had wondered what had happened.

 

I am glad that you consider the issue resolved.  :smileyhappy:

 

I would just note that as far as I am aware there is no way that Norton or anyone else could remove an app from your device without a complete system restore or system upgrade.  So I have to assume that you never actually had Norton Halt on your device just NMS.  

 

And I still have no idea how you got to that original message.  But there are many wonders in the world I will never understand.  Maybe we should not worry about them....

 

All the best for the future.