[After a Week of Big Updates] Don't Open "Update Now" Mails or Pop-ups | Open Updates Yourself From Settings, and Close Certificate Errors

Hello! I'm Shemhazai, the sentinel.
Today: how an individual should act after a run of news about big browser and app updates.

The short answer: do not open an "update now" notice from a link in a mail, SMS, ad or pop-up. Open the update yourself from Settings or the official app store. And if your browser shows a certificate error, do not go on through "Advanced"; close it.

This week's example. 19-23 October saw big updates pile up: Chrome 156 (20 October), Firefox 158.0.1 (20 October), Java (IPA's advisory on 21 October) and PHP (IPA's advisory on 22 October). In its September report published on 19 October, the Council of Anti-Phishing Japan wrote that "mail posing as app updates or application procedures and leading to malicious-app installation is also surging". In its 8 September alert about mail leading to malicious Android apps, it reported many wordings: app updates, notice checks, points, lotteries, coupons and gifts.

First, what is known and what is not. Known: mail posing as updates and leading to malicious apps surged in September, and the Council asks people to update from the official store or Settings. Not known: whether fake notices riding this week's Chrome and other updates are actually circulating; I found no report from a public body. "Big update news makes people easier to exploit" is our own view.

How the fake "please update" works

• ▸1. You see the update news. When big updates keep coming, a feeling of "if I don't update it's dangerous" spreads. Many updates really are needed, and they are listed in our companion article, this week's security update roundup
• ▸2. A fake update notice arrives. The wordings the Council confirmed include app updates, notice checks, points, lotteries, coupons and gifts. The Council writes that the mail text and the brands impersonated are changed every few days
• ▸3. You open the link and are made to install an "update app". The Council's 8 September alert warns against accessing or installing from mail or SMS links that urge Android-only logins or app installs
• ▸4. Harm. The Council lists, as one way malicious apps get installed, downloading directly from a mail link. Once installed, information on the device and what you type may be stolen (our note)

What you can do today

• ✓★Do updates from a screen you open yourself. Check the browser from items such as "About Chrome" or Firefox's update section in Settings, the phone or PC OS from Settings' software update, and apps from the official app store (the names differ by environment; our note). The Council asks you to "update and install apps from the phone's settings or the official app store, and not to download directly from a mail link"
• ✓Do not press the "update" button or link in a mail, SMS, ad or pop-up. If you wonder whether a notice is real, open that service's official site or app yourself and check
• ✓On Android, keep "install unknown apps" turned off for every app. This is IPA's advice, since apps distributed outside the official store can be dangerous
• ✓Update the software you use most, such as Chrome, Firefox and Java. For Chrome, you need to restart after updating (our note). IPA's "MyJVN Version Checker" can check whether your PC software is current (IPA)
• ✓If your browser shows a certificate error, close it rather than proceed. Even if a "go on" button appears under "Advanced", do not press it. Because trust lists keep changing, for example Chrome removing a root certificate on 27 October, genuine sites may occasionally show errors (Google says sites using certificates from that hierarchy must move to another one). Even then, close the page and wait, or check the site operator's notice (our note)
• ✓If you run your own site or blog, check the PHP update. WordPress and similar run on PHP. Read your hosting company's notice and IPA's advisory of 22 October. PHP 8.1 and older will not be fixed, and IPA suggests considering migration or even closing the site
• ✓On a work or school PC, do not update by yourself; ask your IT staff. Software you installed on your own or from a notice link causes more damage if it turns out to be malicious (our note)

If you already installed a fake update

• ▸1. Cut the connection at once. Switch on airplane mode or turn off Wi-Fi. Do not type anything further (our note)
• ▸2. Remove the app. On Android, find the app you do not recognize, or the one you installed from a notice, in the Settings app list and delete it. If you cannot tell how, phone a helpline (our note)
• ▸3. Change, from a different device, any ID and password you typed into a fake site. Then change the same password on other services. If you entered a card number, contact the card company at the number on the back of the card (our note)
• ▸4. Get help. IPA's Information Security Consultation Desk is at 03-5978-7509 (weekdays 10:00-17:00 JST). For the police, go to your nearest station, the cybercrime consultation desk, or the police advice line #9110
• ▸The Council and IPA material does not give concrete steps for after you have installed it. Steps 1 to 3 are our notes. If you find a similar mail you can report it to the Council (info@antiphishing.jp)

Spot-the-scam quiz

Picture this.

Three lines to send your family

• ▸Do not open the link in any mail, SMS or pop-up saying "update now". Open updates yourself from the phone or PC's settings or the official app store (Council of Anti-Phishing Japan)
• ▸★On Android, keep "install unknown apps" turned off. If the browser shows a certificate error, close it rather than proceed
• ▸If you installed something, typed something or feel unsure, call IPA at 03-5978-7509 (weekdays 10-17) or the police advice line #9110 (Japan). For contract or billing trouble, Consumer Hotline 188

Where to get help (Japan)

If you are not sure whether something is a scam, or you installed a suspicious app, contact your nearest police station, the cybercrime consultation desk, or the police advice line #9110. If harm is happening right now, call 110 (based on NPA guidance; our note). These are services within Japan.

For technical questions about PC or phone security, ask IPA's Information Security Consultation Desk (03-5978-7509, weekdays 10:00-17:00 JST, closed on weekends, public holidays and at year end).

For contract or billing trouble, call the Consumer Hotline 188. It connects you to your local consumer affairs centre.

What I could not confirm

• ▸Whether fake notices riding this week's updates are actually circulating. I found no report in the Council's or IPA's publications that names this week's Chrome, Firefox, Java or PHP updates. "Easier to exploit" in this article is our own view
• ▸The Council's October figures. What I could check were the September monthly report (published 19 October) and the alerts of 8 and 30 September
• ▸A public guideline on how an individual should treat a certificate error. The IPA and Council material does not cover it, so that part is our note. For businesses, Cloudflare advises not to resolve it by disabling verification
• ▸Exact steps on the update screens. Names and locations differ by browser, OS and device, and I did not try the screens
• ▸An official procedure for after you installed it. It is not in the material for this case; it is our note

Pages we relied on