Mobile malware: a myth buster

October 2011 Cyber Security

Amit Klein, Trusteer CTO, explodes the myths and dispels the fantasies of mobile malware.

We are all wise to the risks our online antics pose to our security. We have learned not to trust e-mails from Nigerian Bankers offering to share millions in exchange for a small upfront handling fee. Our banks have not monitored fraudulent activity so they do not need us to verify our account details by confirming our information. Messages from DHL with attachments informing us about deliveries we are not expecting do not fool us into opening the document. We are even wise to the links in e-mails that want us to visit websites and win prizes. Why do they not work? Because we have learned the hard way.

When these scams first started circulating people fell for the lies. Some of you will remember, or heard about, the chaos caused in 2000 when people opened an attachment to find out who loved them and spread the I Love You worm. In a single day it travelled around the world causing an estimated $5,5 billion in damages.

So, why are people not heeding the warning that malware has gone mobile and taking steps to protect themselves? The reality is there is a false sense of security surrounding mobile use, especially as victims currently are few and far between, but I am here to dispel the myths and banish the fantasy.

Myth one: Mobile operating systems are sandboxed, so we are safe

Anyone that still believes this is true is living in fantasy land. We have already seen malware that attacks sandboxing – DroidDream is just one that recently made the headlines. It exploited a vulnerability in the android operating system and obtained root privileges, downloading and installing additional arbitrary pieces of software, to assume virtually limitless control of the infected smartphone.

Myth two: Mobile applications are controlled – Apple and Google are watching our backs

Anyone that still believes this myth has a serious case of loyalty overload. DroidDream was found in applications that were being sold through the Google app store proving that the semi-closed, or walled garden, approach that is supposed to protect our mobile devices and prevent malware from infecting the device is flawed.

The simple reason is Google et al want, and actively encourage, developers to create apps with just a $25 entry fee. It is unsurprising that malware writers and spammers are happy to flex their muscles and get a piece of the action. Rogue developers all too easily can get permission or approval to upload their infected applications – that is what they did with DroidDream.

Myth three: There is no money in mobile malware so fraudsters are not interested

Wake up people – we are already in the middle of a third generation of financial malware. Zero generation had users unwittingly dialling premium numbers or sending SMS texts to services that charged them for the privilege

First generation was malware that engaged simple tricks, for example changing the host file of an infected device and redirecting the user’s mobile browser to a phishing site.

Second generation has seen malware increasingly infect the mobile device that works in conjunction with malware already infecting the desktop. In case you are not sure how this scam works, basically malware infects the mobile device and steals SMS verification messages and reroutes them to the fraudster.

The next generation of mobile malware will actually attack the mobile device focusing on mobile browsers or mobile applications themselves to abuse the current users session and commit fraudulent transactions, possibly even with the unintended aid of the user. While at the moment, this could be argued as myth it will not be long before it becomes reality, we are just waiting for banks to introduce the service. Fraudsters have all the tools they need to effectively turn mobile malware into the biggest customer security problem we have ever seen. They are lacking one thing – customer adoption.

I said at the start of this article that people need to heed the warning that malware has gone mobile and taking steps to protect themselves. As I am sure you will agree, I have proven it is not only possible but is happening, so it is time to start affording your smartphone the same protection you do the PC.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

NIST’s impact on cybersecurity
Cyber Security
Through its NIST Cybersecurity Framework, the non-regulatory agency empowers organisations to take a proactive approach towards managing and mitigating cyber risks, enabling them to stay resilient against the ever-evolving threat landscape.

Best practice tips for strengthening data privacy system
Security Services & Risk Management Cyber Security
International cybercriminals are increasingly targeting South African organizations, making data privacy more difficult to maintain. A standardization expert offers insight to help combat this threat.

AI-powered cyber protection for consumers
IT infrastructure Cyber Security
Acronis Cyber Protect Home Office is designed for the evolving landscape of cyber threats by integrating Acronis' cyber protection and secure backup solutions, combining AI-powered defence mechanisms, robust data backup, remote management tools, and mobile device protection.

A surge of cybersecurity for the energy sector
Government and Parastatal (Industry) Cyber Security
With a rapid transition towards renewable energy, the energy sector has an increased reliance on technology. This makes it particularly vulnerable with regards to cybersecurity, as it depends on interconnected systems and digital technologies.

Secure backup strategies imperative for business continuity
IT infrastructure Cyber Security
Cybercrime is on the rise, and businesses need to adjust how they manage their data to fend off attackers, or risk irreparable damage, writes Lisa Strydom, Senior Manager Channel and Alliance for Africa at Veeam Software.

CHI selects NEC XON as trusted cybersecurity partner
News Cyber Security Industrial (Industry)
CHI Limited, Nigeria's leading market player in fruit juices and dairy products, has engaged in a strategic cybersecurity partnership with NEC XON, a pan-African ICT systems integrator.

Mitigating escalating DDoS cyberattacks
Cyber Security
As cyberattacks, particularly those of the Distributed Denial of Services (DDoS) variety, continue to rise at an unprecedented rate across Africa, it is no longer a question of ‘if’ your organisation will be targeted, but rather ‘when’.

Six effective antidotes to modern cyber adversaries
Cyber Security
As the head of cybersecurity at NEC XON, Armand Kruger has witnessed the transformation from hooded hackers to a sophisticated dark economy that poses unprecedented threats and is run like a business.

Key strategies for businesses in the face of cyber threats
Cyber Security Security Services & Risk Management
Businesses face severe financial and reputational consequences due to data breaches and daily website hacks, and not all organisations are adequately prepared to combat these escalating threats.

Cyberattacks are inevitable for small businesses
Cyber Security
The recent cyberattack on Microsoft is a stark reminder that no organisation, regardless of its size or industry, is immune to cyber threats. Even small businesses, often assuming they are less attractive targets, are vulnerable.