Mobile malware: a myth buster

October 2011 Information Security

Amit Klein, Trusteer CTO, explodes the myths and dispels the fantasies of mobile malware.

We are all wise to the risks our online antics pose to our security. We have learned not to trust e-mails from Nigerian Bankers offering to share millions in exchange for a small upfront handling fee. Our banks have not monitored fraudulent activity so they do not need us to verify our account details by confirming our information. Messages from DHL with attachments informing us about deliveries we are not expecting do not fool us into opening the document. We are even wise to the links in e-mails that want us to visit websites and win prizes. Why do they not work? Because we have learned the hard way.

When these scams first started circulating people fell for the lies. Some of you will remember, or heard about, the chaos caused in 2000 when people opened an attachment to find out who loved them and spread the I Love You worm. In a single day it travelled around the world causing an estimated $5,5 billion in damages.

So, why are people not heeding the warning that malware has gone mobile and taking steps to protect themselves? The reality is there is a false sense of security surrounding mobile use, especially as victims currently are few and far between, but I am here to dispel the myths and banish the fantasy.

Myth one: Mobile operating systems are sandboxed, so we are safe

Anyone that still believes this is true is living in fantasy land. We have already seen malware that attacks sandboxing – DroidDream is just one that recently made the headlines. It exploited a vulnerability in the android operating system and obtained root privileges, downloading and installing additional arbitrary pieces of software, to assume virtually limitless control of the infected smartphone.

Myth two: Mobile applications are controlled – Apple and Google are watching our backs

Anyone that still believes this myth has a serious case of loyalty overload. DroidDream was found in applications that were being sold through the Google app store proving that the semi-closed, or walled garden, approach that is supposed to protect our mobile devices and prevent malware from infecting the device is flawed.

The simple reason is Google et al want, and actively encourage, developers to create apps with just a $25 entry fee. It is unsurprising that malware writers and spammers are happy to flex their muscles and get a piece of the action. Rogue developers all too easily can get permission or approval to upload their infected applications – that is what they did with DroidDream.

Myth three: There is no money in mobile malware so fraudsters are not interested

Wake up people – we are already in the middle of a third generation of financial malware. Zero generation had users unwittingly dialling premium numbers or sending SMS texts to services that charged them for the privilege

First generation was malware that engaged simple tricks, for example changing the host file of an infected device and redirecting the user’s mobile browser to a phishing site.

Second generation has seen malware increasingly infect the mobile device that works in conjunction with malware already infecting the desktop. In case you are not sure how this scam works, basically malware infects the mobile device and steals SMS verification messages and reroutes them to the fraudster.

The next generation of mobile malware will actually attack the mobile device focusing on mobile browsers or mobile applications themselves to abuse the current users session and commit fraudulent transactions, possibly even with the unintended aid of the user. While at the moment, this could be argued as myth it will not be long before it becomes reality, we are just waiting for banks to introduce the service. Fraudsters have all the tools they need to effectively turn mobile malware into the biggest customer security problem we have ever seen. They are lacking one thing – customer adoption.

I said at the start of this article that people need to heed the warning that malware has gone mobile and taking steps to protect themselves. As I am sure you will agree, I have proven it is not only possible but is happening, so it is time to start affording your smartphone the same protection you do the PC.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

iOCO collaboration protection secures Office 365
Information Security Infrastructure
The cloud, in general, and Office 365, in particular, have played a significant role in enabling collaboration, but it has also created a security headache as organisations store valuable information on the platform.

Cybercriminals embracing AI
Information Security Security Services & Risk Management
Organisations of all sizes are exploring how artificial intelligence (AI) and generative AI, in particular, can benefit their businesses. While they are still figuring out how best to use AI, cybercriminals have fully embraced it.

A strong cybersecurity foundation
Milestone Systems Information Security
The data collected by cameras, connected sensors, and video management software can make a VMS an attractive target for malicious actors; therefore, being aware of the risks of an insecure video surveillance system and how to mitigate these are critical skills.

Surveillance and cybersecurity
Cathexis Technologies Information Security
Whether your business runs a security system with a handful of cameras or it is an enterprise company with thousands of cameras monitoring sites across a multinational organisation, you must pay attention to cybersecurity.

Cyber-armour for a healthcare industry under attack
NEC XON Information Security Healthcare (Industry)
Malicious actors have exploited compromised credentials, a clear and present danger when healthcare providers' reliance on remote access software allows adversaries to disguise themselves as legitimate users and gain unauthorised access to critical environments.

Cybersecurity and AI
AI & Data Analytics Information Security
Cybersecurity is one of the primary reasons that detecting the commonalities and threats of what is otherwise completely unknown is possible with tools such as SIEM and endpoint protection platforms.

What are MFA fatigue attacks, and how can they be prevented?
Information Security
Multifactor authentication is a security measure that requires users to provide a second form of verification before they can log into a corporate network. It has long been considered essential for keeping fraudsters out. However, cybercriminals have been discovering clever ways to bypass it.

SA's cybersecurity risks to watch
Information Security
The persistent myth is that cybercrime only targets the biggest companies and economies, but cybercriminals are not bound by geography, and rapidly digitising economies lure them in large numbers.

Cyber insurance a key component in cyber defence strategies
Information Security
[Sponsored] Cyber insurance has become a key part of South African organisations’ risk reduction strategies, driven by the need for additional financial protection and contingency plans in the event of a cyber incident.