GIVEN all the talk about mobile malware—Trojans, viruses, keyloggers, phishing expeditions and other scams infecting the phones in people’s pockets—users might be forgiven for thinking cybercrooks are cleaning up at their expense. Truth is, surprisingly few bits of malware have found their way into mobile phones. More by accident than design, smartphones have turned out to be much tougher to infect than laptops and desktop PCs. At least, that is the case at present.
Makers of security software would like mobile-phone users to think otherwise. Everywhere Babbage turns these days there is yet another white paper on the threat of mobile malware. Adverts, too—online and in print—warn increasingly of the dangers of texting and talking, searching and surfing without some from of protection against malicious software. Individuals should take note, but the warnings are aimed primarily at IT professionals in firms where employees are allowed to use their own phones and tablets to connect to company networks.
Certainly, the BYOD (bring your own device) trend has created security headaches for network managers. It may be one thing for individuals to discover some malicious app they have unwittingly downloaded has racked up large telephone bills by spewing out text messages to pricey pay-to-use services. It is quite another for IT managers to learn that company secrets—contact lists, passwords, authentication keys, business plans and confidential memoranda—have been leaking out via employees’ phones to competitors or criminals. While individuals may be hundreds of dollars out of pocket, companies could be on the hook for millions.
Mobile malware is still very much in its infancy. Adrian Ludwig, Google’s top security engineer, reckons only one in 100,000 apps downloaded by Android users from all sources, legitimate or otherwise, pose any threat. Researchers at Georgia Institute of Technology and Damballa, a security firm based in Atlanta, agree.
After surveying two networks with some 380m users between them, the Georgia researchers found fewer than 3,500 phones with signs of having been infected by malware—ie, one in 108,000. Given that there are around 1.5 billion smartphones and tablets in the world (about the same number as there are desktop and laptop computers), probably fewer than 15,000 mobile devices are harbouring mischievous software of some sort.
That is nowhere near enough to attract the attention of criminals. The black-hat botnets they rent by the day, week or month to carry out their nefarious bidding comprise hundreds of thousands of zombie computers that have been infected and hijacked unbeknown to their owners. Such computers present a far easier target for cybercrooks—whether to coral into botnets, or exploit directly for criminal purposes.
There are good reasons why smartphones have proved tougher nuts to crack than computers. First, mobile-phone users are rarely administrators by default—unlike, say, users of Windows XP computers, where everyone has administrative privileges unless they have taken the trouble to set up individual user-accounts with separate passwords. The danger, of course, is that administrators (or super-users in Linux-speak) can tinker with the settings of a device’s operating system to their heart’s content.
It is possible, of course, to grant such rights to phone users—through jailbreaking an Apple device or rooting and sideloading an Android. Doing so, however, not only voids the maker’s warranty, but can also “brick” the device—turning it into an expensive paperweight.
Even so, there are always folk willing to take the risk, to add functions and features to their phones that are not normally available. But doing so exposes them to vulnerabilities which can be readily exploited. One of the more common tricks hackers use is to inject a “secure-shell daemon” into a device by embedding it in an e-mail message or a website offering free downloads. Tools like secure shells allow malware to spread quickly across networks, while setting up “packet forwarding” routines to establish bridges between company networks and unauthorised servers elsewhere.
Fortunately, with jailbreakers and rooters occupying such a tiny corner of the mobile-phone universe, cybercriminals tend not to waste time trying to rip them off. Mainstream computer users make easier and more lucrative targets.
Another reason why mobile phones have so far remained largely free of malware is because they lead such sheltered lives. Most users download any apps they want (the average is around 40) from one or other of the two official locations: Google’s Play Store for Android devices, and Apple’s App Store for iPhones and iPads. Both are reasonably well policed. Despite its laissez-faire reputation, Google’s marketplace for apps is curated far better than third-party sites, though nowhere near as rigorously as Apple’s.
With 1m apps available for the Android operating system and over 750,000 for Apple’s iOS, users have little need to venture outside their walled gardens. The small minority who visit dubious download sites have only themselves to blame if their phones become infected. Third-party app stores, especially for Android devices, tend to be dens of iniquity. Most offer free apps for downloading pornography or pirate copies of sought-after music, video and utilities as honeypots for the gullible. As a rule, expect anything downloaded from third-party sites to come with some form of malware embedded in it.
At its least damaging, such downloads may be no more than nuisanceware—software that causes adverts to pop up, unnecessary toolbars to be added to browsers, and home pages diverted to inappropriate sites. Other times, it is just scareware—software that offers to scan the user’s device for viruses and the like, and then requires payment for the full version of the software needed to fix the problem, which probably did not exist in the first place.
At its most toxic, by contrast, mobile malware can collect personal data and contact lists, monitor keystrokes, track the phone’s location, even take photographs or video of users and their surroundings. It will then transmit the proceeds back to servers run by organised crime for extortion, identity theft, scams or phishing trips.
Because mobile phones, unlike laptops and desktops, are still not widely used for online banking or credit-card transactions, they tend to be of less interest to the cyberworld’s shady characters. However, that is changing.
Thanks to improvements in “near-field communication”, phones are beginning to morph into wallets—with all the necessary links to bank accounts and credit cards—so users can make incidental payments at stations, convenience stores and elsewhere merely by waving their phone near a terminal. Cybercrooks are, no doubt, watching such developments with interest.
Overall, though, it is business that tends to suffer most from follies users have with phones. And the biggest hazard of all is not mobile malware, but data leakage caused by employees losing their phones, or selling sensitive corporate information collected on their mobiles.
Gartner, an information-technology consultancy based in Stamford, Connecticut, counsels clients not to get too worked up about malware penetrating their networks through the personal devices employees bring to work. It is the users themselves who are the problem, not their mobile phones.
How, for instance, do companies prevent employees from responding to “spear-phishing attacks” in the form of highly personalised and legitimate-looking e-mail or text messages from seemingly reputable sources that seek clarification of various corporate details? Security measures need to focus more on changing social behaviour, rather than trying to solve the relatively minor problem of mobile malware.
As for Babbage, he has taken the precaution of activating the Google app on his Android phone and tablet that enables devices to be located, tracked, rung or wiped clean if lost or stolen. He also keeps their WiFi and GPS radios switched off until needed. That saves battery life, and adds an extra layer of protection.
He has also installed a popular security suite on both devices that blocks all known malicious software. He is aware that it is not the known threats that are the problem, but the unknown ones (ie, the “zero-day” attacks). Still, he sleeps easier with it there. The only other thing he does religiously is to steer clear of third-party download sites with offers that seem too good to be true. Invariably, they are.
Powered by Facebook Comments