According to IDC’s quarterly report for Q3 2014, sales of mobile devices, (smart-phones and tablets) exceeded 327,000,000. There is currently something over 3 billion internet users with almost 6 billion internet devices live. The shift to mobile is pervasive and we should not be surprised to see cyber criminality follow the rush to mobile.
Android Devices Predominate
At the end of Q2 2014, almost 85% of those mobile smart devices, were android devices, less than 12% are IOS devices. Surprise, surprise, the criminality has focused upon Android devices.
Kaspersky labs, one of the leading cyber security intelligence practices, reports that in the first half of 2014 more than 175,000 new malicious programmes targeting mobile devices were detected and of those 98% targeted Android.
So what has Android done to deserve this attention? Well nothing except be successful and power great devices that contribute to people’s lives. Simply, the first issue is the scale of the installed base is enormous the bad guys are going to get more penetration for the buck than focusing say on iOS.
Secondly, with the significant take-up of mobile payments, this scale of user base represents a significant opportunity for (relatively) easy monetisation of criminality against (usually) unprepared consumer-users.
Third, Apps can be installed through Google Play as well as 3rd parties like Amazon App Store. Users who have enabled the installation of apps from unverified sources open themselves up to REAL vulnerabilities – Yes YOU!
What Criminals Are After
An attacker can gain access to personal data such as the user’s cloud photo storage accounts and associated email credentials exposing that cloud stored data but you’d most likely never know. Smartphones routinely collect a lot of varied personal information about their users and this data bank is a very valuable target for the criminals.
Forget the lone hacker view of cyber crime. The criminality is not random; instead it is institutionalised.
- The infector’s job is to catch you out en-masse, exploit your devices, and capture data – the more of each the better.
- The analysts study and process the data. They use the same sophisticated big data analytics businesses do and figure the most effective mechanism to monetise the exploit – so they can sell it on underground markets, blackmail individuals, use the information to manipulate market.
- The investors provide seed funding and provide funding throughout the pyramid and take the majority profits through the lifecycle.
Personal devices are as rich source of personal data as desk top computer used to be and much more available and often less secure. As a consequence, infectors have followed the crowd to mobile and they have taken sophisticated technology with them.
Mobile banking trojans (like Citadel Mobile – CITMO) that use malicious SMS as part of the attack as a router to malicious affiliated programs (oops too much detail) were the most widespread malicious programs identified (57%) and these are after your money. There were almost 14 times as many new mobile banking Trojans or modified Trojans in July 2014 compared with August 2013, rising from 423 types to 5,967 types in June of this year – that’s a lot of new products coming to market in 10 months!
The way these work is that you’ll get a VISHING (Voicemail phishing) message, maybe it’s
“Our records show you were in a no fault accident”
inviting you to contact a given number. Or maybe it’ll be a smishing message (SMS phishing) that says something like,
“Our records show you are due £3,549 in compensation for PPI miss-selling, click the link below”
or at the relevant time, perhaps it’ll be,
“There is £4,300 lodged in our bank account for your tax rebate, click on the link below to activate the release to your account.”
This is sophisticated, targeted, imaginative and believable stuff.
What Should You Do?
Not a lot that you don’t already know but most of you don’t do:
- Protect your Android devices with secure passwords
- Don’t unblock the option that allows you to download 3rd party apps from unverified sources. If you do have to download such an App, re-set the switch to block afterwards
- Use a mobile anti-virus software including the facility to scan files as they download to your device
- If you do banking transactions, consider using a dumb brick phone to receive your one-time-only transaction code so that sniffer apps can’t intercept the code and use your smart phone credentials to steal your money
- Be aware that phishing attacks are very common onto your smart phones and tablets with added threats from VISHING (voice mail phishing), SMISHING, (SMS phishing)