Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
12/31/2012
04:52 PM
Dark Reading
Dark Reading
Security Insights
Connect Directly
RSS
E-Mail
50%
50%

Advisory: As New Year Approaches, Android Malware Detection Growing

As 2012 comes to a close, cybercriminals are taking advantage of your Android app purchases with mobile malware. Be on high alert after you install new Android apps from third-party markets and Google's

As 2012 becomes 2013, there has been a lot going on for the holidays and upcoming New Year, both in and out of cyberspace. This type of hustle and bustle is the perfect opportunity for cybercriminals to take advantage of our hurried lives.

When you are preoccupied, your guard is down for malware authors to strike.

SophosLabs has been extra busy during the holidays, as well. While I don't work in SophosLabs, I do have limited insights to some of its activities. The Android platform is the primary focus for cybercriminals to deliver mobile malware to you via the third-party markets and even Google Play.

Apple released version 6.0.2 for iOS on Dec. 18, which only had a fix for a Wi-Fi bug. That got the Apple forums abuzz with several reports of reduced battery life. No security updates? I searched the CVE database and the last three reported vulnerabilities were patched in security update 6.0.1 on Nov. 1. Nice job, Apple!

In the context of mobile malware, does that make iOS a more secure platform than Android?

What Is Old Is New Again
There appears to be a recycling of some of the malware attacks used last year, mainly stealing data and opening backdoors. SophosLabs' detection of apps such as Andr/NewYearL-B (also known as CounterClank) over the past couple of weeks has spiked. On Dec. 11, SophosLabs detected 3,687 instances of NewYearL-B malware/Potentially Unwanted Application (PUA) over a six-month period with daily updates to the report. Over the next 20 days, Andr/NewYearL-B has been detected a total of 7,158 instances in the same report. That's a 94.14 percent increase.

Compare that to the next most active malware, Andr/BatteryD-A, in the same period with 966 detected instances. That is a 641 percent difference.

Android Malware Comparison chart

Looking at other Android malware, Andr/Boxer-A and Andr/Gmaster-A, compared to Andr/BatteryD-A, appears to be a competition of who can successfully deliver the most mobile malware.

Looking at the graphic below, earlier in December Andr/BatteryD-A (476 detections) doesn't have nearly as much success as its closest competitors. Just before the Christmas holiday, Andr/BatteryD-A starts to pick up momentum with 648 detections.

Android Malware Detections chart

How To Protect Yourself And Your Users
As the mobile malware detection market matures, you still need to rely on your own gut feel. If it doesn't feel right, it isn't.

First off, before downloading anything, read the reviews and check the reputation of the app in the Google Play marketplace.

Next, avoid third-party markets.

Third, don't root your device unless you really know what the hell you are doing.

Last, use a mobile security solution to scan your device and its apps. There are some very good, free Android Mobile Security apps available at Google Play store. You just need to see for yourself.

Let's all put some protection on our Android smart devices and ring in the new year without any malware.

No security, no privacy. Know security, know privacy.

David Schwartzberg is a Senior Security Engineer at Sophos, where he specializes in latest trends in malware, web threats, endpoint and data protection, mobile security, cloud and network security. He is a regular speaker at security conferences and serves as a guest blogger for the award winning Naked Security blog. David talks regularly with technology executives and professionals to help protect their organizations against the latest security threats. Follow him on Twitter @DSchwartzberg

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2010-5110
Published: 2014-08-29
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVE-2012-1503
Published: 2014-08-29
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

CVE-2013-5467
Published: 2014-08-29
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM)...

CVE-2014-0600
Published: 2014-08-29
FileUploadServlet in the Administration service in Novell GroupWise 2014 before SP1 allows remote attackers to read or write to arbitrary files via the poLibMaintenanceFileSave parameter, aka ZDI-CAN-2287.

CVE-2014-0888
Published: 2014-08-29
IBM Worklight Foundation 5.x and 6.x before 6.2.0.0, as used in Worklight and Mobile Foundation, allows remote authenticated users to bypass the application-authenticity feature via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.