Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
12/31/2012
04:52 PM
Dark Reading
Dark Reading
Security Insights
50%
50%

Advisory: As New Year Approaches, Android Malware Detection Growing

As 2012 comes to a close, cybercriminals are taking advantage of your Android app purchases with mobile malware. Be on high alert after you install new Android apps from third-party markets and Google's

As 2012 becomes 2013, there has been a lot going on for the holidays and upcoming New Year, both in and out of cyberspace. This type of hustle and bustle is the perfect opportunity for cybercriminals to take advantage of our hurried lives.

When you are preoccupied, your guard is down for malware authors to strike.

SophosLabs has been extra busy during the holidays, as well. While I don't work in SophosLabs, I do have limited insights to some of its activities. The Android platform is the primary focus for cybercriminals to deliver mobile malware to you via the third-party markets and even Google Play.

Apple released version 6.0.2 for iOS on Dec. 18, which only had a fix for a Wi-Fi bug. That got the Apple forums abuzz with several reports of reduced battery life. No security updates? I searched the CVE database and the last three reported vulnerabilities were patched in security update 6.0.1 on Nov. 1. Nice job, Apple!

In the context of mobile malware, does that make iOS a more secure platform than Android?

What Is Old Is New Again
There appears to be a recycling of some of the malware attacks used last year, mainly stealing data and opening backdoors. SophosLabs' detection of apps such as Andr/NewYearL-B (also known as CounterClank) over the past couple of weeks has spiked. On Dec. 11, SophosLabs detected 3,687 instances of NewYearL-B malware/Potentially Unwanted Application (PUA) over a six-month period with daily updates to the report. Over the next 20 days, Andr/NewYearL-B has been detected a total of 7,158 instances in the same report. That's a 94.14 percent increase.

Compare that to the next most active malware, Andr/BatteryD-A, in the same period with 966 detected instances. That is a 641 percent difference.

Android Malware Comparison chart

Looking at other Android malware, Andr/Boxer-A and Andr/Gmaster-A, compared to Andr/BatteryD-A, appears to be a competition of who can successfully deliver the most mobile malware.

Looking at the graphic below, earlier in December Andr/BatteryD-A (476 detections) doesn't have nearly as much success as its closest competitors. Just before the Christmas holiday, Andr/BatteryD-A starts to pick up momentum with 648 detections.

Android Malware Detections chart

How To Protect Yourself And Your Users
As the mobile malware detection market matures, you still need to rely on your own gut feel. If it doesn't feel right, it isn't.

First off, before downloading anything, read the reviews and check the reputation of the app in the Google Play marketplace.

Next, avoid third-party markets.

Third, don't root your device unless you really know what the hell you are doing.

Last, use a mobile security solution to scan your device and its apps. There are some very good, free Android Mobile Security apps available at Google Play store. You just need to see for yourself.

Let's all put some protection on our Android smart devices and ring in the new year without any malware.

No security, no privacy. Know security, know privacy.

David Schwartzberg is a Senior Security Engineer at Sophos, where he specializes in latest trends in malware, web threats, endpoint and data protection, mobile security, cloud and network security. He is a regular speaker at security conferences and serves as a guest blogger for the award winning Naked Security blog. David talks regularly with technology executives and professionals to help protect their organizations against the latest security threats. Follow him on Twitter @DSchwartzberg

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2382
Published: 2014-11-20
The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations, related to the IofCallDriver function.

CVE-2014-3625
Published: 2014-11-20
Directory traversal vulnerability in Pivitol Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVE-2014-7194
Published: 2014-11-20
TIBCO Managed File Transfer Internet Server before 7.2.4, Managed File Transfer Command Center before 7.2.4, Slingshot before 1.9.3, and Vault before 1.1.1 allow remote attackers to obtain sensitive information or modify data by leveraging agent access.

CVE-2014-7195
Published: 2014-11-20
Spotfire Web Player Engine in TIBCO Spotfire Web Player 6.0.x before 6.0.2 and 6.5.x before 6.5.2, Spotfire Deployment Kit 6.0.x before 6.0.2 and 6.5.x before 6.5.2, and Silver Fabric Enabler for Spotfire Web Player before 1.6.1 allows remote authenticated users to obtain sensitive information via u...

CVE-2014-8000
Published: 2014-11-20
Cisco Unified Communications Manager IM and Presence Service 9.1(1) produces different returned messages for URL requests depending on whether a username exists, which allows remote attackers to enumerate user accounts via a series of requests, aka Bug ID CSCur63497.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?