Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
12/31/2012
04:52 PM
Dark Reading
Dark Reading
Security Insights
Connect Directly
RSS
E-Mail
50%
50%

Advisory: As New Year Approaches, Android Malware Detection Growing

As 2012 comes to a close, cybercriminals are taking advantage of your Android app purchases with mobile malware. Be on high alert after you install new Android apps from third-party markets and Google's

As 2012 becomes 2013, there has been a lot going on for the holidays and upcoming New Year, both in and out of cyberspace. This type of hustle and bustle is the perfect opportunity for cybercriminals to take advantage of our hurried lives.

When you are preoccupied, your guard is down for malware authors to strike.

SophosLabs has been extra busy during the holidays, as well. While I don't work in SophosLabs, I do have limited insights to some of its activities. The Android platform is the primary focus for cybercriminals to deliver mobile malware to you via the third-party markets and even Google Play.

Apple released version 6.0.2 for iOS on Dec. 18, which only had a fix for a Wi-Fi bug. That got the Apple forums abuzz with several reports of reduced battery life. No security updates? I searched the CVE database and the last three reported vulnerabilities were patched in security update 6.0.1 on Nov. 1. Nice job, Apple!

In the context of mobile malware, does that make iOS a more secure platform than Android?

What Is Old Is New Again
There appears to be a recycling of some of the malware attacks used last year, mainly stealing data and opening backdoors. SophosLabs' detection of apps such as Andr/NewYearL-B (also known as CounterClank) over the past couple of weeks has spiked. On Dec. 11, SophosLabs detected 3,687 instances of NewYearL-B malware/Potentially Unwanted Application (PUA) over a six-month period with daily updates to the report. Over the next 20 days, Andr/NewYearL-B has been detected a total of 7,158 instances in the same report. That's a 94.14 percent increase.

Compare that to the next most active malware, Andr/BatteryD-A, in the same period with 966 detected instances. That is a 641 percent difference.

Android Malware Comparison chart

Looking at other Android malware, Andr/Boxer-A and Andr/Gmaster-A, compared to Andr/BatteryD-A, appears to be a competition of who can successfully deliver the most mobile malware.

Looking at the graphic below, earlier in December Andr/BatteryD-A (476 detections) doesn't have nearly as much success as its closest competitors. Just before the Christmas holiday, Andr/BatteryD-A starts to pick up momentum with 648 detections.

Android Malware Detections chart

How To Protect Yourself And Your Users
As the mobile malware detection market matures, you still need to rely on your own gut feel. If it doesn't feel right, it isn't.

First off, before downloading anything, read the reviews and check the reputation of the app in the Google Play marketplace.

Next, avoid third-party markets.

Third, don't root your device unless you really know what the hell you are doing.

Last, use a mobile security solution to scan your device and its apps. There are some very good, free Android Mobile Security apps available at Google Play store. You just need to see for yourself.

Let's all put some protection on our Android smart devices and ring in the new year without any malware.

No security, no privacy. Know security, know privacy.

David Schwartzberg is a Senior Security Engineer at Sophos, where he specializes in latest trends in malware, web threats, endpoint and data protection, mobile security, cloud and network security. He is a regular speaker at security conferences and serves as a guest blogger for the award winning Naked Security blog. David talks regularly with technology executives and professionals to help protect their organizations against the latest security threats. Follow him on Twitter @DSchwartzberg

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0640
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote authenticated users to bypass intended restrictions on resource access via unspecified vectors.

CVE-2014-0641
Published: 2014-08-20
Cross-site request forgery (CSRF) vulnerability in EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to hijack the authentication of arbitrary users.

CVE-2014-2505
Published: 2014-08-20
EMC RSA Archer GRC Platform 5.x before 5.5 SP1 allows remote attackers to trigger the download of arbitrary code, and consequently change the product's functionality, via unspecified vectors.

CVE-2014-2511
Published: 2014-08-20
Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum WebTop before 6.7 SP1 P28 and 6.7 SP2 before P14 allow remote attackers to inject arbitrary web script or HTML via the (1) startat or (2) entryId parameter.

CVE-2014-2515
Published: 2014-08-20
EMC Documentum D2 3.1 before P24, 3.1SP1 before P02, 4.0 before P11, 4.1 before P16, and 4.2 before P05 does not properly restrict tickets provided by D2GetAdminTicketMethod and D2RefreshCacheMethod, which allows remote authenticated users to gain privileges via a request for a superuser ticket.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.