Mobile

5/30/2018
10:20 AM
50%
50%

Mobile Malware Moves to Mine Monero (and Other Currencies)

A new report shows that cryptocurrencies tend to be the focus of a growing number of malicious apps.

Cryptocurrencies are good news for bad guys. That's a key finding of a new report on mobile threats from the first quarter of 2018. In another major finding, nation-state threat actors seem here to stay, and they have a growing love for mobile platforms.

The Mobile Threat Landscape Q1 2018 Report, sponsored by RiskIQ, analyzed 120 mobile app stores and billions of daily scanned resources for its data. And in spite of headlines, the overall news is promising, with a reduction in the total number of malicious apps found.

According to the report, malicious blacklisted apps are increasingly masquerading as cryptocurrency wallets, exchanges, or generic cryptocurrency applications. Once installed, these malicious apps will either begin working to steal legitimate cryptocoins from wallets, or begin mining cryptocurrency, frequently the highly anonymous Monero, using the device's compute resources.

The research also found that the vast majority — 86% — of malicious apps share the READ_SMS permission, which allows the app to read messages and can be used for functions like side-stepping two-factor authentication. Other commonly shared permissions include access to cameras, microphones, and location information.

For more, read here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2018 | 9:28:34 AM
Buyer Beware
The only protection here is research. These pieces of malware are very pervasive and easy to download if you do not perform due diligence on the provider.
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Understanding Evil Twin AP Attacks and How to Prevent Them
Ryan Orsi, Director of Product Management for Wi-Fi at WatchGuard Technologies,  11/14/2018
7 Free (or Cheap) Ways to Increase Your Cybersecurity Knowledge
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/15/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Online Malware and Threats: A Profile of Today's Security Posture
Online Malware and Threats: A Profile of Today's Security Posture
This report offers insight on how security professionals plan to invest in cybersecurity, and how they are prioritizing their resources. Find out what your peers have planned today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2008-7320
PUBLISHED: 2018-11-18
** DISPUTED ** GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision.
CVE-2018-19358
PUBLISHED: 2018-11-18
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig...
CVE-2018-19351
PUBLISHED: 2018-11-18
Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHand...
CVE-2018-19352
PUBLISHED: 2018-11-18
Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.
CVE-2018-19353
PUBLISHED: 2018-11-18
The ansilove_ansi function in loaders/ansi.c in libansilove 1.0.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted file.