Mobile

5/30/2018
10:20 AM
50%
50%

Mobile Malware Moves to Mine Monero (and Other Currencies)

A new report shows that cryptocurrencies tend to be the focus of a growing number of malicious apps.

Cryptocurrencies are good news for bad guys. That's a key finding of a new report on mobile threats from the first quarter of 2018. In another major finding, nation-state threat actors seem here to stay, and they have a growing love for mobile platforms.

The Mobile Threat Landscape Q1 2018 Report, sponsored by RiskIQ, analyzed 120 mobile app stores and billions of daily scanned resources for its data. And in spite of headlines, the overall news is promising, with a reduction in the total number of malicious apps found.

According to the report, malicious blacklisted apps are increasingly masquerading as cryptocurrency wallets, exchanges, or generic cryptocurrency applications. Once installed, these malicious apps will either begin working to steal legitimate cryptocoins from wallets, or begin mining cryptocurrency, frequently the highly anonymous Monero, using the device's compute resources.

The research also found that the vast majority — 86% — of malicious apps share the READ_SMS permission, which allows the app to read messages and can be used for functions like side-stepping two-factor authentication. Other commonly shared permissions include access to cameras, microphones, and location information.

For more, read here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
5/31/2018 | 9:28:34 AM
Buyer Beware
The only protection here is research. These pieces of malware are very pervasive and easy to download if you do not perform due diligence on the provider.
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12557
PUBLISHED: 2018-06-19
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could ...
CVE-2018-12559
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequ...
CVE-2018-12560
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.
CVE-2018-12561
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
CVE-2018-12562
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).