Risk
12/29/2009
01:21 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Mobile Botnets: A New Frontline

There has been a recent rash of worms and malware targeting (jailbroken) iPhones. A group of researchers from SRI International published a study of an Apple iPhone bot client, captured just before Thanksgiving.

There has been a recent rash of worms and malware targeting (jailbroken) iPhones. A group of researchers from SRI International published a study of an Apple iPhone bot client, captured just before Thanksgiving.In case you missed it, last month the iKee bot targeted jailbroken iphones. According to this report, An Analysis of the iKee.B (Duh) iphone Botnet, by researchers Phillip Porras, Hassen Saidi, and Vinod Yegneswaran, malware aimed at smartphones is maturing rapidly.

From the report:

Nearly two weeks after the iKee.A incident, on 18 November, a new and more malicious iPhone malware was spotted by XS4ALL across parts of Europe [0]. This new malware, named iKee.B, or duh (the name of the bot's primary binary), was based on a nearly identical design of the iKee.A worm. However, unlike iKee.A, this new malware includes command and control (C&C) logic to render all infected iPhones under the control of a bot master. This latest Phone malware, though limited in its current growth potential, offers some insights into what one day may become a widespread threat, as Internet-tethered smartphones become more ubiquitously available.

For the first time, I think mobile malware is on the verge of becoming a viable threat. By that, I mean a mechanism to steal data and online logon credentials. It's an area I've been watching for a long time, but until very recently the smart phones were neither always connected to the Internet, nor as powerful as they are now. As the iKee series of malware shows, another platform for distributed denial-of-service, phishing, and other forms of attacks.

Consider the capabilities that have surfaced in the iKee series in just a matter of weeks:

Perhaps the most immediate observation regarding the iKee.B botnet is that it has a very simple yet flexible code base, which given its target platform makes tremendous sense. While its code base is small, all the key functionality that we have grown to expect of PC botnets is also present in iKee.B: it can self-propagate, it carries a malicious payload (data exfiltration), and it periodically probes its C&C for new control instructions. iKee.B's C&C protocol is simply a periodic curl fetch from a small iPhone app, allowing the bot master to reprogram bot clients at will. As with all Internet-based botnets, iKee.B clients take full advantage of the Internet to find new victims, coordinate with their C&C, fetch new program logic, and to exfiltrate whatever content they find within their hosts.

If trends in malware operations are your thing, this new research from SRI International is worth a read. You'll see that smartphones - not just jailbroken iPhones - but all smartphone platforms will be significantly targeted in the years ahead.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.