Risk
12/29/2009
01:21 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Mobile Botnets: A New Frontline

There has been a recent rash of worms and malware targeting (jailbroken) iPhones. A group of researchers from SRI International published a study of an Apple iPhone bot client, captured just before Thanksgiving.

There has been a recent rash of worms and malware targeting (jailbroken) iPhones. A group of researchers from SRI International published a study of an Apple iPhone bot client, captured just before Thanksgiving.In case you missed it, last month the iKee bot targeted jailbroken iphones. According to this report, An Analysis of the iKee.B (Duh) iphone Botnet, by researchers Phillip Porras, Hassen Saidi, and Vinod Yegneswaran, malware aimed at smartphones is maturing rapidly.

From the report:

Nearly two weeks after the iKee.A incident, on 18 November, a new and more malicious iPhone malware was spotted by XS4ALL across parts of Europe [0]. This new malware, named iKee.B, or duh (the name of the bot's primary binary), was based on a nearly identical design of the iKee.A worm. However, unlike iKee.A, this new malware includes command and control (C&C) logic to render all infected iPhones under the control of a bot master. This latest Phone malware, though limited in its current growth potential, offers some insights into what one day may become a widespread threat, as Internet-tethered smartphones become more ubiquitously available.

For the first time, I think mobile malware is on the verge of becoming a viable threat. By that, I mean a mechanism to steal data and online logon credentials. It's an area I've been watching for a long time, but until very recently the smart phones were neither always connected to the Internet, nor as powerful as they are now. As the iKee series of malware shows, another platform for distributed denial-of-service, phishing, and other forms of attacks.

Consider the capabilities that have surfaced in the iKee series in just a matter of weeks:

Perhaps the most immediate observation regarding the iKee.B botnet is that it has a very simple yet flexible code base, which given its target platform makes tremendous sense. While its code base is small, all the key functionality that we have grown to expect of PC botnets is also present in iKee.B: it can self-propagate, it carries a malicious payload (data exfiltration), and it periodically probes its C&C for new control instructions. iKee.B's C&C protocol is simply a periodic curl fetch from a small iPhone app, allowing the bot master to reprogram bot clients at will. As with all Internet-based botnets, iKee.B clients take full advantage of the Internet to find new victims, coordinate with their C&C, fetch new program logic, and to exfiltrate whatever content they find within their hosts.

If trends in malware operations are your thing, this new research from SRI International is worth a read. You'll see that smartphones - not just jailbroken iPhones - but all smartphone platforms will be significantly targeted in the years ahead.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Join Dark Reading community editor Marilyn Cohodas and her guest, David Shearer, (ISC)2 Chief Executive Officer, as they discuss issues that keep IT security professionals up at night, including results from the recent 2016 Black Hat Attendee Survey.