Vulnerabilities / Threats
5/14/2013
02:48 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

F-Secure: Android Malware Ecosystem Resembling Windows

F-Secure Labs’ latest Mobile Threat Report records a list of firsts for Android malware, including the first non-app-related distribution, while the overall number of threats continue to rise

SAN JOSE, Calif. – May 14, 2013: The first quarter of 2013 was marked by firsts for Android malware that add complexity to the Android threat landscape. According to F-Secure Labs' latest Mobile Threat Report, Q1 saw the first Android threat distribution outside of apps via email spam, the first targeted Android attacks, and the first Android advanced fee fraud scam. Additionally, examples of increased commoditization of Android malware surfaced.

The number of new mobile threat families and variants continued to rise by 49% from the previous quarter, from 100 to 149. 136, or 91.3 percent of these were Android and 13, or 8.7 percent Symbian. Q1 2013 numbers are more than double that of a year ago in Q1 2012, when 61 new families and variants were discovered.

The new Android techniques are a cause for concern, said Sean Sullivan, Security Advisor at F-Secure Labs. "I'll put it this way: Until now, I haven't worried about my mother with her Android because she's not into apps. Now I have reason to worry because with cases like Stels, Android malware is also being distributed via spam, and my mother checks her email from her phone."

The Android trojan known as Stels began distributing via fake U.S. Internal Revenue Service-themed emails, using an Android crimeware kit to steal sensitive information from the device, and monetizing by making calls to premium numbers. This example of mobile malware commoditization "could be a game changer," according to Sullivan.

Q1 also saw the first targeted attacks in the mobile space. Tibetan human rights activists were targeted with emails that contained an Android-malware-infected attachment, and a so-called "coupon app" for a popular coffee chain steals information from phones with South Korean country codes.

Mobile is being targeted in India, as the discovery of the first Android advanced fee fraud proved. A fake "job offer" Android app in India informs that the user is being considered for a position at TATA Group, an Indian multinational company. To arrange the interview, the app asks for a refundable security deposit.

For more details on the latest mobile threats, including adware, commoditization via Perkele, and more, see the complete Mobile Threat Report Q1 2013 at http://www.f-secure.com/en/web/labs_global/whitepapers/reports.

F-Secure provides the best protection in the world for Android smartphones and tablets, effectively protecting devices from all common threats. Get F-Secure Mobile Security free for 30 days at www.f-secure.com or Google Play: http://play.google.com/store/apps/details?id=com.fsecure.ms.dc.

F-Secure Labs focuses on counting the numbers of families and variants of malware rather than the number of unique samples. To attempt to avoid detection of their malware, cybercriminals use automation that makes slight changes to malware code – resulting in new malware samples, while still being the same malware family or variant. Counting families and variants rather than samples provides a more realistic measurement of threats.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.