Vulnerabilities / Threats
1/31/2012
09:49 PM
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Jury Still Out On Mobile Adware

Malicious software or not? Defining the threat on mobile platforms becomes more difficult as some advertising software enters a gray area

On Friday, security firm Symantec warned that a baker's dozen of applications available through the Android Marketplace hosted a "bot-like threat" that could leak information.

With an estimated 1 million to 5 million installations, the threat -- dubbed Counterclank by Symantec -- would have been one of the largest outbreaks of mobile malware to date. Yet other security firms disagreed over the details: The affected programs incorporated third-party software that was not malicious but comprised "an aggressive form of ad network," concluded mobile security firm Lookout.

The incident highlights that uncertain gray areas continue to inhabit the space between what is definitely a legitimate mobile application and what is purely malicious.

"I think we are in a place where people are being very experimental, and people are coming up with new ideas for a new platform," says Tim Wyatt, a principal engineer at Lookout. "We will definitely see ideas that push the boundaries of what is acceptable and what is not."

The debate follows a similar trajectory as the concerns over spyware, adware, and unwanted programs that plagued PC users at the beginning of last decade. In the early 2000s, the infamous affiliate adware maker 180Solutions, later known as Zango, paid partners to install its software on systems, which they often did without the users' permission.

In a similar way, some mobile advertising platforms perform functions that users would likely not want, if they had a choice. Counterclank, which is actually the Apperhand software development kit, collects the international mobile equipment identifier (IMEI) and uses the push notification mechanism to send personalized ads to the user's device. Software using the development kit also leaves a search icon on a mobile device's desktop and can modify bookmarks.

The last capability is unacceptable behavior but not malicious, Lookout states in its analysis.

Other companies agree. Counterclank may not be malware, but its definitely unwanted, says Roel Schouwenberg, senior researcher with security firm Kaspersky. The company classifies the program, not as malicious, but as something that users would not want on their mobile device. Whether that determination stays constant is an open question, he says.

"It is definitely grayware," Schouwenberg says. "We haven't quite hashed out yet whether [programs using it] are malicious or not. We are currently detecting it, but I would not be surprised if somewhere down the line, we decide not to detect it or detect it in a different way."

On the Android platform, many security firms focus on the types and number of permissions requested by programs as an initial indicator that something may be amiss. However, permissions by themselves are not sufficient, says Schouwenberg.

"We see quite a lot of apps out there that ask for a ton of permissions," he says. "Developers are copy-pasting the permissions list off of a template, and going with it, when in reality, they will never use some of those permissions."

Yet, permissions that seem excessive -- such as GPS tracking, connecting to an Internet server and the ability to read data from the phone -- are actually necessary, argues some developers. Full-function advertising platforms need to assign a user a unique ID and offer other benefits to their clients, argues mobile advertising software maker Mobclix.

"GPS activation, Internet connectivity and read phone state, when accessed, are not signs you’ve accidentally put malware into your application," the company writes in a blog post. "They’re usually legitimately accessed – along with other data and functions we rarely think about."

As mobile application development -- and the business models that drive it -- matures, the gray area will shrink, says Schouwenberg. In addition, customer concerns will likely drive developers to focus on reducing the expansive permission sets that are currently the norm.

"Quick growth and security generally don't go hand in hand," he says. "When the rapid growth starts winding down a bit, that's when Google [and developers] will look and see what they can improve on."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-3946
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

CVE-2012-5723
Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

CVE-2013-6738
Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before 1.2.0.0-CSI-SCALA-IF0003 allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

CVE-2014-2391
Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

CVE-2014-2392
Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web