Application Security

Attacks on Android Soared 40% in Q2

Despite a rise in attacks, the average number of malicious variants remains surprisingly limited, according to a report from Avast.

Cyberattacks on Android devices jumped 40% year-over-year in the second quarter fueled by cybercriminals capitalizing on increasing popularity of mobile banking.

"We are seeing a shift from PCs to mobile devices and people are using their smartphones as wallets," says Filip Chytry, director of threat intelligence at Avast. "This exponential growth in mobile attacks has been going on since 2010 or 2011 and I would expect it to continue to grow by 40% for the next several years."

During the second quarter, attacks on Android devices grew to 1.7 million per month, up from 1.2 million per month, Avast's research shows.

Patrick Hevesi, Gartner's research director of security and risk management, says he does not doubt attacks on mobile devices are rising, but he also notes it may be partially due to more companies deploying agents on their devices that can flag malicious activity.

Shift in Attacks

Rooters - malware that gives attackers root access on an Android device to spy on its users or steal their information - accounted for 22.8% of the mobile attacks Avast logged in during the second quarter. During that period, the notorious Pegasus emerged on Android.

Downloaders, which Avast characterizes as downloaded malicious apps planted on a device following a phishing attack, represented 22.8% of Android attacks in the quarter.

Although rooters and downloaders were the two most prevalent forms of cybersecurity threats in the quarter, fake apps held the number three spot at around 7% of mobile attacks, according to the report.

That's a marked shift from the 2014-2015 period when fake apps held the number one slot and accounted for 25% to 35% of mobile threats, Chytry says.

The popularity of fake apps among cybercriminals has waned as developers increasingly become more security-conscious and encrypt their source code, Chytry says. As a result, it makes it more difficult for hackers to recreate a bogus and malicious version of an app.

"Most of the companies we talk to say Trojans were the largest problem last year. Google says 54.2% of all malware were Trojans in Google Play last year and it was 77.8% for third-party stores," Gartner's Hevesi says. "But beginning in the third quarter last year, we started to see a shift."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Malicious apps are making their way into Google Play and Apple's App Store by disguising themselves as a legitimate app and keeping their exploit well-hidden until a month or two have passed, Hevesi says. That gives the app more time to gain traction among users and increase its scope of potential downloads. After time has passed, the exploit is unleashed onto the user's device.

For Avast's Chytry, the most surprising aspect of the data Avast collected in its report is that only 788 virus variations on average emerged each month during the second quarter.

"There were not a lot of variants, yet a lot of people got attacked. That tells me the attackers are well-organized because they are reusing and sharing code," Chytry says. "I would have expected 10,000 to 20,000 variants for the 1.7 million attacks."

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
How the US Chooses Which Zero-Day Vulnerabilities to Stockpile
Ricardo Arroyo, Senior Technical Product Manager, Watchguard Technologies,  1/16/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He just showed up at my doorstep one day without a geotag."
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3906
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.
CVE-2019-3907
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
CVE-2019-3908
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
CVE-2019-3909
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3910
PUBLISHED: 2019-01-18
Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.