Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

Attacks on Android Soared 40% in Q2

Despite a rise in attacks, the average number of malicious variants remains surprisingly limited, according to a report from Avast.

Cyberattacks on Android devices jumped 40% year-over-year in the second quarter fueled by cybercriminals capitalizing on increasing popularity of mobile banking.

"We are seeing a shift from PCs to mobile devices and people are using their smartphones as wallets," says Filip Chytry, director of threat intelligence at Avast. "This exponential growth in mobile attacks has been going on since 2010 or 2011 and I would expect it to continue to grow by 40% for the next several years."

During the second quarter, attacks on Android devices grew to 1.7 million per month, up from 1.2 million per month, Avast's research shows.

Patrick Hevesi, Gartner's research director of security and risk management, says he does not doubt attacks on mobile devices are rising, but he also notes it may be partially due to more companies deploying agents on their devices that can flag malicious activity.

Shift in Attacks

Rooters - malware that gives attackers root access on an Android device to spy on its users or steal their information - accounted for 22.8% of the mobile attacks Avast logged in during the second quarter. During that period, the notorious Pegasus emerged on Android.

Downloaders, which Avast characterizes as downloaded malicious apps planted on a device following a phishing attack, represented 22.8% of Android attacks in the quarter.

Although rooters and downloaders were the two most prevalent forms of cybersecurity threats in the quarter, fake apps held the number three spot at around 7% of mobile attacks, according to the report.

That's a marked shift from the 2014-2015 period when fake apps held the number one slot and accounted for 25% to 35% of mobile threats, Chytry says.

The popularity of fake apps among cybercriminals has waned as developers increasingly become more security-conscious and encrypt their source code, Chytry says. As a result, it makes it more difficult for hackers to recreate a bogus and malicious version of an app.

"Most of the companies we talk to say Trojans were the largest problem last year. Google says 54.2% of all malware were Trojans in Google Play last year and it was 77.8% for third-party stores," Gartner's Hevesi says. "But beginning in the third quarter last year, we started to see a shift."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Malicious apps are making their way into Google Play and Apple's App Store by disguising themselves as a legitimate app and keeping their exploit well-hidden until a month or two have passed, Hevesi says. That gives the app more time to gain traction among users and increase its scope of potential downloads. After time has passed, the exploit is unleashed onto the user's device.

For Avast's Chytry, the most surprising aspect of the data Avast collected in its report is that only 788 virus variations on average emerged each month during the second quarter.

"There were not a lot of variants, yet a lot of people got attacked. That tells me the attackers are well-organized because they are reusing and sharing code," Chytry says. "I would have expected 10,000 to 20,000 variants for the 1.7 million attacks."

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Greater Focus on Privacy Pays Off for Firms
Robert Lemos, Contributing Writer,  1/27/2020
Average Ransomware Payments More Than Doubled in Q4 2019
Jai Vijayan, Contributing Writer,  1/27/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Physical Security Privilege Escalation
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3215
PUBLISHED: 2020-01-29
vtiger CRM 5.4.0 and earlier contain an Authentication Bypass Vulnerability due to improper authentication validation in the validateSession function.
CVE-2019-18634
PUBLISHED: 2020-01-29
In Sudo through 1.8.29, if pwfeedback is enabled in /etc/sudoers, users can trigger a stack-based buffer overflow in the privileged sudo process. (pwfeedback is a default setting in Linux Mint and elementary OS; however, it is NOT the default for upstream and many other packages, and would exist onl...
CVE-2013-2568
PUBLISHED: 2020-01-29
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user execute arbitrary code.
CVE-2013-2569
PUBLISHED: 2020-01-29
A Security Bypass vulnerability exists in Zavio IP Cameras through 1.6.3 because the RTSP protocol authentication is disabled by default, which could let a malicious user obtain unauthorized access to the live video stream.
CVE-2013-2570
PUBLISHED: 2020-01-29
A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 in the General.Time.NTP.Server parameter to the sub_C8C8 function of the binary /opt/cgi/view/param, which could let a remove malicious user execute arbitrary code.