Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

Attacks on Android Soared 40% in Q2

Despite a rise in attacks, the average number of malicious variants remains surprisingly limited, according to a report from Avast.

Cyberattacks on Android devices jumped 40% year-over-year in the second quarter fueled by cybercriminals capitalizing on increasing popularity of mobile banking.

"We are seeing a shift from PCs to mobile devices and people are using their smartphones as wallets," says Filip Chytry, director of threat intelligence at Avast. "This exponential growth in mobile attacks has been going on since 2010 or 2011 and I would expect it to continue to grow by 40% for the next several years."

During the second quarter, attacks on Android devices grew to 1.7 million per month, up from 1.2 million per month, Avast's research shows.

Patrick Hevesi, Gartner's research director of security and risk management, says he does not doubt attacks on mobile devices are rising, but he also notes it may be partially due to more companies deploying agents on their devices that can flag malicious activity.

Shift in Attacks

Rooters - malware that gives attackers root access on an Android device to spy on its users or steal their information - accounted for 22.8% of the mobile attacks Avast logged in during the second quarter. During that period, the notorious Pegasus emerged on Android.

Downloaders, which Avast characterizes as downloaded malicious apps planted on a device following a phishing attack, represented 22.8% of Android attacks in the quarter.

Although rooters and downloaders were the two most prevalent forms of cybersecurity threats in the quarter, fake apps held the number three spot at around 7% of mobile attacks, according to the report.

That's a marked shift from the 2014-2015 period when fake apps held the number one slot and accounted for 25% to 35% of mobile threats, Chytry says.

The popularity of fake apps among cybercriminals has waned as developers increasingly become more security-conscious and encrypt their source code, Chytry says. As a result, it makes it more difficult for hackers to recreate a bogus and malicious version of an app.

"Most of the companies we talk to say Trojans were the largest problem last year. Google says 54.2% of all malware were Trojans in Google Play last year and it was 77.8% for third-party stores," Gartner's Hevesi says. "But beginning in the third quarter last year, we started to see a shift."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Malicious apps are making their way into Google Play and Apple's App Store by disguising themselves as a legitimate app and keeping their exploit well-hidden until a month or two have passed, Hevesi says. That gives the app more time to gain traction among users and increase its scope of potential downloads. After time has passed, the exploit is unleashed onto the user's device.

For Avast's Chytry, the most surprising aspect of the data Avast collected in its report is that only 788 virus variations on average emerged each month during the second quarter.

"There were not a lot of variants, yet a lot of people got attacked. That tells me the attackers are well-organized because they are reusing and sharing code," Chytry says. "I would have expected 10,000 to 20,000 variants for the 1.7 million attacks."

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
NSA Appoints Rob Joyce as Cyber Director
Dark Reading Staff 1/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Hunny, I looked every where for the dorritos. 
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8567
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver Vault Plugin prior to v0.0.6, Azure Plugin prior to v0.0.10, and GCP Plugin prior to v0.2.0 allow an attacker who can create specially-crafted SecretProviderClass objects to write to arbitrary file paths on the host filesystem, including /var/lib/kubelet/pods.
CVE-2020-8568
PUBLISHED: 2021-01-21
Kubernetes Secrets Store CSI Driver versions v0.0.15 and v0.0.16 allow an attacker who can modify a SecretProviderClassPodStatus/Status resource the ability to write content to the host filesystem and sync file contents to Kubernetes Secrets. This includes paths under var/lib/kubelet/pods that conta...
CVE-2020-8569
PUBLISHED: 2021-01-21
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, ...
CVE-2020-8570
PUBLISHED: 2021-01-21
Kubernetes Java client libraries in version 10.0.0 and versions prior to 9.0.1 allow writes to paths outside of the current directory when copying multiple files from a remote pod which sends a maliciously crafted archive. This can potentially overwrite any files on the system of the process executi...
CVE-2020-8554
PUBLISHED: 2021-01-21
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typicall...