Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

Attacks on Android Soared 40% in Q2

Despite a rise in attacks, the average number of malicious variants remains surprisingly limited, according to a report from Avast.

Cyberattacks on Android devices jumped 40% year-over-year in the second quarter fueled by cybercriminals capitalizing on increasing popularity of mobile banking.

"We are seeing a shift from PCs to mobile devices and people are using their smartphones as wallets," says Filip Chytry, director of threat intelligence at Avast. "This exponential growth in mobile attacks has been going on since 2010 or 2011 and I would expect it to continue to grow by 40% for the next several years."

During the second quarter, attacks on Android devices grew to 1.7 million per month, up from 1.2 million per month, Avast's research shows.

Patrick Hevesi, Gartner's research director of security and risk management, says he does not doubt attacks on mobile devices are rising, but he also notes it may be partially due to more companies deploying agents on their devices that can flag malicious activity.

Shift in Attacks

Rooters - malware that gives attackers root access on an Android device to spy on its users or steal their information - accounted for 22.8% of the mobile attacks Avast logged in during the second quarter. During that period, the notorious Pegasus emerged on Android.

Downloaders, which Avast characterizes as downloaded malicious apps planted on a device following a phishing attack, represented 22.8% of Android attacks in the quarter.

Although rooters and downloaders were the two most prevalent forms of cybersecurity threats in the quarter, fake apps held the number three spot at around 7% of mobile attacks, according to the report.

That's a marked shift from the 2014-2015 period when fake apps held the number one slot and accounted for 25% to 35% of mobile threats, Chytry says.

The popularity of fake apps among cybercriminals has waned as developers increasingly become more security-conscious and encrypt their source code, Chytry says. As a result, it makes it more difficult for hackers to recreate a bogus and malicious version of an app.

"Most of the companies we talk to say Trojans were the largest problem last year. Google says 54.2% of all malware were Trojans in Google Play last year and it was 77.8% for third-party stores," Gartner's Hevesi says. "But beginning in the third quarter last year, we started to see a shift."

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Malicious apps are making their way into Google Play and Apple's App Store by disguising themselves as a legitimate app and keeping their exploit well-hidden until a month or two have passed, Hevesi says. That gives the app more time to gain traction among users and increase its scope of potential downloads. After time has passed, the exploit is unleashed onto the user's device.

For Avast's Chytry, the most surprising aspect of the data Avast collected in its report is that only 788 virus variations on average emerged each month during the second quarter.

"There were not a lot of variants, yet a lot of people got attacked. That tells me the attackers are well-organized because they are reusing and sharing code," Chytry says. "I would have expected 10,000 to 20,000 variants for the 1.7 million attacks."

Related Content:

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/3/2020
'BootHole' Vulnerability Exposes Secure Boot Devices to Attack
Kelly Sheridan, Staff Editor, Dark Reading,  7/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13523
PUBLISHED: 2020-08-04
An exploitable information disclosure vulnerability exists in SoftPerfect’s RAM Disk 4.1 spvve.sys driver. A specially crafted I/O request packet (IRP) can cause the disclosure of sensitive information. An attacker can send a malicious IRP to trigger this vulnerability.
CVE-2020-16134
PUBLISHED: 2020-08-04
An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.01.20, and Internet Box light prior to 08.06.06. Given the (user-configurable) credentials for the local Web interface or physical access to a device's plus or r...
CVE-2020-16199
PUBLISHED: 2020-08-04
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple stack-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read/modify information, execute arbitrary code, and/or crash the applicat...
CVE-2020-16201
PUBLISHED: 2020-08-04
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. Multiple out-of-bounds read vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to read information.
CVE-2020-16203
PUBLISHED: 2020-08-04
Delta Industrial Automation CNCSoft ScreenEditor, Versions 1.01.23 and prior. An uninitialized pointer may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to read/modify information, execute arbitrary code, and/or crash...