Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:00 PM
Connect Directly

Windows PCs Make Up 80% Of Mobile Network Infections

Microsoft Windows PCs -- not smartphones and tablets -- harbor most of the malware on mobile networks, according to a new Alcatel-Lucent report.

Mobile devices are the least of your worries in a mobile network: Windows PCs are responsible for 80% of all malware infections on today's mobile infrastructure, new data shows.

Alcatel-Lucent's Motive Security Labs this week published its findings from the first half of 2015, showing that the overall infection rate for mobile devices had declined from 0.68% to 0.50% from January to April of this year. Then it spiked to 0.75% in late June, thanks in part to the main source of malware on a mobile network -- Windows PCs tethered to mobile WiFi devices, hotspots, and smartphones getting hit mainly with malicious adware.

The report is yet another reality check on mobile security, indicating that the bad guys still prefer infecting pervasive and often vulnerable Windows machines over smartphones, despite worries over mobile devices being targeted and a rise in mobile malware. Motive Security Labs found that 80% of the infected devices on mobile networks in June were Windows PCs, followed by Androids.

The number of new strains of Android malware is expected to hit 2 million, according to anti-malware firm G DATA. 

While many enterprise security teams worry about BYOD as an attack vector, Verizon's 2015 Data Breach Investigations Report earlier this year showed that attackers really aren't using mobile malware for cybercrime or cyber espionage in real attacks. There was some mobile malware, but its role in security incidents was insignificant, according to the firm, which also found that mobile devices on Verizon Wireless's network were infected at a rate of 0.68%, coincidentally the same rate as Alcatel-Lucent found in the first half of this year.

Security firm Damballa Research used a more dramatic analogy to illustrate the mobile threat in its recent study: US users are 1.3 times more likely to get struck by lightning than to be infected with malware, they found.

[BYOD may be a big fat security and management headache for the business world and mobile malware is on the rise, but the reality is that so far, hackers aren't employing mobile malware for cybercrime or cyber spying purposes. Read Verizon DBIR: Mobile Devices Not A Factor In Real-World Attacks.]

According to Alcatel-Lucent, malware on mobile networks from 2013 to 2014 was half Android malware and half PC malware. Why the drop in Android malware? "The Android reduction is probably due to efforts by Google to eliminate malware from Google Play and to the introduction of the Verify Apps feature on Android," the report said. "The Verify Apps feature was introduced in Android 4.2 (JellyBean) and is now available on close to 80% of deployed devices. It is activated by default, but the user does have to consent to have the service run the first time they side-load an app."

Most Android malware on the mobile network comes via Trojan-rigged apps, many downloaded from third-party app stores and websites rather than Google Play, the report says.

Meanwhile, spyware for mobile devices is on the rise: ten of the top 25 malware types for mobile are spyware variants. These programs do everything from watch the location of a phone to monitoring calls, texts, emails, and Web browsing.

Among the more malicious adware families is BetterSurf, which comes bundled with free Windows applications and games. It installs as a plug-in to browsers and  injects pop-up ads into Web pages the user browsers. "While it looks like run-of-the-mill adware, the ads themselves are very dangerous. Many are phishing attempts to install additional malware and engage in fraudulent activity," Alcatel-Lucent said in its report.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Moderator
9/21/2015 | 10:40:43 AM
Good article - concise, informative, and actionable
Enjoyed this article very much. It clarifies what is actually happening in the mobile security arena, how & why it is happening, and a bit about Verify Apps on the Android platform and a warning about BetterSurf on Windows. This sort of clarity is exactly what every IT expert needs to have in order to begin to get a handle on mobile security strategies.
User Rank: Ninja
9/21/2015 | 10:38:29 AM
Largest Landscape
Good article. This isn't too surprising as windows represents the largest landscape in the business world for technology. Due to this more malware is written towards this environment.
User Rank: Strategist
9/21/2015 | 4:10:14 AM
very disturbing !!
Hello and thank you for your article, these figures are very worrying. The security of all is really goodbye on the web!
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/7/2020
The Coronavirus & Cybersecurity: 3 Areas of Exploitation
Robert R. Ackerman Jr., Founder & Managing Director, Allegis Capital,  4/7/2020
'Unkillable' Android Malware App Continues to Infect Devices Worldwide
Jai Vijayan, Contributing Writer,  4/8/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Digitized COVID-19 Prevention
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-04-09
QQBrowser before 10.5.3870.400 installs a Windows service TsService.exe. This file is writable by anyone belonging to the NT AUTHORITY\Authenticated Users group, which includes all local and remote users. This can be abused by local attackers to escalate privileges to NT AUTHORITY\SYSTEM by writing ...
PUBLISHED: 2020-04-09
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).
PUBLISHED: 2020-04-09
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There is pervasive CSRF.
PUBLISHED: 2020-04-09
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive information via info.php4.
PUBLISHED: 2020-04-09
An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. It allows remote attackers to obtain sensitive credential information from backup files.