Android Malware Samples Cross the 2 Million Mark

Today’s consumers have a wide variety of smartphones and tablets, several operating system choices and an abundance of security risks to manage. This ever-growing number of options greatly increases the likelihood of end users downloading and installing a suspicious app or simply being attacked by a social engineering campaign.

According to SC Magazine’s latest report on the evolution of mobile malware, there is a dramatic increase in the number of Android samples both on a daily and monthly basis. The number of daily gathered malware samples peaked at a staggering 1,500 samples. On a yearly scale, the overall number of Android malware samples crossed the 2 million mark in late 2013. Despite the overwhelming number of daily samples, it should be noted that Zeus still ranks in the top five attacks plaguing U.S. companies.

Malware Goes Mobile

Cyber criminals have advanced their attack methods on the mobile device; from bypassing the mobile device ID and cross-channel attacks leveraging one-time passwords (OTP) to mobile phishing and malware targeting mobile platforms, the mobile threat landscape has progressed significantly in threat techniques targeting both devices and end users. Techniques such as cross-channel attacks, SMS forwarding, malware and phishing are all prevailing in the mobile channel because of inherent flaws in the operating systems and human error.

Mobile devices can be infected when users access malicious or compromised websites with exploit codes that target mobile browser vulnerabilities, also known as “drive-by downloads.” In this case, a malicious application is downloaded and run transparently so that the user never sees any suspicious activity on the device.

Old Techniques, New Channel: Mobile Malware Adapting PC Threat Techniques

Recently, a targeted Android banking Trojan called SVPENG targeting Russian institutions was discovered, representing significant progression for mobile malware. SVPENG targets Android mobile applications by substituting an automatically-opened window with a phishing window designed to steal the victim’s login and password from the online banking system. Additionally, it creates an “overlay,” which consists of malware (already residing on the end user’s device) that continuously monitors whether a user is browsing to a bank’s website. Once the malware identifies that an online banking session is starting, it displays a screen on top of the browser, mimicking the look and feel of the bank’s website, but which is in fact a spoofed page. This probably sounds familiar: While not yet a true HTML injection, this is definitely a big step in that direction; mobile malware capabilities are quickly catching up with those of their PC-grade counterparts.

A Holistic Approach to Mobile Security

Because mobility is evolving and traditional PC attack techniques are migrating to the mobile channel and introducing unique risks, a mobile fraud mitigation approach is essential. The platform must be highly adaptable to protect against ever-changing mobile threats in this rapidly growing channel. The expansion of mobile fraud methods together with the lack of security on mobile devices means that cyber criminals will increasingly target the mobile channel. It is clear that new mobile fraud mitigation techniques are essential in order to protect against evolving mobile threats.

Trusteer, an IBM company, offers holistic fraud prevention architecture that features three capabilities to help detect and prevent these mobile threats, including:

  • Trusteer’s Mobile SDK, which provides a library that is designed to enable application security services for mobile applications. This library can be used to build custom apps with Trusteer’s advanced security features, among which are: Device risk detection, active protection, an API interface to the Trusteer mobile risk engine (MRE) and unique and persistent device ID creation.
  • Trusteer’s Mobile App (Secure Browser), which provides secure access to banking websites for which no app exists and for users that prefer to use a mobile device, such as a tablet, to access the banking website. The secure browser detects underlying device risks and communicates them to the financial institution over the session.
  • The Trusteer Mobile Risk Engine, which protects the mobile channel by performing a mobile risk assessment based on device and account risk factors. It enables organizations to mitigate risk by producing an accurate and conclusive recommendation that can be used to apply stepped-up authentication or extended transaction review for truly high-risk users, sessions and transactions. The MRE can be used with the Trusteer Mobile SDK, which has a mechanism for sending a data bundle containing information about the device to the MRE. The MRE analyzes the data and returns a recommendation.

More from Endpoint

The Needs of a Modernized SOC for Hybrid Cloud

5 min read - Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint (EDR) technologies can detect and often stop entire classes of threats. Now we are seeing the emergence of technologies such as attack surface management (ASM), which are starting to help organisations get more proactive and focus their efforts for maximum…

5 min read

X-Force Identifies Vulnerability in IoT Platform

4 min read - The last decade has seen an explosion of IoT devices across a multitude of industries. With that rise has come the need for centralized systems to perform data collection and device management, commonly called IoT Platforms. One such platform, ThingsBoard, was the recent subject of research by IBM Security X-Force. While there has been a lot of discussion around the security of IoT devices themselves, there is far less conversation around the security of the platforms these devices connect with.…

4 min read

X-Force Prevents Zero Day from Going Anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

8 min read

Patch Tuesday -> Exploit Wednesday: Pwning Windows Ancillary Function Driver for WinSock (afd.sys) in 24 Hours

12 min read - ‘Patch Tuesday, Exploit Wednesday’ is an old hacker adage that refers to the weaponization of vulnerabilities the day after monthly security patches become publicly available. As security improves and exploit mitigations become more sophisticated, the amount of research and development required to craft a weaponized exploit has increased. This is especially relevant for memory corruption vulnerabilities.Figure 1 — Exploitation timelineHowever, with the addition of new features (and memory-unsafe C code) in the Windows 11 kernel, ripe new attack surfaces can…

12 min read