Feeds

Security firms: Android malware set to skyrocket

Droid isn't the new Windows yet, but ...

SANS - Survey on application security programs

Android malware threats could increase by a factor of 60 over the next six months, according to Romanian security pros.

The rise, if realised, could see the number of Android mobile malware samples increasing from 200 now to 12,000 by March 2012. Many examples of Android malware involve the insertion of malicious code into legitimate applications before they are uploaded to third-party Android marketplaces.

During a demonstration on Tuesday, BitDefender security researchers showed it was possible perform this task with just 10 lines of base script. In most cases, users can avoid becoming victims by reviewing the "permissions" that an item of software requests before agreeing to install an app. For example, there is no legitimate reason why a torch app would need the ability to send SMS messages.

"The trouble with permissions is that ultimately falls down to user choice and interpretation," Viorel Canja, head of anti-malware and anti-spam labs at BitDefender told El Reg. "It's a repeat of the same problem we've had on the desktop."

"If Google locks down its applications, it risks losing developer interest, something that happened to Symbian before it. Android is not yet the new Windows for malware but it is going that way at the moment," he added.

BitDefender is developing a mobile security product for Android. The product, currently in beta, includes remote wipe and a filter designed to allow users to easily review application permissions as well as malware detection features. Under current plans, the software would be released free of charge to consumers but neither this or the release date for the software are confirmed. The application has been designed to minimise battery impact.

Rival security firm G Data agreed with BitDefender's assessment that the rate of growth of mobile malware - which it reckoned grew by 273 per cent in the first half of 2011 - is only going to increase over the immediate future.

“With mobile malware, cyber criminals have discovered a new business model," said Eddy Willems, security evangelist at G Data. "At the moment, the perpetrators mainly use backdoors, spy programs and expensive SMS services to harm their victims.

"Even though this special underground market segment is still being set up, we currently see an enormous risk potential for mobile devices and their users. We are therefore expecting another spurt of growth in the mobile malware sector in the second half of the year."

The sophistication as well as the sheer number of malware strains targeting Android smartphones is increasing. For example, Trusteer warned earlier this week over the appearance of a strain of the SpyEye banking Trojan that infected Android smartphones in order to intercept text messages that many financial institutions use to prevent fraud, as explained in more detail in our earlier story here. ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.