Mobile computing ripe for 'catastrophic malware disaster,' report states
Android's popularity, lack of oversight creating 'a perfect storm'
The number of reported software vulnerabilities last year continued
a four-year decline, but criminals are following their online victims
by refocusing their attention on the most popular online activities and
turning to a new generation of mobile devices, according to a pair of
new cybersecurity trend reports.
“There has been a significant rise in phishing associated with social
networks,” said Jeff Williams, a group program manager at Microsoft
Malware Protection Center.
The 10th Microsoft Security Intelligence/ Report shows
that after an increase in phishing activities targeting online gaming
sites in the first half of 2010, social networking sites became the lure
of choice in the last half of the year. Recorded visits to social
networking phishing sites jumped from 8.3 percent of visits in January
to 84 percent in December, a 1,200 percent increase.
Related stories:
Advanced persistent threats are a new way of life
New cyber threats emerging, and IPv6 won't make defense any easier
A report on malicious mobile threats
from Juniper found that increasingly popular and powerful mobile
devices finally have attracted the attention of malware developers.
“Already, mobile malware and exploitation techniques have reached the
complexity and capabilities of their counterparts in wired networks,”
the Juniper report concludes. “Malware developers are capable of
researching, uncovering and leveraging weaknesses in mobile platform
security models, as well as inherent weaknesses in app stores and open
ecosystems.”
The mobile threat is being compounded by a lack of oversight in the
marketplace and an exploding consumer base that lacks security
awareness, the report states, “creating a recipe ripe for a catastrophic
malware disaster.”
The Microsoft report found a polarization in criminal activity, with a
small number of skilled attackers using sophisticated techniques to
target a few high-value victims, while at the other end of the spectrum
exploit kits are being used by the less skilled to broadcast attacks in
the hope of a high number of smaller payoffs. These activities have kept
the overall threat level consistent with recent years, despite some
encouraging news, Williams said.
The good news in the reports is the decrease in the number of new
vulnerabilities being reported, which Microsoft reports has been sliding
since a peak in 2006. In 2010, the number of medium severity
vulnerabilities disclosed dropped by 17.5 percent from 2009, and the
number of high severity dropped by 20.2 percent. The report attributed
this to better software development practices.
On a similar note, newer versions of Windows operating systems are
showing lower rates of infection. Based on infections found per thousand
of licenses sold, Windows XP has significantly higher rates of
infection than Vista, and both have higher rates than the current Widows
7.
Industry cooperation also has succeeded in combating a number of
online threats by taking down several prominent botnets and effectively
eliminating the Conficker command-and-control system.
Spammers who use these networks adapt by moving to new ones, but
Williams said progress is being made. “In the long run, we will make
significant strides,” he said.
In the mobile environment, developers of exploits are following the
crowds to the Google Android operating system, which has become the
target of choice, said Dan Hoffman, chief mobile security evangelist for
Juniper.
Overall, the older Symbian operating systems still has the largest
number of exploits available, he said. “Symbian has been in existence
for a long time,” and still has the largest installed based. “However,
the majority of new signatures now are for Android.”
Overall, mobile malware grew 250 percent in 2010, Juniper found, and
the number of Android malware samples grew 400 percent from June 2010 to
January 2011. Two primary factors contribute to the Android focus,
Hoffman said: The Android is the cool new device being rapidly adopted,
and there are few restriction on software that can be written for it.
“Just about anybody can write an app for Android,” he said. “There is
not much vetting going on.” The market for applications for Apple’s IOS
is much more regulated with fewer rogue applications.
“The Google Android mobile operating system, as the dominant growing
force in the mobile device market, was the biggest target of malware and
exploit developers in 2010,” the Juniper report states. “Malicious
individuals took advantage of a market with little oversight and a large
and exponentially growing number of new users who were largely
uneducated, unaware, or disinterested in mobile security. It was, in
effect, a perfect storm.”
Hoffman said the technology exists to bring the level of mobile
device security up to that of laptops, which mobile devices are in many
ways replacing. Although laptop security is not perfect, “the vast
majority of government and enterprise laptops at least have a baseline
of security,” Hoffman said. But with mobile devices, “you would be hard
pressed to find any baseline security.”