geloescht645843
Gesperrt
- Seit
- 4 März 2011
- Beiträge
- 2.657
http://globalthreatcenter.com/?p=2492
Mobile Malware Development Continues To Rise, Android Leads The Way
Mobile Malware Development Continues To Rise, Android Leads The Way
What happens when anyone can develop and publish an application to the Android Market? A 472% increase in Android malware samples since July 2011. These days, it seems all you need is a developer account, that is relatively easy to anonymize, pay $25 and you can post your applications. With no upfront review process, no one checking to see that your application does what it says, just the world’s largest majority of smartphone users skimming past your application’s description page with whatever description of the application the developer chooses to include. Sure, your application can be removed after the fact—if someone discovers that it is actually malicious and reports it. But, how many unsuspecting people are going to download it before it is identified as malicious and removed? This is precisely what is playing out in the mind of mobile malware developers today [...]
This approach has led to major increases in research into and discovery of vulnerabilities with in the Android platform as the delivery mechanisms of mobile malware. In our annual Malicious Mobile Threats Report, report, Juniper found a 400% increase in Android malware from 2009 to the summer of 2010. We have since seen exponential grow in Android malware over the last several months. The Juniper Global Threat Center found that the months of October and November are shaping up to see the fastest growth in Android malware discovery in the history of the platform. The number of malware samples identified in September increased by 28% over the number of the known Android malware samples. October showed a 110% increase in malware sample collection over the previous month and a striking 171% increase from what had been collected up to July 2011.
In addition to an increase in the volume, the attackers continue to become more sophisticated in the malware they write. For instance, in the early spring, we began seeing Android malware that was capable of leveraging one of several platform vulnerabilities that allowed malware to gain root access on the device, in the background, and then install additional packages to the device to extend the functionality of the malware. Today, just about every piece of malware that is released contains this capability, simply because the vulnerabilities remain prevalent in nearly 90% of Android devices being carried around today. Attackers know this, and they’re using it to gain privilege escalation on the device in order to gain access to data and services that wouldn’t otherwise be available.
The majority of malicious applications target communications, location, or other personal identifying information. Of the known Android malware samples, 55%, acts in one way or another as spyware. The other major type of attack, which make up 44%, are SMS Trojans, which send SMS messages to premium rate numbers owned by the attacker in the background of a legitimate application, without the person’s knowledge. Once these messages are sent, the money is not recoverable, and the owners of these premium rate numbers are generally anonymous. (Have you ever considered voting for American Idol via text message and it costs you $1.99 or $2.99 per vote? That’s how it works.)
So who is writing these apps? The Global Threat Center believes it’s the same actors who originally wrote malicious code for the legacy platforms of Symbian and older versions Windows Mobile. They shifted to Android given it gains significant market share when compared these legacy platforms. Statistically, this amounts to month-to-month sample collections on those platforms of 6%, 4%, 1.4%, and 0.93% for August, September, October and November.
One question Juniper always get when discussing our research is if Apple’s iOS is more or less secure than Android? Maybe, but it’s not necessarily because of the security or lack of vulnerabilities in the platforms themselves. The main reason for the malware epidemic on Android is because of different approaches that Apple and Google take to police their application stores. Android’s open applications store model, which the lacks code signing and an application review process that Apple requires, makes it easy for attackers to distribute their malware. There is still no upfront review process in the official Android Market that offers even the hint of a challenge to malware writers that their investment in coding malware will be for naught. Until there comes a time that someone (ever heard of Charlie Miller?) figures out a tried and true way to get malicious applications into the App Store, Android will remain the target of mobile malware writers around the world.
For our more technical readers, the findings outlined in this post are very straightforward, but we also developed an infographic to explain