For many cybercriminals, mobile phones are the crown jewels. They carry our email, our contact databases, and even our wallets, thanks to mobile payment systems. Online ne’er-do-wells are trying their hardest to get their malicious software onto our devices.
What can this malware do? As always, money is a critical driver for cybercriminals. One piece of Android malware, called MKero, secretly subscribes victims to premium-rate SMS services that come with monthly fees, for example.
“A mobile phone is a very capable and aware device,” says Andrey Pozhogin, cybersecurity expert at the North American arm of Kaspersky Lab, an anti-virus company headquartered in Moscow.
“If a cybercriminal gets access to a mobile phone, the possibilities are many and the more critical or damaging the information is that is received from the compromised device, the more money the cybercriminal can make using it.”
Ransomware is also making its way onto mobile devices. It can either encrypt data or frighten users into thinking that they have acted illegally and demand payment.
“Ransomware has had tremendous growth on the PC this past year (up 155 per cent from the previous year) and is starting to grow on the mobile side as well,” says Pozhogin.
There are three main types of mobile operating systems in the market today: Google Inc.’s Android OS, Apple Inc.’s iOS, and Microsoft Corp.’s Windows Mobile. With less than 3 per cent of the market, Windows is less of a target then Apple and Android, says Bruce Snell, cybersecurity and privacy director at Santa Clara, Calif.-based Intel Security. That doesn’t mean Windows is immune, though.
How is mobile malware distributed? One of the most common ways to get malware onto these devices is phishing, in which victims are sent messages purporting to be from a legitimate source such as a bank. On a mobile phone, phishing links can arrive via email or SMS text message. When clicked, they can install malware on the phone by cajoling the user into giving permission.
In some cases, security vulnerabilities can be exploited without the user’s involvement at all. One of the biggest bugs that has hit Android was Stagefright, an attack that exploited a security vulnerability in Android, enabling attackers to infect a device simply by sending a multimedia text message.
“With malware increasing on mobile platforms, it’s very important that people update their operating systems and applications as soon as they can, be wary of clicking on links in SMS and email and install an antivirus solution on their phone,” Snell says.
Aside from SMS, Android phones can be infected by downloading apps from third-party app stores other than Google’s. There are several of these, including the Amazon app store, GetJar, and F-Droid. Users can avoid these stores and only use Google’s Play store, but this may not save them.
Google uses an automated analysis tool called Bouncer that examines programs before they are approved. In several cases, though, malicious software has flown under the radar and gained approval. Multiple apps in the Google Play store were found to have contained the MKero malware, for example.
Apple’s iOS system has been relatively safe from bugs, thanks to the tight restrictions that Apple places on its platform. Its approval process is extremely stringent, and unless users specifically take steps to ‘jailbreak’ their phones, they are mostly safe. Apple’s steely grip on its mobile operating system and applications has also extended to antivirus programs for the iPhone, which it rarely allows. This has left security firms to focus on features like password protection for photos and encryption of wireless communications on the iPhone instead.
Apple’s heavy-handed approach doesn’t make iPhone users completely immune, though. “Several times in the past, Apple confirmed that programs containing malicious code made it through the review process and into their app store,” says Snell.
The smarter our smartphones get, the more opportunities they present for cybercriminals to attack us. Antivirus software – when available – can help protect our mobile devices, and Apple has unparalleled performance in securing its iPhone and iPad devices. As with all cybersecurity threats, though, avoiding apps from untrusted sources and thinking twice before clicking on links is one of the most helpful measures that users can take. A little user common sense goes a long way.
This is the second article in a three-part series on cybersecurity.
Up next: Minimizing the cybersecurity threat.