A NEW BREED

securityage
A wolf in sheep’s clothing
Is mobile malware just a virulent nuisance, as some experts claim, or is enterprise
IT becoming complacent to a potentially business-endangering threat?
T
here’s no denying the
fact that mobile
malware is soaring.
In 2014, mobile security
firm Lookout reported that the
number of malware attempts
on mobile devices jumped by a
staggering 75%. Android users are,
unsurprisingly, taking the brunt of
it – with around two million forms
of Android malware, one in five
Android users have encountered at
least one mobile threat in the past
year, according to security firm
Kaspersky, which identifies roughly
5,000 new samples every day.
But alongside these scary statistics,
other experts are claiming that
mobile malware, as endemic as it
might be, is not really that serious
a threat.
In amongst the usual ‘doom and
gloom’ of its annual breach report,
wireless telecoms provider Verizon
declared – in a section called ‘I’ve Got
99 Problems and Mobile Isn’t Even 1%
of Them’ – that the major malware
exploits ‘just aren’t happening’.
Though the firm detected hundreds
of thousands of malware infections,
these were mostly ‘adnoyance’ type
programs that simply irritate users
with unwanted adverts. Other
forensic companies like FireEye also
‘A significant
proportion of malicious
mobile software seen
in the wild today is
adware, but it would be
very foolish to lower our
defences based on this
observation’
>> David Kennerley, Webroot
say that mobile devices just don’t
show up in their investigations.
Despite the volume and veracity,
Verizon and FireEye paint a picture
of mobile malware as a cloud of
tiny, annoying ticks and parasites
that pose no real threat to
information security.
So just how concerned should
enterprise IT be about mobile
malware and the potential threat
to their business’s information?
David Kennerley, threat research
manager at cyber security firm
Webroot, argues that it would be
naive to think that mobile malware
doesn’t pose a significant security
risk for companies. ‘There is a real
concern that enterprise decisionmakers
may misinterpret recent
reports and not take mobile security
as seriously as they should,’ he says.
Treason and plot
The recent case of ‘Gunpoder’ [sic]
also highlights a new technique of
the malware writers. This piece
of malware, disguised as a game
emulator app, looked and behaved
like adware – all while stealing
personal information from the
infected Android device, which the
cybercriminals then used to commit
phishing attacks.
‘Many AV companies classified
this malicious app as adware,
and many users thinking that
adware was “more annoying than
dangerous” allowed the app to run,’
says Kennerley.
September 15 information-age.com 37