The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? … and What Can be Done About It?

Kevin McPeak, CISSP, ITILv3 Technical Architect, Security

Symantec Public Sector Strategic Programs

Who Can Be Affected by Mobile Malware?

Governmental, Commercial, and Home UsersApple iOS Android

BlackBerry Windows Mobile

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

Who Creates & Distributes Mobile Malware?Cyber Criminals and their AccomplicesMalware Developers Mules

Mobile Botnet Operators Cyber Thieves

Espionage Rings Hacktivists

2

What is Mobile Malware and How Do We Count Them?

• Each of these applications contain the same piece of malware embedded in them

• Each piece of malware is counted as one Family – If this malware is modified the new version counts as a Variant

• We would count the five apps as Samples• We do not report on Samples, but many vendors do

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

3

What is the Growth Rate of Android Malware?

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

4

Vulnerabilities & Mobile Malware

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

What Mobile Platform Has the Most Vulnerabilities? …What Mobile Device Type Has the Most Threats?

5

What Types of Mobile Malware Exist?

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

6

When is Mobile Malware Active?

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

When Mobile Data is Collected: When IMEI7 and IMSI8 numbers are taken by attackers as a way to uniquely identify a device.

When Users Are Tracked: When communication data such as SMS messages, call logs, GPS coordinates, calendar events, or personal photos are exfiltrated.

Or when a device is hijacked to serve as an e-mail spam relay system, thus allowing unwanted e-mails to be sent from addresses registered to the device.

When Device Settings are Changed: When an attempt is made to elevate privileges or modify OS settings to perform further actions on the compromised devices.

When Bad Apps Send Out Content: When an app sends a text message to a premium SMS number, ultimately appearing on the mobile bill of the device’s owner.

7

Where is Mobile Malware Found?

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

Third-Party App Stores Hosting the Most Malware

8

Where is Mobile Malware Found?

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

9

Why is Mobile Malware Developed?

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

…. because There is Significant Illicit Money Being Made• Premium SMS Messages• Mobile Adware (Madware)• Stealing Information• Bank Fraud • Ransomware • Botnets and Spam

10

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

Information Stealing Malware

Android.Sumzand

1. User received email with link to download app

2. Steals contact information3. Sends email promoting app to all

contacts

11

Mobile & Social

• Everyone Likes to be Liked

• And there’s an App for that!

12

Mobile & Social

• Instlike gives you 20 free likes on your Instagram photos• And you can buy more

13

Mobile & Social

• Just give the app developer your login and password• Don’t worry, he promises not to steal your account

Internet Security Threat Report 2014 :: Volume 19

5214

Mobile & Social

• Thousands of mobile users willing gave away their email addresses and passwords for nothing more than a Like.

• Mobile users are at risk, even from themselves.

15

Internet of Things – The FutureWearable Devices will soon

be measuring:• Pulse

• Weight

• Time Slept

• Glucose Levels

• Blood Pressure

• Exposure to sunlight

• Teeth Brushing

• And more…

As more of our personal information travels the Internet what will become of it?

16

72%90% 78%

56% 48%33%

DELETE SUSPICIOUS EMAILS FROM PEOPLE

THEY DON’T KNOW

HAVE AT LEAST A BASIC FREE ANTIVIRUS

SOLUTION

AVOID STORING SENSITIVE FILES

ONLINE

Mobile Security IQ

Source: Norton Report

17

Vulnerability Patching

Service Providers

iOSGoogle

OEMs

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

… The Problem Exists, so What Can be Done About It?

18

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

… What Can be Done About It? (Continued)19

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

… What Can be Done About It? (Continued)

NIST Special Publication 800-163 "Technical Considerations for Vetting 3rd Party Mobile Applications"Allows Federal agencies to assess the following for any given mobile app:• Security• Behavior• Reliability• Performance

AppVet:In conjunction with DARPA, NIST developed the AppVet program:• Allows Feds to submit an app for

testing • Uses open source and

commercially available tools

20

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?

Deploy Mobile Security Software Throughout Your Organization: At a minimum, this software should scan and identify threats from any mobile apps or content that the user downloads.

Establish a Robust, Highly Secure Mobile Device Management Framework for Your Agency: Managing your organization’s mobile devices is not just about remote wipe commands for lost/stolen devices and OTA password resets. You should also setup a system for mobile app management across the entire app lifecycle. Likewise, you should manage your organization’s mobile content ecosystem in the same secure end-to-end manner.

… What Can be Done About It? (Continued)

Enforce User Mobile Security Training: Users must be constantly reminded to avoid clicking on suspicious links in messages, to keep their personal mobile devices updated, and to only download apps from officially sanctioned App Stores.

21

Thank you!

Copyright © 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice.

Kevin McPeakkevin_mcpeak@symantec.com @kevin_mcpeak

symantec.com/threatreport

mobilesecurity.com/

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?