This blog sometimes runs the risk of become something of a Cassandra given the nature of the topics we cover. But we’d be failing in our duty if we didn’t bring things to your attention we think you should be aware of. As the old saying goes, ‘Forewarned is forearmed.’
And that said there’s rarely a dull moment in the online world with headline leading hacks happening on an almost weekly basis. And the issues that have surfaced recently are very relevant to everyone who makes use of mobile computing.
Chinese hackers are targeting mobile users
Chinese hackers are upping the ante in terms of the number of attacks targeted at mobile users; there’s been a worrying increase in malware that is successfully penetrating online banking apps used on Android phones and researchers have developed a virus that infects Wi-Fi points and spreads like the common cold.
Hackers based in China have always been a prolific bunch and in the past have been accused of penetrating a wide range of commercial and military networks lifting everything from blueprints for helicopter designs to industrial control system architecture. But this is part of the hidden cyber war that many countries continuously engage in and we only become aware of when the lid blows of some particular attack such as Stuxnet.
However, the latest revelations merely confirm our suspicions, based on hard evidence, anecdotes and predictable trends, that mobile computing is becoming a big fat target. Malware kits for hacking mobile devices, that is smart phones, are available on the deep web for just short of £10. And its Android phones that are the primary target.
SMS forwarders + malicious apps = paying for premium rate numbers
One of the most insidious is something called SMS forwarders. These are essentially Trojans that steal authentication or verification codes sent via text messages from online payment service providers. The codes are intercepted and used by cyber villains to penetrate customer accounts.
Another sneaky method, and which it’s very easy to fall victim to, is a scam connected to the sale of premium-rate phone numbers for what seems like a hefty sum of 220,000 Yuan or just over £21,000.
These numbers are used in conjunction with malicious apps that reply to text messages that are connected to the premium rate numbers.The app embeds itself into the phone and then sends text messages to the premium rate numbers without the phone owner being aware of it, until they scan their bill and realise they’ve been paying a high charge for the text messages.
When you consider that thousands and thousands of phones are infected and at least several text messages are sent every week from each phone it’s easy to see how the villains quickly recoup their initial outlay and make a hell of a lot on top. It might be easy to dismiss this as a Chinese thing, in that people in China are by and large the victims but that would be naive.
Mobile banking apps penetrated
The global scale of hacking and the fact that geographical boundaries on the internet simply don’t exist, means that this type of malware and the SMS scams as outlined above are already quite rampant across Europe.
As in Europe and the US, spam is also big business in China. Hackers are hiring modems that send almost 10,000 text messages an hour, advertising products or directing users to websites that are populated with ID stealing Trojans.
It’s often difficult for the authorities to get a handle on this type of activity because much of the activity is carried out on the deep web where hackers can mask and hide their online locations.
It was also revealed recently that according to some sources there has been a 20-fold increase in the theft of financial details from mobile devices with up to 98 percent of malware breaching banking apps made for Android phones. Apparently, while at the beginning of 2013 67 ‘unique’ banking Trojans had been identified. By the end of the year this had grown to 1,321. A unique sample is exactly that, it stands alone and is not a variant of existing malware.
The malware is being used to liftcredit card numbers, personal data, logins and passwords for online banking from smartphones that process banking transfers. Why? To steal money from personal bank accounts of course.
Mobile malware prefer Android for its vulnerabilities
It’s interesting, and somewhat obvious, to note that most of the mobile malware zipping across wireless networks is aimed at Android phones. This is because the architecture is open and as such more vulnerable than proprietary platforms such as Apple’s IOS. But that said, Apple devices are also certainly being targeted.
Apparently, the countries that experience the highest number of attacks on mobile banking applications are Russia (40 percent), India (8 percent), Ukraine (4 percent), Vietnam (4 percent) and the UK (3 percent).
It goes without saying that smart phones need protection against mobile malware. There are already some strong security products available that safeguard against these threats – and it makes sense to ensure that if mobile computing is a significant part of your life then you need to make sure the door is locked so you have good identity theft protection.
A ‘whoo whoo’ discovery – The Chameleon
Staying on the same theme but just veering to the left slightly is a discovery that a few years back would have been dismissed as science fiction. Researchers at the University of Liverpool have developed malware that can spread through computers like an organic airborne virus spreads through humans.
The researchers designed malware they called ‘Chameleon’ that infects computers by exploiting the access points that homes and businesses use to connect to Wi-Fi networks. The Chameleon malware can also identify security weaknesses in Wi-Fi networks to quickly spread between homes and businesses.
Wi-Fi virus – just like the common cold
It’s faintly chilling because in densely populated areas Wi-Fi access points are clustered together meaning that just like a cold virus for example, the malware can spread much faster in a city.
When the virus attacked an access point it collected and reported the credentials of all other Wi-Fi users connected to it. It then went on searches for other Wi-Fi access points on the network to infect. Interestingly, the malware evaded detection from most modern antivirus software because it only looked for malware on the Internet or on the computer rather than the Wi-Fi network.
People rarely protect their Wi-Fi connections with a strong password and encryption and as a result, are increasingly vulnerable to attacks via this route. However, given that it was the boffins who developed this particular virus we can take some comfort that it’s not out there in the wild. Yet.
While Chameleon was developed for demonstration purposes only, how long will it be before some smart hacker creates their own version? It’s certainly more than likely. Years ago, people laughed at the idea of computer viruses; today they’re by and large struggling to understand that mobile devices also need protection and tomorrow you can bet when new threats evolve there’s likely to be an equally muted response. Still, at least you can put that one on your radar.