Mobile Malware

Mobile device use is on the rise: As reported by Tech Crunch, mobility firm Ericsson predicts that there will be over six billion smartphone users worldwide by 2020, overtaking landlines. Why? Because smartphones and tablets are quickly becoming more powerful as companies embrace the idea of bring your own device (BYOD) policies and allow users to access corporate networks with personal technology. But along with increased use comes an explosion of mobile malware — malicious code designed to target smartphones and tablets.

Your Risk Factors

Is your device at risk of being attacked, hijacked or damaged? Absolutely. Researchers from the University of Cambridge found that 87 percent of all Android smartphones are exposed to at least one critical vulnerability, while Zimperium Labs discovered earlier this year that 95 percent of Android devices could be hacked with a simple text message. Apple isn't immune either. In September, 40 apps were pulled from the official app store because they were infected with XcodeGhost, a form of malware designed to turn Apple devices into a large-scale botnet. Despite Apple's vaunted protection, the malware not only sneaked through but was layered on top of legitimate apps, making it difficult to detect.

Bottom line? If you have a mobile device you're at risk.

Popular Types of Mobile Malware

While mobile malware hasn't quite caught up to its PC counterpart in terms of volume or complexity, IT security pros are seeing more mobile-specific malware designed to prey on smartphone features or tablet vulnerabilities. Let's take a look at some of the most popular types now making the rounds:

• Banking Malware: As noted by Dark Reading, banking-based mobile malware is on the rise, as hackers look to compromise users who prefer conducting all of their business — including money transfers and bill payments — from their mobile devices. More than 1.6 million malicious installation packages were found in Q3 2015, many of them Trojans designed to infiltrate devices and then deploy, collecting bank login and password details, which are then sent back to a command and control (C&C) server. In Q3 2015, mobile banking Trojans were the fastest-growing threat in the wild.
• Mobile Ransomware: First made popular on PCs, ransomware "locks out" important user data such as documents, photos and videos by encrypting this information and then demanding a ransom be paid to the malware makers. If the ransom isn't paid on time — usually in Bitcoin — all files are deleted or simply locked up —forever inaccessible to the user. According to International Data Group (IDG), 74 percent of companies reported a security breach in 2015, with ransomware being one of the most prevalent threats; malware creators leveraged both improved smartphone performance and the anonymous Tor network to infect devices and encrypt stored data.
• Mobile Spyware: Loaded as a program onto your device, spyware monitors your activity, records your location and lifts critical information, such as usernames and passwords for email accounts or e-commerce sites. In many cases, spyware is packaged with other seemingly benign software and quietly collects data in the background. You may not even notice the presence of spyware until device performance degrades or you run an anti-malware scanner on your tablet or phone. As noted by Krebs on Security, spyware is now big business: Companies like mSpy create "legitimate" apps that concerned parents or spouses can use to "keep track" of their children or partners. Ironically, mSpy was hacked in May 2015, putting to bed any notion of "safe" spyware.
• MMS Malware: Malware makers are also looking for ways to exploit text-based communication as a way to deliver malware. As noted by CSO Online, a vulnerability in Android's media library, Stagefright, made it possible for attackers to send a text message embedded with malware to any mobile number. Even if users didn't open or acknowledge the text, the malware could still deploy, allowing hackers root access to your mobile device. The problem was quickly patched but offered proof of text-based infections.
• Mobile Adware: Adware has come a long way from being nothing more than annoying pop-ups and data collection. For many adware makers, revenue depends on the number of clicks and downloads they receive, and according to ZDNet, some have now created "malvertising" code that can infect and root your device, forcing it to download specific adware types and allowing attackers to steal personal information.
• SMS Trojans: Cybercriminals are infecting mobile devices by preying on what users love most about their phones: text messages. SMS trojans wreak financial havoc by sending SMS messages to premium-rate numbers across the world, racking up users' phone bills. In 2015, some Android users were infected with a banking trojan that could intercept text messages that included financial information and then send a copy of the text message through email, giving cybercriminals all the information they needed to infiltrate financial accounts.

Steps to Protect Your Device

So how do you keep your mobile device free of malicious code? Try these simple steps:

• Use secure Wi-Fi. While this won't stop you from navigating to an infected website, using password-protected Wi-Fi connections keeps unwanted third parties from snooping or carrying out man-in-the-mobile attacks between your device and your intended Web destination.
• Watch your email. The devices may have changed, but the threat remains the same: Many attackers still rely on malicious email attachments to infect your phone or tablet. Don't click on links in email and other messages, as these may direct you to phishing or malware websites — this applies to all mobile platforms.
• Be consistent. Only download apps from trusted sources. This ensures that the apps are legitimate and not havens for mobile malware.
• Install antivirus protection. Antivirus and anti-malware solutions are now popping up for mobile devices; install one from a trusted source, then run it regularly to ensure your device is clean. Also, watch out for malware masquerading as virus protection: only download legitimate apps from trusted sources.
• Don't jailbreak or root your device. Doing so increases your risk of infection from untrusted third-party sources. Stay rooted and benefit from automatic security updates and patches.

Mobile malware is on the rise, with attackers shifting their efforts to smartphones and tablets as global mobile markets come under attack. Staying secure means recognizing your risk, understanding common threats and following basic mobile security best practices.