The Enemy on your Phone

Many people believe that there are no malware programs on smartphones. There was a time when there was some truth in this. A few years ago mobile platform operators originally designed their products with very high security levels. Mobile operating systems did not allow malicious programs to easily seize control and make themselves at home on devices.

Sadly that’s no longer the case. Mobile devices are fundamentally different, they can do much more. A modern smartphone is a full-blown working tool, an entertainment center and a tool to manage your personal finances. The more it can do, the more attractive it is to cybercriminals. They want to steal a slice of that pie and the more tempting the prize, the more they create malicious applications, and invent methods to infect computers and to distribute malware.

Since Q1 2012, the number of malicious programs has grown more than tenfold, to exceed 12,000,000 in Q4 2014

Tweet

The evidence for this is clear when we look at the rapid growth in the numbers of mobile Trojans. The rate of growth is impressive: since Q1 2012, the number of malicious programs has grown more than tenfold, to exceed 12,000,000 in Q4 2014.

The number of detected malicious installation packages

Looking at the types of malicious programs is also revealing. It is easy to see that SMS Trojans and multi-purpose backdoors are giving way to malicious adware and Trojan bankers. However, just because a specific type of malware is losing its market share, this doesn’t mean it is disappearing: it should be also remembered that the overall number of malware programs targeting mobile devices keeps growing.

Distribution of mobile malware by function (files from Kaspersky Lab’s collection)

Malware writers don’t create tons of malicious programs to build up a private collection or show off on some forum. All malware programs find their victims, and it is at times surprising to see how a seemingly innocuous loophole can allow them onto users’ mobile devices.

Do it yourself

Believe it or not, users often infect their mobile devices with their own hands.

The ways to get malicious code on a regular computer without any user involvement are well known. Cybercriminals hack websites, users visit the sites and a hidden frame is opened in their browsers to download malware on to the victim machine using an arsenal of exploits.

On mobile platforms, everything is different. The underlying principles behind these platforms mean there are almost no vulnerabilities that would enable cybercriminals to attack a device without the user’s knowledge and consent. So criminals need some help from users: Trojans must be installed and launched by their intended victims. It’s like the old joke about the first, primitive virus: ‘please delete all your important data and reformat your hard drive’.

A classic method to make money with mobile malware is to send premium-rate SMS messages from your phone

Tweet

Installing programs is one of the weakest places in mobile platforms, especially Android. Under iOS, you have to spend time fiddling around before you can install a program from anywhere other than App Store; however, Android allows users to do that by checking just one box in the settings. Once that’s done, the system will check the digital signature of any installation package, and theoretically that should protect your device against malicious programs. But here’s the snag: there are no Android certification centers, so anyone can create their own signature. Of course cybercriminals just sign off their own security confirmation and the installation goes ahead without a hitch when the user clicks ‘OK’.

And many users do click ‘OK’. After all, it’s often easier than investigating everything about the app you’re allowing onto your device.

Information security is usually far from the thoughts of a regular user. People love a bargain and find it hard to resist a free download of a useful program or a favorite game from some helpful-looking website. Often the application, once installed, will work as expected, except that money is drained from the phone’s account at an alarming rate, and the user’s credit card will soon get empty… Or, if users are invited to watch an exclusive video on an interesting site, perhaps they’d take a minute to update their Flash Players?

Fake Adobe Flash Player update page. Users are told to update an outdated version of Flash Player on their devices

Inexperienced users do not know that the update process for software on smartphones is different than on computers, so cybercriminals can trick them into installing anything under the guise of a useful upgrade.

Cybercriminals are extremely aggressive and astute when pursuing their targets: malicious applications are typically distributed in the form of various tempting software programs, games, porn clips or players for watching porn.

Where to find malware

Since users have to install malicious programs on their smartphones with their own hands, cybercriminals need to somehow entice them to a web resource where the malware is available. “Black SEO” is one of the methods used to do that. Black SEO is a type of search optimization that encourages search engines to display a link to the preferred malicious resource at the top of the search results. As soon as the site receives a top position in the search results, a harvest of unwitting users can be reaped.

A bored user types “Android games download” in a search engine and receives a link to web-site in the first or second line at the top of search results. That site may indeed contain games, but they come with some unpleasant extras. People tend to trust the sites from the top lines of search results. Users think that since thousands of people visit a web-site, it will also have the game or program they are looking for. Users do not think about security. That’s a big mistake.

To bring the malicious site to the top of the search results, cybercriminals often use botnets: thousands of bots send search requests to Google and Yandex and visit the cybercriminals’ site, boosting its ranking. Links to the cybercriminals’ site are also published on all types of forums, bulletin boards, and in comments on news sites. The crawler bots of search engines find them there, so the rankings grow even faster.

Of course search engines try to stop this abuse of their services. They block hundreds of malicious sites. But that’s not a big problem for cybercriminals: they keep creating and promoting new sites with the help of automatic tools.

SMS spam is yet another means of enticing users to sites containing malicious applications. It could be a simple, non-targeted mass-mailing of messages containing a link to the site: at least some of the recipients will follow the link. As soon as such program lands on somebody’s smartphone, it will start to send SMS messages containing the malicious link to the owner’s entire contact list. A message from a person you know raises few suspicions, especially if the text looks natural, so many do indeed follow the link they received, hoping to see some photos or jokes that their friend is sharing. But once opened, the site actually hosts malware samples from the cybercriminal.

Another method allows cybercriminals to exploit the popularity of legitimate resources. Cybercriminals hack popular online resources high visitor traffic, such as news sites, online stores, specialized portals. If the site’s software contains known vulnerabilities, a code is embedded to the page and redirects the users to another site containing malware. If no vulnerabilities could be found, cybercriminals can still try to steal the site admin’s credentials by using phishing and social engineering. If they succeed they can do anything to the site, including posting malware on the site itself.

Fake Android Market

In addition mobile malicious applications are distributed “almost honestly” – via app stores. This might be a legitimate program containing embedded malicious code; a specially created application which imitates some useful functionalities; or a bare-bones malicious program, with just a name and an icon as a camouflage.

Fake Google Play

Such programs are usually uploaded to unofficial app stores which either neglect security measures altogether or only take a cursory look at the content that gets published. However, there have been cases when dangerous programs got uploaded to official app stores – Google Play and even Apple App Store, which is historically more secure. Naturally, the manufacturers promptly clean their stores, but cybercriminals never sit on their hands either.

How cybercriminals make money

Once malware lands on your smartphone, it starts its mission of making money for its owner, naturally at your expense. A modern mobile device is a real goldmine for a cybercriminal; it only takes the appropriate mining skills.

Mobile malware: methods of making money

Expensive tricks

The least damaging money-spinner used by cybercriminals is obtrusive adware. It doesn’t do much harm, but it doesn’t take long for all those pop-up ads to get annoying. Getting rid of them is often more of a challenge: it takes quite an effort to find out which program is actually producing the banners. It could be Angry Birds HD, or it could be that something that has a name you cannot read aloud and masquerades as a system application.

There is also a curious category of fake apps that do nothing at all – neither good nor bad – but still cost good money. Some of these are clear dummies on offer in paid-apps sections of application stores, like a program that promises to make you rich but only displays an image of a diamond on the smartphone’s screen. Others pretend to be useful applications, such as antivirus programs, and demand payments from the user for protection against Trojans that have supposedly overrun the device.

Money from your telephone

A classical method to make illegal money with mobile malware is to send SMS to premium-rate numbers. A Trojan running on your phone simply sends several premium-rate SMS messages and drains your account. Your phone service provider sends money from your account to the renter of the premium-rate number (the cybercriminal) without asking any questions, since premium-rate numbers are still a popular way to pay for different types of online services.

Another way to make money from the owners of infected smartphones is to steal their valuable data. There are tons of things of interest in your address book, SMS messages and email. At the very least, your address book can be used to replenish the spam databases, so your contacts will receive piles of ads and malicious links. Also, if you’ve ever sent or received web site administrator credentials and have not updated them since then, you can be sure that the cybercriminals will appreciate it and will adopt your site into the their malicious “family”.

Smartphone or your wallet?

Ransomware Trojans for PCs are abundant. Recently, they’ve started emerging on mobile devices. The scam is simple: once installed on your mobile device, the Trojan displays a screen making threats and demanding a ransom. You can no longer work with your device. All you can do is to enter the special code that they promise to send you as soon as you pay them a specified amount of money.

Message displayed by this ransomware sample: “Your phone has been blocked for viewing banned porn (Pedophilia, Zoophilia)! All photo and video materials have been sent for further investigation. To unblock your phone and delete this material, you must pay a 1,000-ruble fine within 24 hours. To do this, top up number XXXX at the nearest payment kiosk. Warning! If the fine is not paid, all data will be made public”

It is impossible to delete the Trojan unless you hard reset the settings and the contents of the device’s flash memory. For many the value of the data on the device makes it worth paying the ransom. However, the cybercriminals do not always send the unblock code even after the ransom is paid.

The key to your bank

However, none of the above scams are anything like as costly as this relatively new way of stealing from mobile device owners. In recent years mobile banking services have become increasingly popular. Every major bank has developed an app that allows clients to manage their money from their smartphone or, at the very least, use SMS banking services.

Mobile banking #malware threats increased since 2013 – from less than 100 to 13,000 by Oct. 2014

Tweet

Suddenly many smartphones are the key to bank accounts – often to several accounts at the same time. This offers many opportunities to make illegal profits – and promises greater rewards than the traditional SMS and ransomware scams of old. Not surprisingly, cybercriminals have been quick to embrace this new opportunity.

The statistics clearly show how much interest mobile virus writers have in users’ bank accounts. At the start of 2013, there were less than a hundred Trojan bankers in Kaspersky Lab’s collection; at the October 2014, there are more than 13,000 of them.

The number of detected banking malware programs

Banking Trojans are enjoying a surge in popularity all over the world but Russia is facing the brunt of this boom. Russia is a place where malware writers test-run their creations before using them in other countries.

Geography of mobile banking threats. January – October 2014
(Number of attempted installations of banking Trojans)

For cybercriminals, SMS banking is the easiest path to other people’s money. It doesn’t even require new tools – existing SMS Trojans work just fine. Banks often assume the client’s phone is a trusted environment and follow SMS instructions without query.. Clients can send money from their bank accounts to their own or somebody else’s mobile phone account. Using that feature, the cybercriminals send an appropriate SMS and send money from the victim to their phone number. After that it is easy to withdraw the money using advanced mobile payment systems.

Quite often, banking Trojans work in partnership with computer Trojans; Faketoken is one example. When the user’s computer is infected with a banking Trojan it waits until they visit their online banking account. Then the malware program becomes active and displays a window to the user, asking them to download an Android application which is allegedly required to securely confirm the transaction. Gullible users obediently install Faketoken on their smartphones. After that it is only a matter of time: the malware on the computer steals the credentials, and the cybercriminals gain access to the user’s banking account. They make a transaction and Faketoken intercepts the one-time confirmation code (mTAN) sent by the bank in an SMS. In the end some Vasily P. collects a hefty sum of money divested from the user’s account, and cashes it immediately at an ATM. We saw this piece of malware attacking users in 55 countries, including Germany, Sweden, France, Italy, the UK and the USA.

A third method is to use independent mobile banking Trojans which can masquerade as a mobile banking applications or simply spoof the banking application’s interface. The Trojan gets hold of the users’ credentials and sends the information to its C&C server. The cybercriminal uses the intercepted data to make a transaction. Svpeng is a good example of this tactic. This mobile Trojan opens a window on top of a legitimate application window, imitating the banking applications of the largest Russian and Ukrainian banks.

Phishing window imitating the bank’s own application

Using these programs, cybercriminals can strip you of all your savings in an instant, drain your accounts and close your deposits. They can also put you in debt by running up your entire available credit.

Don’t dig a hole for yourself

The proportion of malicious applications among all applications installed by users varies from country to country. Here are the figures for some countries for January – October 2014 (according to Kaspersky Security Network data):

The fact is it’s fairly easy to protect yourself against all these sophisticated mobile threats. Mobile platform developers have taken good care of security and the user is often the weakest link in the security chain. This is good and bad at the same time. It’s a problem because many users don’t pay much attention to their security. But the plus side is that you only need to follow a few simple recommendations to safeguard yourself against all the above threats.

We recommend that you follow the following simple rules.

• Do not jailbreak / root your smartphone. While it will give you extra opportunities on your phone, it will also give the green light to cybercriminals.
• On an Android phone, disable the option of installing software from untrusted sources.
• Install a mobile security product on your phone. It will analyze all applications before installation.
• Try not to follow any links arriving in SMS, even if they come from people you know.
• If you do follow a link in an SMS, do not accept any downloads or installations.
• Only updates your applications with downloads from official stores, not third-party sites.