2011 is looking to be the year when mobile malware comes into its own. Why? First off, the devices we carry in our pockets are morphing from phones to true computers. They can run sophisticated software, and multitask, allowing evil code to lurk in the background and do its dirty work. Secondly, our phones are increasingly becoming repositories of interesting and valuable information. Mobile payment applications such as Square and even Starbucks’ “pay for your coffee” app mean that there’s gold in them thar phones for attackers.
Researchers in Hong Kong and Indiana have provided us with a preview of things to come with their Soundminer proof of concept app for Android. Soundminer and its companion app, Deliverer, listen for spoken or touch toned credit card numbers during phone calls. The recordings are converted into typed numbers and then delivered (by Deliverer) to the central control server. This is pretty sophisticated stuff. Converting the recordings to text on the phone is a neat trick – and the authors found a really clever way to get around Android’s restrictions on sharing information between apps. Both of the apps require fewer privileges than many legitimate Marketplace apps. You can read more about this project and see a video demo here.
While Soundminer is a proof of concept, there have been some instances of mobile malware found in the wild. Another Android trojan called Geinimi appeared on Chinese app stores in 2010. Geinimi is meant to be packaged with legitimate applications. Geinimi appears to be able to send information about SMS messages and contacts to a remote server, make phone calls and download files, according to an analysis conducted by Lookout, a purveyor of anti malware software for Android phones.
I think that over the next year, having an antimalware program on your phone or tablet will be the status quo… Lookout seems to be the market leader in the Android world at the moment, but industry leaders Norton and McAfee have both released Android apps as well. I have a feeling that this is going to be a profitable market segment – and the source of security woes for many smartphone users.
RSS - Posts