Courcy's Future Threats - 8 May 2012

A rising trend in security threats is attacks on smartphones and other mobile devices. Rootkits, botnets, and other malware, well recognised in computer and network security are now a serious threat to smartphones and PDAs. Malware is not the only threat. As devices develop more advanced capability they carry more data, or have access to companies’ internal networks, so theft is a greater problem than used to be the case. Research shows that companies are not fully aware of the threat posed to their data, and that smaller businesses are particularly at risk. It seems that users are also not aware that activities such as online banking could be more hazardous on a mobile device.

Users are often not as security conscious about their mobile devices as they are about their PCs. Some users, seeking even more functionality and a personalised interface, actually alter their smartphones in ways that break them wide open to hackers.

A large part of the problem is perception. People tend to view smartphones as ‘phones with additional functionality, rather than computers with telephone capabilities. Tablets, generally, are not at as high a risk as smartphones, as they are recognised as computers not ‘phones. Many of them are sold with special antivirus programs designed specifically for their operating systems. Users are able to choose between different antiviruses, and are prompted to update them when necessary. This is particularly important for Android devices (see below).

Malware threats for mobile devices are showing the same evolutionary pattern as those that developed in parallel with PCs (both Windows based and Apple computers). Attackers have moved on from simple destructive or mischievous malware to spyware and malware that makes them money. They have learnt to exploit vulnerabilities that bypass system protections and gain greater control. Security companies such as McAfee are suggesting that 2012 will be marked out as the year that mobile-banking attacks will begin in earnest.

On PCs, rootkits and botnets deliver ads and make money off of their victims. Malware is now being seen on smartphones that do the same things. Rootkits allow the installation of additional software or spyware, and botnets can cause ad clicks or send premium-rate text messages.

One of the most significant technical threats stems from some users’ habit of breaking open their smartphones to gain increased functionality, or to allow them to switch carrier. The most commonly targeted devices are those with an Android operating system, although Apple devices are also vulnerable.

Mobile variants of malware families that include Android/DrdDream, Android/DrdDreamLite, and Android/Geinimi, as well as Android/Toplank and Android/DroidKungFu have been spotted, and these could mark the beginning of an explosion of mobile malware. Antivirus developers may be able to keep pace with the malware, but users must opt to employ security solutions, and more importantly not disable them if they come built in to the device.

Some of the malware detected has used root exploits, originally developed for customers to unlock their own phones, to gain access and take over victims’ phones. Through 2012 and beyond developers and researchers will continue to develop new methods for rooting ‘phones and it is likely that cybercriminals will further adapt the lessons of PC malware development to undertake attacks that leverage the mobile hardware layer to a greater extent. PC-based malware is increasingly moving further down the operating system (OS) to take greater advantage of hardware. Mobile malware will probably follow the same trajectory.

Bootkits, malware that replaces or bypasses system startup, also threaten mobile devices. Although rooting one’s own smartphone opens the device to extra features or to replacing the OS, it can also allow attackers to load their own modified OS. Whereas a mobile rootkit will simply modify the existing OS to evade detection, a bootkit can give an attacker much greater control over a device.

For example, the Weapon of Mass Destruction (WMD) mobile penetration-testing toolkit runs on old Windows Mobile phones. WMD installs itself using tools developed to load Linux on Windows Mobile phones and allows the user to reboot to the original OS. Attackers have already used old root exploits to hide themselves; as new exploits are developed, attackers will eventually install their own custom firmware.

Although Android is the most widely targeted OS, the danger extends beyond Android and Windows devices. Apple’s strict policy of only allowing limited functionality is leading to more people ‘jailbreaking’ their iPhone. This allows users to download and install apps not supported by the native OS (iOS). Most jailbreaking tools automatically install Cydia, a native iOS APT client used for finding and installing software for jailbroken iOS devices. Since software programs available through Cydia are not required to adhere to App Store guidelines, many of them are not typical self-contained apps but instead are extensions and customizations for iOS and other apps. Users install these programs to personalise or customise the interface in ways not permitted by Apple, adding desired features, fixing annoyances, and making development work on the device easier by providing access to the filesystem and command-line tools. For example, jailbreaking enables users to apply themes that change the iPhone’s wallpaper as well as its icons. It can also allow video recording on older phones like the iPhone 3G that do not natively support it. And, with the installation of Secure Shell (SSH), a network protocol for secure communications, users have the ability to access every part of the iPhone, as with a Mac, rather than just those specific areas allowed by Apple.

The other principal reason for jailbreaking an iPhone is to get cheaper calls when travelling abroad. By jailbreaking the phone a user can switch carriers, and then just buy a local pay-as-you-go SIM card and pay local rates for calls. The device may not have full functionality when the other SIM is being used, but it can save the user a lot of money. Most users would not consider the security risks of doing this, and many would not even realise there are any. But when a user jailbreaks an iPhone and enables SSH the device is more accessible from the outside. Most people who jailbreak their smartphone, or purchase a jailbroken and unlocked phone, do not change its default ‘alpine’ password, which allows hackers easy access to the device. That it is necessary to change the password is recognised by the developers of the ‘legitimate’ breaking tools, and Cydia’s home screen even provides a Root Password How-To button which shows users how to change the password. However, surprisingly few users ever do.

Banking on the bus

Smartphones are now sophisticated enough for users to do their online banking anywhere they can get a wi-fi or 3G signal. Banking details are a tempting target for cybercriminals, and it is impossible to imagine they would not try to access them via users’ mobile devices, especially if the operating system has been conveniently rendered accessible to attack. PC users have seen attacks from criminals using the Zeus and SpyEye crimeware kits to steal money from online banking accounts. Both Zeus and SpyEye have begun to use mobile apps that bypass two-factor authentication and gain access to victims’ money. Zitmo (Zeus-in-the-mobile) and Spitmo (SpyEye-in-the-mobile) are two families of mobile spyware that forward SMS messages to attackers. Using this spyware required the attackers to log in manually to steal users’ money.

Cybercriminals are rapidly evolving their techniques to make their actions harder to detect. A year ago transactions performed by criminals using Zeus and SpyEye could easily be tracked, as they looked nothing like those of legitimate users. Now, criminals have adapted and can programmatically steal from victims while they are still logged on. This helps the criminals transactions appear to come from the legitimate users and by adding a delay seem to be performed by a real person (rather than malicious software posing as the user). Attackers have adapted quickly to every change intended to secure banking on PCs. As people use their mobile devices ever more for banking, attackers will most likely bypass PCs and go straight after mobile-banking apps. There is an increasing trend of people using their smartphone for online banking, and an increasing trend of people jailbreaking their device, but no discernible increasing trend of users becoming more security conscious. This combination suggests there could be a surge in banking fraud to come.

Of the various developers of smartphones, Apple in particular is unhappy about jailbreaking. Its official position is that jailbreaking constitutes a breach of copyright. In 2010, exemptions were made to the Digital Millennium Copyright Act (DMCA), allowing the rooting and breaking of smartphones, but Apple is likely to jump on any opportunity to overturn this decision. Whether this happens or not, companies like Apple are unlikely to go out of their way to develop solutions to problems that they view as being brought on themselves by users conducting illegal acts against the company.

Company data

An increasing threat to companies is that more and more employees are using smartphones for business purposes with little regard to security. This is especially a threat for companies that employ a BYOD (bring your own device) policy. Many employees like to have access to the advanced functionality available on a smartphone, but companies are (understandably) unwilling to pay extra to provide devices with functionality not necessary for business purposes. This means that more company data is now stored on employees’ mobile devices. This goes beyond just contact data, as was the case before smartphones existed. Employees can carry around files containing a lot of sensitive data in a relatively insecure form.

Firstly, there is the risk of theft. This, at least, is a threat employees are aware of, especially where their attention is focused by some companies’ policy of making the loss of a company phone a ‘sackable offence’.

Secondly, there is the threat that a phone could be hacked using malware. This is especially the case where an employee has rooted or jailbroken the device. If cybercriminals learn that access can be gained to a company’s data or systems by planting a piece of hidden malware on a mobile device it could cause a huge amount of damage, especially as this is a route into the company’s data that bypasses traditional antivirus solutions.

Both for personal and company data, attacks on mobile devices could well be a new paradigm. The fact that some attacks have already been detected, and that a rapid evolution in technique has been observed, suggests it is already beginning.

Recent research shows that the companies at greatest risk are smaller business. Although they have less to steal, their limited budgets mean that security cannot keep pace with the evolving threat from mobile devices.

A survey conducted by risk management company Mobilesafe determined that small and medium sized enterprises (SMEs) are particularly vulnerable to security risks from mobile devices that employees use to access and download company data.

As part of a private beta program, participants in the survey evaluated a product that assesses the security risk of mobile devices accessing their company’s network. Over four months, Mobilisafe’s mobile security product mapped pre-existing and newly discovered vulnerabilities to devices. The study included an analysis of more than 134 mobile operating system and application vulnerabilities, segmented by degree of severity from low to high.

The analysis showed that SME IT managers cannot keep up with the rate of discovery of severe vulnerabilities these devices bring to their corporate networks. In addition, SME IT departments lack a standardised approach to mitigating the risks from different types of mobile devices, as they do with laptops, desktops and servers. Although they recognise the exposure to mobile device security risk, SMEs do not posses adequate tools to sufficiently assess and mitigate these risks.

The disposable nature of mobile devices means that the threat is even greater. There is a burgeoning reseller market for replaced devices, many of which are not properly cleared of personal information. According to an informal survey by mobile and forensics specialist Disklabs, half the mobile devices sold on eBay still contain personal information and other data input by the previous owner.

Ultimately, there is a stable of emerging threats from mobile devices that presents a serious risk to both companies and individuals. Until users wake up to the threat and recognise the role they need to play in data security on mobile devices it will be extremely hard to mitigate.