Mobile computing ripe for 'catastrophic malware disaster,' report states

The number of reported software vulnerabilities last year continued a four-year decline, but criminals are following their online victims by refocusing their attention on the most popular online activities and turning to a new generation of mobile devices, according to a pair of new cybersecurity trend reports.

“There has been a significant rise in phishing associated with social networks,” said Jeff Williams, a group program manager at Microsoft Malware Protection Center.

The 10th Microsoft Security Intelligence/ Report shows that after an increase in phishing activities targeting online gaming sites in the first half of 2010, social networking sites became the lure of choice in the last half of the year. Recorded visits to social networking phishing sites jumped from 8.3 percent of visits in January to 84 percent in December, a 1,200 percent increase.

Related stories:

Advanced persistent threats are a new way of life

New cyber threats emerging, and IPv6 won't make defense any easier

A report on malicious mobile threats from Juniper found that increasingly popular and powerful mobile devices finally have attracted the attention of malware developers.

“Already, mobile malware and exploitation techniques have reached the complexity and capabilities of their counterparts in wired networks,” the Juniper report concludes. “Malware developers are capable of researching, uncovering and leveraging weaknesses in mobile platform security models, as well as inherent weaknesses in app stores and open ecosystems.”

The mobile threat is being compounded by a lack of oversight in the marketplace and an exploding consumer base that lacks security awareness, the report states, “creating a recipe ripe for a catastrophic malware disaster.”

The Microsoft report found a polarization in criminal activity, with a small number of skilled attackers using sophisticated techniques to target a few high-value victims, while at the other end of the spectrum exploit kits are being used by the less skilled to broadcast attacks in the hope of a high number of smaller payoffs. These activities have kept the overall threat level consistent with recent years, despite some encouraging news, Williams said.

The good news in the reports is the decrease in the number of new vulnerabilities being reported, which Microsoft reports has been sliding since a peak in 2006. In 2010, the number of medium severity vulnerabilities disclosed dropped by 17.5 percent from 2009, and the number of high severity dropped by 20.2 percent. The report attributed this to better software development practices.

On a similar note, newer versions of Windows operating systems are showing lower rates of infection. Based on infections found per thousand of licenses sold, Windows XP has significantly higher rates of infection than Vista, and both have higher rates than the current Widows 7.

Industry cooperation also has succeeded in combating a number of online threats by taking down several prominent botnets and effectively eliminating the Conficker command-and-control system.

Spammers who use these networks adapt by moving to new ones, but Williams said progress is being made. “In the long run, we will make significant strides,” he said.

In the mobile environment, developers of exploits are following the crowds to the Google Android operating system, which has become the target of choice, said Dan Hoffman, chief mobile security evangelist for Juniper.

Overall, the older Symbian operating systems still has the largest number of exploits available, he said. “Symbian has been in existence for a long time,” and still has the largest installed based. “However, the majority of new signatures now are for Android.”

Overall, mobile malware grew 250 percent in 2010, Juniper found, and the number of Android malware samples grew 400 percent from June 2010 to January 2011. Two primary factors contribute to the Android focus, Hoffman said: The Android is the cool new device being rapidly adopted, and there are few restriction on software that can be written for it.

“Just about anybody can write an app for Android,” he said. “There is not much vetting going on.” The market for applications for Apple’s IOS is much more regulated with fewer rogue applications.

“The Google Android mobile operating system, as the dominant growing force in the mobile device market, was the biggest target of malware and exploit developers in 2010,” the Juniper report states. “Malicious individuals took advantage of a market with little oversight and a large and exponentially growing number of new users who were largely uneducated, unaware, or disinterested in mobile security. It was, in effect, a perfect storm.”

Hoffman said the technology exists to bring the level of mobile device security up to that of laptops, which mobile devices are in many ways replacing. Although laptop security is not perfect, “the vast majority of government and enterprise laptops at least have a baseline of security,” Hoffman said. But with mobile devices, “you would be hard pressed to find any baseline security.”