Android a likely target once mobile crime pays
Connecting state and local government leaders
The technology and malware exist to exploit mobile devices, but so far the payoff hasn't been worth it for criminals to go after smart phones, Symantec researchers say.
Smart phones are becoming a viable means for distributing and executing malware, and the growing use of the open-source Android operating system is enabling an increase in malicious applications, researchers say.
“We’ve been looking at mobile devices for years now,” said Vikram Thakur, principal security response manager for Symantec. “In the last year we’ve seen a huge uptick,” in the amount of malicious software targeting the devices. “But it really isn’t paying off yet.”
The poor return on investment for mobile malware appears to be keeping the market for this type of crime small.
Related stories:
The top cyber threats of 2011, so far
Is the smart phone the new laptop?
“This is still in the informational stage,” Thakur said. “We don’t think they’re making enough money at this stage to spend a lot more time making more malware. It’s not reaching PC malware levels until the bad guys see where the money is.”
Despite the growing functionality and use of the phones, the desktop and laptop PC remains a much richer target for online criminals. “There is a lot more data on one PC,” Thakur said, and it is more likely to be used for financial transactions.
A new white paper from Symantec, “Security Response on Motivations of Recent Android Malware,” reports that many of the attacks against Android were one-off efforts that, although apparently successful, were not repeated because of the poor return.
“Only if these monetization schemes succeed do we expect attackers to continue to invest in the creation of Android malware,” the report concludes.
For mobile devices such a smart phones to become popular targets for criminals, there must be an open, ubiquitous platform to exploit, Symantec researchers said. Android, which accounted for 43 percent of the worldwide smart-phone market in the second quarter of 2011, according to information from Gartner cited in the report, seems to be fulfilling this requirement. But the opportunity to monetize the attacks is not yet mature.
There are active, money-making exploits, such as malicious applications that send unwanted texts to premium rate numbers for which the victim is billed. But such premium rate numbers usually are carrier- and country-specific, limiting the size of and return on the attack.
Search engine poisoning and delivery of pay-per-click ads are other schemes. But where a full-sized PC screen can display 12 to 15 ads, a phone screen will display just one, Thakur said. Rogue antivirus applications for mobile devices appear to be in their infancy because legitimate mobile antivirus is also only getting started.
It also is possible to hijack financial transactions and steal data from mobile devices, the report states.
“Stealing information such as log-in credentials and financial data is the primary motivation for malware in the PC space,” it states. “Mobile devices provide an additional vector when devices are used as payment devices via protocols such as near-field communications that allow someone to pay for goods using their mobile device. How malware may take advantage of mobile payment devices remains to be seen, as this payment method is still in its infancy.”
Thakur warned that online criminals are not ignoring mobile devices while waiting for the market to develop.
“They are absolutely ready,” to exploit them as they become more valuable, he said. The malware works well and there are effective methods of distributing it through Trojan horse programs and downloaded applications. “We’re seeing it get more structured. The more financial transactions or data stored on a phone, the more motivated the attackers are going to be.”
Smart-phone users appear ready to use their devices for transactions, Thakur said. “The users are usually very quick to adopt any technology made available to them. But the vendors need to adopt it, too.”
The use of near-field communications to pay for retail purchases requires not only the technology and software on the smart phone but also at the point of sale. “The infrastructure usually takes longer,” he said.