The “Five W’s” of Mobile Device Malware: W ho, W hat, W hen, W here, and W hy? … and What Can be Done About It? Kevin McPeak, CISSP, ITILv3 Technical Architect, Security Symantec Public Sector Strategic Programs

W ho Can Be Affected by Mobile Malware? Governmental, Commercial, and Home Users Apple iOSAndroid BlackBerryWindows Mobile The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? W ho Creates & Distributes Mobile Malware? Cyber Criminals and their Accomplices Malware DevelopersMules Mobile Botnet OperatorsCyber Thieves Espionage RingsHacktivists 2

W hat is Mobile Malware and How Do We Count Them? Each of these applications contain the same piece of malware embedded in them Each piece of malware is counted as one Family – If this malware is modified the new version counts as a Variant We would count the five apps as Samples We do not report on Samples, but many vendors do The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? 3

W hat is the Growth Rate of Android Malware? The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? 4

Vulnerabilities & Mobile Malware The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? W hat Mobile Platform Has the Most Vulnerabilities? …What Mobile Device Type Has the Most Threats? 5

W hat Types of Mobile Malware Exist? The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? 6

W hen is Mobile Malware Active? The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? When Mobile Data is Collected: When IMEI7 and IMSI8 numbers are taken by attackers as a way to uniquely identify a device. When Users Are Tracked: When communication data such as SMS messages, call logs, GPS coordinates, calendar events, or personal photos are exfiltrated. Or when a device is hijacked to serve as an spam relay system, thus allowing unwanted s to be sent from addresses registered to the device. When Device Settings are Changed: When an attempt is made to elevate privileges or modify OS settings to perform further actions on the compromised devices. When Bad Apps Send Out Content: When an app sends a text message to a premium SMS number, ultimately appearing on the mobile bill of the device’s owner. 7

Where is Mobile Malware Found? The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? Third-Party App Stores Hosting the Most Malware 8

Where is Mobile Malware Found? The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? 9

W hy is Mobile Malware Developed? The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? …. because There is Significant Illicit Money Being Made Premium SMS Messages Mobile Adware (Madware) Stealing Information Bank Fraud Ransomware Botnets and Spam 10

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? Information Stealing Malware Android.Sumzand 1.User received with link to download app 2.Steals contact information 3.Sends promoting app to all contacts 11

Mobile & Social Everyone Likes to be Liked And there’s an App for that! 12

Mobile & Social Instlike gives you 20 free likes on your Instagram photos And you can buy more 13

Mobile & Social Just give the app developer your login and password Don’t worry, he promises not to steal your account Internet Security Threat Report 2014 :: Volume

Mobile & Social Thousands of mobile users willing gave away their addresses and passwords for nothing more than a Like. Mobile users are at risk, even from themselves. 15

Internet of Things – The Future Wearable Devices will soon be measuring: Pulse Weight Time Slept Glucose Levels Blood Pressure Exposure to sunlight Teeth Brushing And more… As more of our personal information travels the Internet what will become of it? 16

72 % 90 % 78 % 56 % 48 % 33 % DELETE SUSPICIOUS S FROM PEOPLE THEY DON’T KNOW HAVE AT LEAST A BASIC FREE ANTIVIRUS SOLUTION AVOID STORING SENSITIVE FILES ONLINE Mobile Security IQ Source: Norton Report 17

Vulnerability Patching Service Providers iOSGoogle OEMs The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? … The Problem Exists, so What Can be Done About It? 18

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? … What Can be Done About It? (Continued) 19

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? … What Can be Done About It? (Continued) NIST Special Publication "Technical Considerations for Vetting 3rd Party Mobile Applications" Allows Federal agencies to assess the following for any given mobile app: Security Behavior Reliability Performance AppVet: In conjunction with DARPA, NIST developed the AppVet program: Allows Feds to submit an app for testing Uses open source and commercially available tools 20

The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why? Deploy Mobile Security Software Throughout Your Organization: At a minimum, this software should scan and identify threats from any mobile apps or content that the user downloads. Establish a Robust, Highly Secure Mobile Device Management Framework for Your Agency: Managing your organization’s mobile devices is not just about remote wipe commands for lost/stolen devices and OTA password resets. You should also setup a system for mobile app management across the entire app lifecycle. Likewise, you should manage your organization’s mobile content ecosystem in the same secure end-to-end manner. … What Can be Done About It? (Continued) Enforce User Mobile Security Training: Users must be constantly reminded to avoid clicking on suspicious links in messages, to keep their personal mobile devices updated, and to only download apps from officially sanctioned App Stores. 21

Thank you! Copyright © 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This document is provided for informational purposes only and is not intended as advertising. All warranties relating to the information in this document, either express or implied, are disclaimed to the maximum extent allowed by law. The information in this document is subject to change without notice. Kevin symantec.com/threatreport mobilesecurity.com/ The “Five W’s” of Mobile Device Malware: Who, What, When, Where, and Why?