Four years ago, F-Secure Chief Research Officer Mikko Hypponen was talking about malware infections on mobile phones while few others were paying attention.
With the growing use of Internet-enabled phones, particularly Apple’s iPhone and RIM’s Blackberry, he sees more opportunities than ever for malicious activity. But, surprisingly, he sees a quiet mobile malware landscape at the moment.
“It’s quite quiet on the mobile side. We now have over 400 known mobile phone viruses and Trojans, but most of those target the older smartphone systems,” he says. “Most of the current systems have improved built-in security.”
Hypponen believes the most likely mobile risk today isn’t mobile viruses or Trojans, but mobile spying tools like FlexiSpy, Neocall or Mobile Spy. These commercial tools run fine even on the latest versions of Symbian, Windows Mobile or Blackberries, he says.
Meanwhile, iPhone has been the target of some attacks, but it still has a miniscule market share globally compared to the big boys like Nokia. That means a smaller bull’s-eye. But as that market share increases, he expects more attacks to materialize.
In the short term, Hypponen is looking at some of the more notable events of 2008 for clues on what will happen in 2009.
“The defining moment in 2008 was the change from smtp to http,” he says. “Now the miscreants’ preferred way of infecting net users is no longer e-mail, but Web-based drive-by-downloads. Today you’re more likely to get infected by surfing the Web than reading your e-mail.”
The explosion of malicious SQL injection attacks on trusted websites, combined with the mass creation of new malicious websites means that in 2008 the Internet was more dangerous than at any other time in the past, he says.
“Also to be noted, many of the attack-in-depth attacks being deployed from these sites don’t just target vulnerabilities in the operating system or the browser, but increasingly they target vulnerabilities in browser plug-ins and add-ons – which people rarely Update,” he says.
Andrew Storms, director of information technology at nCircle Network Security, is more convinced that bigger phone-based threats are around the corner.
One of the biggest shifts in the threat landscape is the proliferation of iPhones and Blackberries — devices that are already almost as ubiquitous as laptops.
With Google Android entering the scene, he worries the problem is just going to become more complex.
“The biggest consequence of the proliferation of mobile devices is that enterprise data is more and more dispersed, but the IT and security teams have no eyes or ears for these devices,” he says.
“Already security professionals are struggling to keep their customers productive in an environment where gadget makers have failed to keep up with the fast-moving security threatscape.
IT teams would like to treat these devices as laptops but many of the tools don’t translate directly to smart phones.”
Sensitive corporate data on smart phones will probably draw only a small number of very targeted attacks; but it only makes sense that security pros expect attack trends on mobile devices to mirror trends for all other computing environments, he says.
Ultimately, the biggest threats will probably be targeted at the treasure trove of personal information stored on a smart phone.
“No one should be surprised if we see the first major threat of the migration of botnets from traditional computing devices to mobile platforms,” Storms says.
“Some smart phones already have more memory and higher processing power than laptops from just a few years ago.
A constantly moving and adapting mobile botnet presents a compelling business proposition for hackers and an interesting real-world case study in chaos theory.”
