Four Ways Malware Sneaks on to Mobile Devices

Fraudsters cast their nets wide in the hopes of snagging unaware and unsuspecting consumers who will unwittingly download malicious applications on to their mobile devices which can then be exploited for short or long-term financial gain by cybercriminals.

• By Michael Lynch
• Aug 07, 2017

In its recently released Threat Intelligence Report, Nokia reported that mobile device infection rates rose steadily throughout 2016, reaching an all-time high in October and growing 63% over the first half of the year. In October of last year, malware had infected 1.35 percent of mobile devices, according to the report – an all-time high.

Given the exponential increase in mobile payments and mobile wallet adoption among businesses seeking increased engagement and consumers seeking increased convenience, it should come as no surprise that fraudsters are waiting in the wings to exploit security loopholes in this emerging payments channel before they can be patched.

Businesses wishing to leverage the mobile channel for increased engagement need be aware of these risks to help protect consumers and themselves.

Fraudsters cast their nets wide in the hopes of snagging unaware and unsuspecting consumers who will unwittingly download malicious applications on to their mobile devices which can then be exploited for short or long-term financial gain by cybercriminals.  Here are four common ways malware can infiltrate a mobile device:

1. Downloading malicious apps directly from an app store or a third party site

From the consumer perspective, it is easy to be fooled by apps that impersonate legitimate use applications. Recent malware has disguised itself as weather apps, flashlight apps, and even Adobe Flash Player updates. Millions of consumers have been duped into installing these apps that then turned out to be malware targeting bank credentials.

Due to differences in the amount of control exerted by the two main mobile app stores, there can be differing levels of risk for downloading malicious apps directly from the store, depending on the device’s operating system. A more open development philosophy offers benefits like more freedom for developers to create apps not available to competing operating system users, but it also means cybercriminals can often pass malware to unsuspecting users more easily.

Typically, a criminal actor will release a perfectly harmless and useful app on to a more open store to pass initial screening conducted by the company. Then, shortly after release, the developer will upload what looks like an upgraded version, but which actually contains malware. Unsuspecting users then download the update – and the malware – on to their mobile devices.

However, just because a provider may exert greater control over developers and apps doesn’t mean it is immune to malicious apps. In some cases, the illicit trust both developers and end users have in a closely regulated store can lead to security failures.

According to CBS news, in one widely-publicized incident from 2015, Apple confirmed that 39 malware-infected apps had been found and removed from its China App Store. The story stated that “The malicious code spread through a counterfeit version of Apple's Xcode tools used to create apps for its iPhones and iPads, according to the company. It said the counterfeit tools spread when developers obtained them from ‘untrusted sources’ rather than directly from the company.”

Third party app stores are even more dangerous. On such sites a cybercriminal has the freedom to make an app appear similar to a mainstream product. A consumer might be phished into going to such a site to download the app or may even be directed there by a browser search. Once downloaded, these apps may knowingly, in the case or ransomware, or unknowingly impact the consumer by exploiting the device to steal data.

2. Phishing/Smishing (Social Engineering)

Phishing/smishing involves fraudsters sending what appear to be legitimate emails (phishing) or SMS text messages (smishing) from businesses that a consumer may actually do business with in the hopes that the consumer will disclose personal information or take some other action the fraudster desires.

We tend to associate such social engineering more with enticing consumers to a fraudulent website designed to replicate a legitimate site where they will input login credentials or provide personal information such as a SSN; however, such emails or text messages can also include Web links that direct users to sites where malicious software is then downloaded to their devices.

3. Malvertising

Malvertising involves malware which is inserted into advertisements that appear on legitimate websites or appear to be from legitimate advertisers.  It is a particular threat to mobile devices because they contain two possible points of entry – the browser and individual apps. Malvertising becomes embedded on a website when developers unknowingly incorporate a malicious advertisement onto a legitimate webpage. Devices can then become infected with or without users clicking the advertisements.

Malicious advertisements are adept at spreading malware because a lot of effort is put into making them appear legitimate, in addition to the fact that the ads appear on legitimate sites for legitimate products.  Malvertising malware can be embedded within the ad itself or can redirect users to a malicious site where the device becomes infected, which is a successful tactic because users expect to be taken to a different site when clicking an online ad. 

Malvertising also enables cybercriminals to attack end users employing firewalls and other security measures that would normally block malware since the ads appear on trusted sites.

4. Sideloading

Sideloading occurs when a user thinks they did their due diligence and believe what they are installing is safe, but it’s actually malware. Examples can include games or utilities not found on the playstore. Sideloading can be an unsafe practice, as the protection of the store is removed. Tremendous care must be taken to avoid mistakenly installing malware.

Mitigating Risk

While information security professionals are up to speed on the various ways end users unknowingly expose mobile devices to malware – as well as the havoc it can wreak – the challenge lies in how best to protect consumers to stop malware before it becomes embedded on the device, or how to secure information on already-infected devices.

Aside from educating the market place on the various ways malware infects mobile devices to create greater awareness among consumers, the best way for businesses to protect consumers – and themselves – is to protect the device itself.

Here are some common ways businesses can protect mobile devices:

Malware detection. Businesses can protect their consumers using signature based malware detection, and then determine what action to take to notify or in some cases even block the consumers access, depending on their policy and the situation.

While signature based detection is certainly a first line of defense, malware is not always caught by signatures, which is often the case when a new malware variant is released. A device therefore must also be scanned for suspicious behavior. For example, has the device been rooted or jailbroken – perhaps without the customer’s knowledge, has the customer mistakenly loaded a malicious app, are there unusual permissions for the device, is there evidence of an unusual configuration for the device, or is this an unusual location for the consumer or indication of location spoofing? This type of device risk assessment is very possible on mobile due to the rich data that is available on mobile devices.

Behavioral Analysis. Consumer behavior should also be analyzed in the event that malware is not detected. The foundation of behavioral analysis is creating a strong mobile device ID. Once the device has been permanently identified, the business can create an association between a customer and a device. Behavioral analysis, for example, ensures the device is one typically associated with the customer, ensures the transaction activity is typical for this customer, and assumes an increased level of risk with first-time access. It is important to employ these capabilities to ensure there is not a transaction taking place that the customer is unaware of even when the device is still in their possession.

End-to-End Encryption. Protecting the mobile device from malware and allowing it to still transact is important. Protection against replay attacks, man in the middle attacks (MitM), man in the application, or session hijack attacks are important. To protect against these attacks, end-to-end encryption from an application to the organization’s server is critical. Many applications transmit sensitive information: credentials, account information, transaction information, application information, etc. If malware is running and has bypassed other detections, it is important to ensure this information can’t be decrypted, intercepted or replayed, and only the consumer within the application itself can read messages.

A holistic approach to analyzing high-risk indicators can help ensure organizations understand device trustworthiness and scan for malware. In addition, preventing malware from intercepting sensitive information even if malware is undetected is critically important to a comprehensive approach to device security.

Having the ability to detect malware infections on users’ devices, or to protect a device and its information even in the presence of malware, allows businesses to seamlessly authenticate good consumers, make more confident transaction decisions, and expand mobile channel functionality without the risk of fraud.