Freely subscribe to our NEWSLETTER

We’re all wise to the risks our online antics pose to our security. We’ve learned not to trust emails from Nigerian Bankers offering to share millions in exchange for a small upfront handling fee. Our banks haven’t monitored fraudulent activity so they don’t need us to verify our account details by confirming our information. Messages from DHL with attachments informing us about deliveries we’re not expecting don’t fool us into opening the document. We’re even wise to the links in emails that want us to visit websites and win prizes. Why don’t they work? Because we’ve learned the hard way.

When these scams first started circulating people fell for the lies - hook line and sinker. Some of you will remember, or heard about, the chaos caused in 2000 when people opened an attachment to find out who loved them and spread the I Love You worm. In a single day it travelled around the world causing an estimated $5.5 billion in damages. It was a huge wakeup call and many organisations issued warning to employees and instructions to make sure they never fell victim again.

So, why aren’t people heeding the warning that malware has gone mobile and taking steps to protect themselves? The reality is there is a false sense of security surrounding mobile use, especially as victims currently are few and far between, but I’m here to dispel the myths and banish the fantasy.

Myth One: Mobile Operating Systems are sandboxed – so we’re safe
Anyone that still believes this is true is living in fantasy land.

We have already seen malware that attacks sandboxing – Droid Dream is just one that recently made the headlines. It exploited a vulnerability in the android operating system and obtained root privileges, downloading and installing additional arbitrary pieces of software, to assume virtually limitless control of the infected smartphone.

Myth Two: Mobile Applications are Controlled – Apple and Google are watching our backs
Anyone that still believes this myth has a serious case of loyalty overload.

Droid dream was found in applications that were being sold through the Google app store proving that the semi-closed, or walled garden, approach that’s supposed to protect our mobile devices and prevent malware from infecting the device is flawed!

The simple reason is Google et al want, and actively encourage, developers to create apps with just a $25 entry fee. It’s unsurprising that malware writers and spammers are happy to flex their muscles and get a piece of the action. Rogue developers all too easily can get permission or approval to upload their infected applications – that’s what they did with Droid Dream. While Google did act swiftly and patched the hole, and removed it from the application store, you can rest assured that the developers are looking for ways to obtain sufficient privileges to prevent Google from removing malicious applications from the infected devices in the future.

Myth Three: There’s no money in mobile malware so fraudsters aren’t interested
Wake up people - we’re already in the middle of a third generation of financial malware!

­- Zero generation had users unwittingly dialling premium numbers or sending SMS texts to services that charged them for the privilege
– First generation was malware that engaged simple tricks – for example changing the host file of an infected device and redirecting the users mobile browser to a phishing site
– Second generation has seen malware increasingly infect the mobile device that works in conjunction with malware already infecting the desktop. In case you’re not sure how this scam works, basically malware infects the mobile device and steals SMS verification messages and reroutes them to the fraudster. With financial transactions banks offer users additional security by sending authentication codes to the users registered mobile, however, if this is controlled by a fraudster then there’s nothing stopping them completing financial transactions on your behalf. By the same token, that same mobile malware is controlled by the SMS channel so attackers can send SMS with commands that the malware would intercept and treat like controlling commands.
­- The next generation of mobile malware will actually attack the mobile device focusing on mobile browsers or mobile applications themselves to abuse the current users session and commit fraudulent transactions, possibly even with the unintended aid of the user. While at the moment this could be argued as myth it won’t be long before it becomes reality, we’re just waiting for banks to introduce the service. Fraudsters have all the tools they need to effectively turn mobile malware into the biggest customer security problem we’ve ever seen. They’re lacking one thing - customer adoption.

Banks are actively advertising their applications for people to download and use from their smartphone and tablets wherever, whenever. As the money trail becomes mobile, so will the attention of our new age of bank robber.

Stop the Rot Before the Damage is Done

I said at the start of this article that people need to heed the warning that malware has gone mobile and taking steps to protect themselves. As I’m sure you’ll agree, I’ve proven it’s not only possible but is happening, so it’s time to start affording your smartphone the same protection you do the PC.

DroidDream was preventable. Yes, Google should have identified the malware and prevented its download in the first instance but that’s not what we mean - DroidDream actually exploited a vulnerability that have already been identified and patched. The problem for many, unfortunately, is 99 percent of Android users were still exposed because their smartphone had not been updated. We regularly update the operating software of our PCs and its time we afforded the same protection to our mobiles.

As online fraud is mostly a big numbers game, attacking mobile bankers is not yet an effective fraud operation. But expect a change. In a year from now this is all going to look completely different as more users start banking from their mobile phone and fraudsters release their heavy guns. You’ve been warned.