The failure of mobile app developers to patch critical secure sockets layer (SSL) vulnerabilities potentially affects millions of mobile phone users, according to Intel Security. The IT firm released its McAfee Labs Threats Report: February 2015, including assessments of the mobile threat landscape.
McAfee Labs also detailed the increasingly popular Angler exploit kit, and warned of increasingly aggressive potentially unwanted programs (PUPs) that change system settings and gather personal information without the knowledge of users. McAfee Labs researchers say that mobile app providers have been slow to address the most basic SSL vulnerabilities: improper digital certificate chain validation. In September 2014, the Computer Emergency Response Team (CERT) at Carnegie Mellon University in the US released a list of mobile apps possessing this weakness, including apps with millions of downloads to their credit.
In January, McAfee Labs tested the 25 most popular apps on CERT’s list of vulnerable mobile apps that send login credentials through insecure connections and found that 18 still have not been patched despite public disclosure, vendor notification, and, in some cases, multiple version updates addressing concerns other than security. The researchers simulated man-in-the-middle (MITM) attacks that successfully intercepted information shared during supposedly secure SSL sessions. The vulnerable data included usernames and passwords and in some instances, login credentials from social networks and other third party services.
Although there is no evidence that these mobile apps have been exploited, the cumulative number of downloads for these apps ranges into the hundreds of millions. Given these numbers, McAfee Labs say that their findings suggest that the choice by mobile app developers to not patch the SSL vulnerabilities has potentially put millions of users at risk of becoming targets of MITM attacks.
Raj Samani, EMEA CTO for Intel Security, said: “Our reliance on mobile devices has been continually increasing over the past few years, with them and the applications that run on them now essential tools for both consumers and businesses. With this in mind, it is therefore important that mobile apps have the level of protection required for consumers and businesses to use them safely and so mobile app developers must take responsibility for ensuring that their applications follow secure programing and vulnerability responses.”
Another development late last year followed by the IT security firm was the rise of the Angler exploit kit – one of the cybercrime-as-a-service economy’s latest contributions to off-the-shelf tools. Researchers saw cybercriminals migrate to Angler in the second half of 2014, when it surpassed Blacole in popularity among exploit kits. Angler employs a variety of evasion techniques to remain undetected by virtual machines, sandboxes, and security software, and frequently changes patterns and payloads to hide its presence from some security products.
This crimeware package contains attack features and new capabilities such as file-less infection, virtual machine and security product evasion, and the ability to deliver a wide range of payloads including banking Trojans, rootkits, ransomware, CryptoLocker, and backdoor Trojans.
The report also identified a number of other developments in the final quarter of 2014:
· Mobile Malware. McAfee Labs reported that mobile malware samples grew 14 percent during the fourth quarter of 2014, with Asia and Africa registering the highest infection rates. At least 8 percent of all McAfee-monitored mobile systems reported an infection in Q4 2014, with much of the activity being attributed to the AirPush ad network.
· Potentially Unwanted Programmes. In Q4, McAfee Labs detected PUPs on 91 million systems each day. McAfee Labs sees PUPs becoming more and more aggressive, posing as legitimate apps while performing unauthorised actions such as displaying unintended ads, modifying browser settings, or collecting user and system data.
· Ransomware. Beginning in Q3, the number of new ransomware samples began to grow again after a four-quarter decline. In Q4, the number of new samples grew 155 percent.
· Signed Malware. After a brief drop in new malicious signed binaries, the pace of growth resumed in Q4 with a 17 percent increase in total signed binaries.
For a full copy of the McAfee Labs Threats Report: February 2015 visit: www.mcafee.com/February2015ThreatsReport
For a list of safety tips on how individual users can protect themselves from the threats details in this quarter’s report visit: http://mcaf.ee/5z86x
For guidance on how mobile app developers can address security vulnerabilities visit: http://mcaf.ee/ndwei.
