Mobile theft

Android is the most popular operating system for handhelds, and among virus makers it ranks second in popularity, after Windows. The first malware for Android appeared in 2010.

Because Android is an open source operating system that enjoys worldwide popularity and enables users to install applications from any source, most malicious programs are designed to infect this platform.

This graph shows how the number of entries for Android malware in the Dr.Web database has grown over time

Growth in the number of entries in 2014—102%!
Since 2010 the number of entries has increased 189 times

By April 1, 2015, the number of signatures in the Dr.Web database for Android reached almost 9,000.

In just the first three months of 2015, the database expanded by more than 25%!

Also, bear in mind that one Dr.Web signature facilitates the detection of more than one malicious program.

In many cases, users themselves download and install malware on their mobile devices!

For example, Android.Plankton, which collects and transmits information about infected devices to criminals, was loaded by users manually from Google Play (originally Android Market) over 150,000 times (!) before it was removed from the catalogue by the portal's administration.

Statistics provided by Dr.Web for Android show that approximately 50% of users enable the option for installing applications from unknown sources (i.e., not from Google Play). This means that users can install malicious applications downloaded from a forum or any other questionable site.

Social engineering techniques enable criminals to spread malware onto handhelds on a massive scale. For example, more than 30,000 South Korean Android device owners downloaded the banking TrojanAndroid.SmsBot.75.origin while trying to track the fate of a “postal delivery”.

For example, to reduce the likelihood that users will detect its unwanted activities, the dialler Android.Dialer.7.origin disables the earpiece of the mobile device during unsolicited phone calls, and to remove all traces of its activities, it also clears the system log and call list of all the information that can help expose it.

Trojans that steal money from mobile accounts by subscribing users to paid services are also able to keep a low profile very well. Normally subscribing users to chargeable services involves a confirmation message which is sent when the operation is successfully completed. Trojans hide these SMS so that users don’t catch on to them too soon. Some malware can automatically send SMS containing a verification code to complete the authorization process for paid services — these messages are often intercepted and hidden by Trojans too.

Many "advanced" Trojans are disguised as legitimate software, but as soon as they are launched, they remove their icon and run in the background so that users won't notice them.

Attackers also embed Trojans in Android firmware and make them an integral part of the operating system. These ”guerrillas” enjoy elevated permissions and can covertly perform the widest range of unwanted activities.

To avoid being detected by anti-viruses, some Trojans come with features that enable them to neutralise security software: anti-viruses can be blocked or completely removed from a device.

Android.SpyEye.1

Should a user of a desktop or laptop go to a bank site whose address is on the invading Trojan’s list, the malware will inject text or web forms into the loaded page to lure the user into divulging their account access credentials. An unsuspecting victim loads a bank page in their browser to access their account and discovers that the bank has introduced new security measures with which they must comply in order to use the online banking client. They are also prompted to download an update for the client program—this update contains this Trojan horse. This program intercepts and forwards to the attackers one-time online banking passwords which are delivered with short messages.

Android.BankBot.29.origin

The Trojan tries to acquire administrator permissions on the device by concealing the corresponding system prompt behind its dialogue box, so that the user is very likely to grant the requested permissions to the application. After that, stealing the money is a cakewalk.

Stealing money by sending SMS

For example, Android.SmsSend Trojans transfer money from a mobile account to criminals by sending premium messages from compromised devices.

According to statistics aggregated by Dr.Web for Android, in 2014 Android.SmsSend programs were detected 20,223,854 times.

Android.SmsBot malware can also send, intercept and delete SMS.

Statistics provided by Dr.Web for Android show that Android.SmsBot programs were detected 5,985,063 times in 2014.

Stealing contact information

Although this doesn't sound like much of a problem, there is also money to be made here. Information about any actual contact can be sold, and there are several categories of buyers.

Spammers

Spam is a thriving business. And it's not just about sending mass spam mailings of harmless ads.

Sending bulk SMS containing malware download links is now one of the most popular ways to distribute Android threats.

For example, Android.Wormle.1.origin can be spread with SMS messages that are sent to all the contacts found in a compromised device’s phone book. By the end of November 2014, Android.Wormle.1.origin managed to infect more than 15,000 Android handhelds in about 30 countries.

Phishers

They collect contact information to send those contacts emails containing links to bogus sites that appear to belong to legitimate banks or payment processors. If the contact who receives the email does go to such a site, a phisher may trick them into providing their online banking login and password or bank card information. Confident that they have gotten onto a legitimate site, users enter all the requested information into the web form voluntarily.

Criminals mounting DDoS attacks

These individuals need contact information to infect mobile devices and use it in DDoS attacks on various sites, e.g., those belonging to their customer's competitors.

Spies

(secret services and competitors). Every contact is a godsend for a spy or blackmailer. Also, people spying on you can read your correspondence, record your conversations and upload your photos to a remote server.

For example, Android.Spy.130.origin sends intruders details on SMS correspondence, outgoing calls, and the device's location and can also secretly call a specified number, thus turning the smart phone or tablet into a covert listening device.

Growth in the number of Android.Spy malware definitions in the Dr.Web virus database

Use Dr.Web for Android Comprehensive Protection free of charge!

If you have a commercial license for

(an electronic license or a boxed product).

The number of free licenses provided to you for your mobile devices is equal to the number of PCs covered by your purchased license.

You don’t have a Dr.Web license yet? That’s easy to fix!

Buy Dr.Web Security Space Buy Dr.Web Mobile Security