NEWS HIGHLIGHTS
- McAfee Labs identifies more than 5,000 versions of 21 consumer mobile apps containing colluding code capable of data exfiltration, file inspection, fake SMS messages, and other malicious activity
- New strain of Pinkslipbot Trojan features anti-analysis and multi-layered encryption
- New ransomware grew 24% quarter-over-quarter in Q1 2016
- Threat researchers saw a 17% quarter-over-quarter increase in new mobile malware samples in Q1 2016
- Mac malware spiked Q1 primarily due to an increase in VSearch adware
Intel Security released its McAfee Labs Threats Report: June 2016, which explains the dynamics of mobile app collusion, where cybercriminals manipulate two or more apps to orchestrate attacks capable of exfiltrating user data, inspecting files, sending fake SMS messages, loading additional apps without user consent, and sending user location information to control servers. McAfee Labs has observed such behavior across more than 5,000 versions of 21 apps designed to provide useful user services such as mobile video streaming, health monitoring, and travel planning. Unfortunately, the failure of users to regularly implement essential software updates to these 21 mobile apps raises the possibility that older versions could be commandeered for malicious activity.
Widely considered a theoretical threat for many years, colluding mobile apps carry out harmful activity together by leveraging interapp communication capabilities common to mobile operating systems. These operating systems incorporate many techniques to isolate apps in sandboxes, restrict their capabilities, and control which permissions they have at a fairly granular level. Unfortunately, mobile platforms also include fully documented ways for apps to communicate with each other across sandbox boundaries. Working together, colluding apps can leverage these interapp communication capabilities for malicious purposes.
McAfee Labs has identified three types of threats that can result from mobile app collusion:
- Information theft:
- Financial theft:
- Service misuse:
Mobile app collusion requires at least one app with permission to access the restricted information or service, one app without that permission but with access outside the device, and the capability to communicate with each other.
“Improved detection drives greater efforts at deception,” said Vincent Weafer, vice president of Intel Security’s McAfee Labs group. “It should not come as a surprise that adversaries have responded to mobile security efforts with new threats that attempt to hide in plain sight. Our goal is to make it increasingly harder for malicious apps to gain a foothold on our personal devices, developing smarter tools and techniques to detect colluding mobile apps.”
The McAfee Labs report discusses forward-looking research to create tools, initially used by threat researchers manually but eventually to be automated, to detect colluding mobile apps. Once identified, colluding apps may be blocked using mobile security technology. The report suggests a variety of user approaches to minimize mobile app collusion, including downloading mobile apps only from trusted sources, avoiding apps with embedded advertising, not “jailbreaking” mobile devices, and most importantly, always keeping operating system and app software up-to-date.
