Security firms see rise in smartphone cyber-attacks

Cyber-crooks are increasingly taking aim at smartphones, following their prey as lifestyles migrate to Internet-linked mobile devices, according to new reports by online security firms. Symantec's annual Norton Cybercrime Report released calculated that such crimes cost worldwide consumers $110 billion in the past year, with an increase in attacks on mobile devices and online social networks. "Cybercriminals are changing their tactics to target fast-growing mobile platforms and social networks where consumers are less aware of security risks," said Norton Internet safety advocate Marian Merritt. Lookout Mobile Security estimated that millions of dollars have been stolen from people worldwide during the past year using smartphone "malware," with a "toll fraud" virus proving to be a popular tool. Toll fraud programs prompt smartphones to send bogus premium text messages, charges for which are added to telecom service bills. The money winds up in the pockets of the people responsible for the infections. Toll fraud malware is designed to hide what it is doing, and charges can go unnoticed in complex mobile service billing statements, according to Lookout senior product manager Derek Halliday. Lookout, which has more than 25 million subscribers to its service, said that in the past 12 months the amount of toll fraud viruses found on devices climbed from 29 percent to 62 percent. "The mobile malware industry has matured and become a viable business model," Halliday said. "Toll fraud is the most prevalent type of malware." The likelihood of being infected was highest in Eastern Europe, Russia, and China, where smartphone users get "apps" from unofficial sources instead of trusted outlets such as Apple or Google online shops, according to Lookout. Infected apps may be made available free at file-sharing sites, discussion forums, or through links sent in messages or posted on social networks. "There are entire systems developed to aid distribution of this malware," Halliday said. "The bad guys are really focusing on improving and scaling their distribution techniques. They are even gaming legitimate app systems." Cyber-criminals also create programs to boost ratings of tainted apps to make them more appealing to unsuspecting smartphone users. Websites booby-trapped with malicious code remain the most common means of attack. Aside from toll fraud, there is "adjacking," in which hackers take a popular application and change segments of its code so that they reap the benefit of advertising. "When we look at the data, 12 months ago we saw a lot of evidence of experimentation that indicated malware developers were looking to see what stuck," Halliday said. "With toll fraud they have found a business model that seems to be working; now they are trying to find a distribution model." Nearly a third of smartphone users have received a text message from a stranger asking them to click on an embedded link or dial an unfamiliar number, according to the Norton findings. One in five online adults told of being a cybercrime victim at a social network or on a mobile device, the Norton report found. "We do believe it is possible to be safe on mobile," Halliday said. "It is all about using caution when downloading apps, paying close attention to what you click on, and watching for the same kinds of threats seen on personal computers."