Malware Targets Android Smartphones

The Internet Crime Complaint Center (IC3) is a partnership between the FBI and the National White Collar Crime Center (NW3C) and has issued a warning about increasing malware attacks on Android devices.

The most prevalent attacks have consisted of Loozfon, an information stealing malware and FinFisher, a spware capable of taking over particular components within a mobile device.

The Loozfon malware works by luring in victims through a set of links. One particular example that the IC3 gives is the use of links within advertisements, such as ones that promise profitable income from merely sending emails at home. Clicking on these links will lead users to a website that tries to push Loozfon onto the user's device. Once the malware is on the device, it steals contact information from the address book along with the personal information of the device itself.

FinFisher, on the other hand, is spyware capable of taking over particular components of a mobile device. Once infected, these components can be remotely controlled and monitored from anywhere. Like Loozfon, FinFisher can be transmitted through a web link, but it can also be transmitted by text messages as well (most commonly disguised as a system update).  

The IC3 notes that these are merely two examples of the malware that is currently attacking Android systems.

General Security Tips

Besides warning users, the governmental organization has compiled a list of safety tips for users to protect their mobile devices and data:

• When purchasing a Smartphone, know the features of the device, including the default settings. Turn off features of the device not needed, as this will/ minimize the attack surface of the device.
• Depending on the type of phone, the operating system may have encryption available. This can be used to protect the user's personal data in the case of loss or theft.
• With the growth of the application market for mobile devices, users should look at the reviews of the developer/company who published the application.
• Review and understand the permissions you are giving when you download applications.
• Passcode protect your mobile device. This is the first layer of security to protect the contents of the device. In conjunction with the passcode, enable the screen lock feature after a few minutes of inactivity.
• Obtain malware protection for your mobile device. Look for applications that specialize in anti-virus or file integrity that helps protect your device from rogue applications and malware.
• Be aware of applications that enable Geo-location. The application will track the user's location anywhere. This can be used for marketing, but can be used by malicious actors raising concerns of assisting a possible stalker and/or burglaries.
• Jailbreak or rooting is used to remove certain restrictions imposed by the device manufacturer or cell phone carrier. This allows the user nearly unregulated control over what programs can be installed and how the device can be used. However, this procedure often involves exploiting significant security vulnerabilities, and increases the attack surface of the device. Anytime a user, application or service runs in "unrestricted" or "system" level within an operation system, it allows any compromise to take full control of the device.
• Do not allow your device to connect to unknown wireless networks. These networks could be rogue access points that capture information passed between your device and a legitimate server.
• If you decide to sell your device or trade it in, make sure you wipe the device (reset it to factory default) to avoid leaving personal data on the device.
• Smartphones require updates to applications and firmware. If users neglect this, it increases the risk of having their device hacked or compromised.
• Avoid clicking on or otherwise downloading software or links from unknown sources.
• Use the same precautions on your mobile phone as you would on your computer when using the Internet.

The IC3 urges all users who have found themselves victim of a malware attack to report the incident at IC3.gov.