In the Kaspersky Lab’s report on the evaluation of threats targeting smartphones, tablets and other mobile devices that was published in February 2013 showed that in 2012 alone Android became the number one target among virus writers and the number has been steadily increasing ever since. January is normally considered to be a quiet month for mobile virus writers. Only 1,262 new modifications were reported in this month but by August the number of fraudulent one-click apps published grew up to 2,500. The Kaspersky Lab has detected over 20,000 new mobile malware modifications over the past few months. In February alone, 12,044 mobile malware modifications were detected, another 9,443 were found in March. To compare, a total of 40,059 modifications of malicious programs targeting mobile devices were detected over the whole of 2012, which is a very huge number.

It was found that SMS Trojans are the most prevalent category of mobile threats, currently representing 63.6% of all attacks. They reportedly send text messages without the users’ knowledge to short, premium-rate numbers, leaving the users’ with hefty phone bills.

It seems that the mobile virus writers are especially fascinated by the Android platform. According to reports, a total of 99.9% of new mobile threat detections target the platform.

Top 4 Malicious Programs

The most dangerous malware goes to Trojan-SMS.AndroidOS.FakeInst.a with 29.45% attacks. The programmers mainly targeted Russian speaking Internet users who attempted to download software for Android devices from dubious sites. These dubious websites are often used by cybercriminals to spread malware as some useful software.

Trojan.AndroidOS.Plangton.a stands tall in the second position with 18.78% of attacks. This is mostly seen in the European countries as free software to monetize products by displaying ads. And finally, SMS Trojans from the Opfake family stood at third and fourth places. It was seen that the first modifications of the Opfake family of threats were disguised as the latest version of Opera, a popular mobile browser. However, today, the malicious programs in this family are disguised as new versions of other popular apps (Skype, Angry Birds, etc.).

Kaspersky Labs recorded two interesting virus incidents in the last quarter:

• A threat by the name of Perkel or Perkele was rumored to have allegedly attacked users in 69 countries. It could be detected several days later only when the first modifications of Perkel began to appear. This malware looks for mTANs (Mobile Transaction Authentication Numbers), uses text messages to communicate and upload stolen data to its command server. It is capable of performing self-updates too.
• The other one is the MTK Botnet. It is responsible for infecting up to one million Android devices that was primarily used by Chinese users. It spread via unofficial Chinese app stores with popular, cracked games. It was developed to steal information about the infected smartphone, user contact data and messages. The Trojan here could stealthily download and install apps on the victim’s mobile device and then give that app the highest possible ranking in the app store, thus increasing its visibility in the app store finally reporting their actions to a remote server.
• Note that the risk of banking or transaction numbers being stolen is increasing at a rapid rate upon storing valuable data in our mobile devices. This is because confidential business data stored in mobile devices are rarely encrypted or protected with a PIN. Growing use of “smart” devices in businesses and personal lives has made data leakage and misuse of important business or personal information more prominent.

We hope Android comes up with a real security update at the earliest!