Posts Tagged ‘mobile-security’

Cybercriminals Stalking and Eavesdropping with Cell Phone Software

Tuesday, March 16th, 2010

pic1-39A recent story on ABC’s Good Morning America describes one woman’s three year battle with a cyberstalker who secretly placed spy software on her cell phone.

At the time, Susan didn’t know that her ex-boyfriend installed spying software on her phone when she wasn’t looking. Once installed, he could be anywhere — even in a different state — and follow her every move. But what was worse, it didn’t just track her whereabouts. He could listen in on her phone calls, read her text messages and turn her personal cell phone into a bugging device. From anywhere, he could activate her speaker phone and listen to everything she was doing.

According to one security expert,

When somebody remotely activates your phone, you’re not going to know it and they can use that phone to monitor the conversations in the room you’re in…. Your phone could be sitting next to you while you are watching TV, and somebody can actually log into your phone and can actually watch what you are watching on television.

In this situation, obtaining a new phone number or carrier was not enough to stop the stalking, since the hardware itself had been infected with the malware. Only upon purchasing a new phone was the victim able to stop her cyberstalker.

According to the ABC report, the spy software used in this kind of attack is readily available online for $350, with basic versions going for as little as $50.

Android Phone Now Shipping With Malware Pre-Installed

Monday, March 8th, 2010

pic5-38We’ve reported on new devices shipping with pre-installed malware before, and this time it’s the Android-based HTC Magic phone.

As reported today on Threat Post, a researcher at Panda Security connected the new phone–from European distributor Vodafone–to her PC and was alerted by her anti-virus software that the handset was infected with the Mariposa botnet client malware, which quickly attempted to infect other PCs in the network.

And perhaps even more shocking, this was not the only malware pre-loaded on the phone:

Interestingly enough, the Mariposa bot is not the only malware I found on the Vodafone HTC Magic phone. There’s also a Confiker and a Lineage password stealing malware. I wonder who’s doing QA at Vodafone and HTC these days…

Cisco Projects Mobile Traffic to Grow to >3.6 Exabytes per Month.

Monday, February 15th, 2010

pic2-35A recent article on the New York Times “Bits” blog described the findings of a newly released report by Cisco Systems, forecasting the growth in mobile data traffic:

[Cisco] expects the volume of mobile data traffic to increase 39 times over the next five years, largely due to the fact that there will five billion devices, from e-readers to tablets and smartphones, connected to mobile networks over that timespan. “We’re going from less than a tenth of an exabyte to more than 3.6 exabytes per month.” [...]

Currently, the average mobile broadband connection generates 1.3 gigabytes of traffic each month. That figure is equivalent to storing roughly 650 songs. In 2014, Cisco predicts, that figure will swell to 7 gigabytes each month, or 3,500 music files.

Driving that spike is mobile video…. It will consume two-thirds, or 66 percent, of all mobile data traffic by 2014. That includes streaming content on laptops as well as handheld devices….

By comparison, in 2008, video traffic accounted for roughly 39 percent of all mobile traffic.

Another key factor driving this growth will be the increased bandwidth provided by 4G and other next-gen wireless network standards.

Mobile Market Poised for Massive Expansion

Sunday, January 10th, 2010

pic1-30Mobile broadband-connected consumer electronics devices — personal navigation devices, personal media players, eBook readers, mobile gaming devices and mobile digital cameras — are forecasted to reach 58 million total shipments in 2014. This is 55 times the amount shipped just six years prior.

As recently reported by ABI Research, eBook readers and personal navigation devices are currently leading this growth, with other products ramping up behind them. However, as this market continues to expand, many device vendors will face new challenges as they determine the proper service models for content delivery and data connection on their internet-connected devices.

Mocana Nominated for 2010 SPIFFY Award

Sunday, January 10th, 2010

pic6-30Presented annually to the most impressive telecommunications start-ups in Silicon Valley, the SPIFFY Awards are judged by the members of the Service Provider Forum (SPiF) of the Telecom Council of Silicon Valley. This year the Council evaluated over 100 telecom companies and Mocana is honored to be among the final nominees.

An award recognizing “the best investment opportunity within the mobile telecom sector,” Mocana has been nominated for The Zephyr Award for Best Mobile Opportunity.

The winners will be announced at a recognition ceremony on February 25.

Another Top Security Exec Warns of Mobile Industry Vulnerability

Tuesday, December 8th, 2009

pic1-27President of the International Security Forum and former Microsoft Chief Information Security Officer Howard Schmidt has warned that the device security industry is not doing enough to secure the rapidly proliferating mobile device market.

At an Australian Information Security Association seminar Schmidt stated,

Now, granted a couple of the ones [viruses] that we’ve seen were people who have modified or unlocked the ability [to replace the operating system] on particularly the iPhone, but that’s just the tip of the iceberg…. The next big challenge we have to face is to start looking at mobile devices and particularly their relationship to the cloud…. We have the ability to do two-factor authentication, build that into the system so that we get away from static user ID and passwords. We have the ability to use end-to-end encryption on end-point devices, in transit, on servers. We can’t stop bad guys from stealing the data but with encryption we can stop them from having any value [from it].

Unlocked iPhones have increasingly been targeted by malicious attacks of ever-greater severity, including:

-The “Duh” worm
as well as
-The “iPhone/Privacy.A” worm

Schmidt’s warnings echo those of Research in Motion’s (RIM) VP of Blackberry Security, Scott Totzke, who recently discussed his concerns that ‘rougue’ smartphones could be used to bring down wireless networks via distributed-denial-of-service (DDoS) attacks.

Newer, Nastier iPhone Worm Spreads

Monday, November 23rd, 2009

pic5-26“Jailbroken” iPhones — iPhones whose users have modified them to run otherwise unsupported code — are once again targets of a serious virus.

As reported in The Sydney Morning Herald, the latest virus to attack these phones — known as the “Duh” virus — is a malicious worm that intercepts passwords and ultimately puts hackers in total control of the phone.

…[S]ecurity researchers say the new [virus]…connect[s] the phone to an “internet control and command centre” in Lithuania that allows hackers surreptitiously to issue commands to the device remotely. It also appears to be designed to steal online banking passwords and scrape the user’s SMS messages.

It is believed that the “Duh” worm is based on the earlier “Ikee” virus, a non-malicious prank hack that changed jailbroken iPhones’ wallpaper images. But these iPhones are increasingly vulnerable to serious attacks, such as the previously discovered “iPhone/Privacy.A” virus, which can also put sensitive user data (email, passwords, SMS messages) into the hands of hackers.

Clobbering the Cloud

Monday, October 12th, 2009

pic2-20“Spying on BlackBerry users for Fun.”

“Clobbering the Cloud.”

These are the titles of two of the presentations scheduled for this year’s “Hack In The Box” (HITB) security conference in Kuala Lumpur, Malaysia. As mobile devices and smartphones continue to proliferate, “the cloud” — the term for services and applications hosted on the internet — is becoming the target of choice for hackers and the new focus for security experts.

According to a recent PC World article, HITB is one of Asia’s most prominent security conferences, bringing together hackers and security experts alike. And according to conference host and organizer Dhillon Andrew Kannabhiran, mobile technology and “the cloud” are among this year’s hot topics:

The focus [of security] is definitely moving towards “the cloud” and to the security of embedded devices (Android, iPhone) to more advanced client-side attacks which leverage Web 2.0 technologies, such as attacks on Facebook, Twitter and other popular sites.

DSF for Android is Mocana’s comprehensive, open standard’s-based security suite for developers building in the Androidâ„¢ Mobile Platform.

WALL STREET JOURNAL
Off-the-shelf mobile devices becoming government-issue standard

Monday, September 21st, 2009

pic3-18Until recently, government employees were rarely issued mobile devices like mobile internet devices or Blackberry’s, usually because of the perceived security problem. That’s changing, and fast. More and more often, government IT departments have decided “if you can’t beat ‘em, join ‘em” and are rapidly outfitting their employees with commercial off-the-shelf mobile communications devices. These consumer devices, previously only issued to the highest-level government employees, are now much more likely to be found in the hands of the rank-and-file. That has dramatically expanded the government’s mobile device population (and its over-the-air data traffic), leading some experts to worry that sensitive government communications are becoming less, not more, secure.

This change in government policy is happening on a massive scale.

This year, the U.S. government will spend $70 billion on information technology, including wireless devices, service contracts and applications, according to Warren Suss, president of Suss Consulting Inc…The shift is being driven by the desire to make government workers more effective and efficient by giving them access to critical information wherever they are, and by the need to cut costs — private networks and proprietary devices are expensive to develop and require specialized staff to maintain and update.

Sara Silver of The Wall Street Journal reports on the exciting new uses government employees are finding for commercial devices and networks.

InformationWeek: 3G Security Coming Along, But…

Monday, June 1st, 2009

56187580The good news about 3G security is that today’s mobile broadband networks have some enhanced security built in. Most of the latest 3G technologies, including WiMax, at least have options for robust encryption. AT&T and T-Mobile provide High Speed Packet Access with a 128-bit Kasumi encryption algorithm. CDMA2000, offered by Sprint and Verizon, offers 128-bit AES (Advanced Encryption Standard) encryption.

The bad news is that operators may or may not actually turn your encryption “on”.

AES activation is largely optional on the part of operators. AT&T claims its Kasumi encryption is “always on”, but Verizon won’t go there. Moreover, even if your operator offers encryption, your users may roam onto a network that doesn’t. And an old 2G connection has much less robust encryption mechanisms, considered easy to defeat.

VPN and endpoint security offerings vary tremendously between the carriers and handset companies, too. The net-net is that companies need to take ownership of their device security. Fortunately, there’s a growing goodie-bag of options out there, if you know where to look. Read more.