Fortinet has released its threat landscape research. During the period beginning July 1, 2012 and ending September 30, 2012, FortiGuard Labs researchers reported a marked increase in Android adware, new evidence suggesting that Zitmo (Zeus-in-the-Mobile) mobile banking Trojan is evolving into a botnet and the detection of Romanian hackers performing large scale scanning for Web vulnerabilities.
In the last three months, FortiGuard Labs reported a surge in Android-based mobile adware with a volume of activity comparable to Netsky.PP. Two adware variants Android/NewyearL and Android/Plankton were detected by close to one percent of all FortiGuard monitoring systems in the APAC and EMEA regions and four percent in the Americas. These two adware variants cover various applications that embed a common toolset for unwanted advertisements displayed on the mobile’s status bar, user tracking through their International Mobile Equipment Identity (IMEI) number and dropping of icons on the device’s desktop.
“The surge in Android adware can most likely be attributed to users installing on their mobile devices legitimate applications that contain the embedded adware code. It suggests that someone or some group is making money, most likely from rogue advertising affiliate programs,” said Guillaume Lovet, senior manager of Fortinet's FortiGuard Labs Threat Response Team.
These types of applications require too many unnecessary rights for a normal application, indicating it has a hidden agenda. Such data request includes permission to access parts of the device that are irrelevant to the application, to get access to the device’s browser history, bookmarks contact data, phone logs and identity as well as system log files.
For best practices, FortiGuard Labs recommends paying close attention to the rights asked by the application at the point of installation. More generally, it is also recommended to download mobile applications that have been highly rated and reviewed.
