Weekly Mobile Security News Roundup

What’s new on the mobile security front? We present the weekly mobile security news round up to keep you updated on the most relevant items.

1. 1. A new botnet that has infected more than 20,000 android devices worldwide has been uncovered.
   Named “XXXX.apk”, the malware illicitly collects information about the user’s location, nearby wireless hotspots and potentially targets the user’s connection to their PC and home wireless network.
   http://www.scmagazineuk.com/thousands-of-smartphones-infected-with-spy-malware/article/328207/ Why should you care? In the meanwhile, the malware acts as an information gatherer – it’s evolution to more sophisticated capabilities is yet to be seen. However, it signifies the existence of an underlying security issue. Furthermore, it demonstrates the ability to distribute malware via fake mobile apps on Android Market.
2. 2. SD cards are just as vulnerable as other platforms.
   As we tweeted earlier this week, Bunnie:studios gave a presentation at Chaos Computer Congress (30C3) on SD card vulnerabilities. They demonstrated the capability to perform malicious code execution on the memory card itself.
   http://www.bunniestudios.com/blog/?p=3554 Why should you care? Although the presentation was on SD cards – and not micro-SDs – this demo serves as a reminder to the importance of external components. Your mobile security strategy needs to consider the risks and threats posed by the mobile OS, device and hardware components
3. 3. Exploitation of baseband vulnerabilities has become significantly harder.
   With Qualcomm holding 97% of the market share of shipped LTE chipsets, you see their chipset in every single top-of-the-line smartphone. This presentation by Ralf-Philipp Weinmann, also at 30C3, summarizes the different challenges for exploit development in 2013.
   http://media.ccc.de/browse/congress/2013/30C3_-_5618_-_en_-_saal_1_-_201312272145_-_baseband_exploitation_in_2013_-_rpw_esizkur.html
   

Here’s to a warmer next week!