iOS Attacked (Again), Play’s Got Adware, Outlook Has Security Flaws – Mobile Security Weekly

This has been quite the week in the world of mobile security. We’ve seen major malware campaigns targeting personal and enterprise users, iOS and Android and even jailbroken and non-jailbroken devices. This goes to show there’s no part of the mobile device ecosystem that can consider itself immune.

Serious Malware Campaign Begins to Target iOS Devices

Attackers, most likely of Russian origin, are using a strain of malware named XAgent to target iOS devices of targets in the US government, defense and media sectors. The attack, which affects both jailbroken and non-jailbroken devices is believed to be a continuation of a malware campaign from October 2014 named Operation Pawn Storm.

XAgent is delivered using several different methods, including phishing attacks based on a technique called island hopping. Essentially, phones of friends and associates of the true target are first infected and then used to pass on the spyware link. It’s based on the assumption that the target is more likely to click on links from people they know than from strangers.

We’ve released an in-depth report of our findings on this issue which you can read here.

Why is this Significant?

This highlights several major issues that we often discuss regarding mobile security:

• iOS is vulnerable, despite everything that Apple claims.
• The notion that only jailbroken devices are vulnerable is wrong.
• The importance of reviewing every link, app, and picture that you receive.

Google Unable to Detect Adware-Infected Apps on Google Play

Three popular, seemingly harmless Android apps that are actually bursting with malware and advertisements, have been tricking users into visiting unwanted sites, installing other apps, fixing non-existent issues, like fake malware infections, porn-filled storage and more.

The Durak card game app is one such malicious application that has already been downloaded 5 to 10 million times from Google Play. Other apps that have been found to carry adware include a Russian language IQ testing app, a history app, a psychology guide, and a wedding planning program.

The malware doesn’t strike immediately, it bides its time. When it starts bombarding the user with ads and fake pages aimed at tricking the victim, it is more difficult for users to identify which of their apps is behind the malice.

http://www.forbes.com/sites/ewanspence/2015/02/04/android-malware-apps-deleted/

Why is this Significant?

Google dropped the ball on this one. It took them months to spot the malicious apps, and had they not received a tip-off, the apps may have gone unnoticed for longer. These events place the security of Google’s official app store in serious doubt.

Microsoft Outlook App for iOS and Android Flagged for Security Flaws

Just days after Microsoft released iOS and Android versions of the Outlook, security researchers warned users to stay clear of it due to a trio of security lapses and design flaws.

• Due to the way the app communicates with file-sharing services such as Dropbox, Google Drive and Microsoft OneDrive, a user can connect their personal cloud storage account within the app. Users can share or save business mail attachments on those services or attach their personal files to emails sent on the corporate account, both of which can be the source of major security issues.
• Microsoft can store a user’s email and login credentials in the cloud. This can also be the start of major threats to the company’s data security.

http://searchconsumerization.techtarget.com/news/2240239514/Security-issues-lead-IT-to-block-Outlook-for-iOS

Why is this Significant?

This isn’t just any old developer, it’s Microsoft. What’s more, Outlook is one of the most famous names in IT and business computing. The fact that even this app is riddled with security hazards makes you wonder just how safe the lesser known apps and services are.