While the vast majority of malicious programs are designed to attack Windows PCs, there is evidence that some hi-tech criminals are starting to turn their attention to smartphones.
Booby trapped applications for smartphones have been found online and in recent weeks Apple and Google have removed applications from their online stores over fears that they were malicious.
Chris Wysopal, co-founder and technology head at security firm Veracode, which helped the BBC with its project to replicate the apps, said smartphones were now at the point the PC was in 1999.
At that time malicious programs were a nuisance. A decade on and they are big business, he said, with gangs of criminals churning out malware that tries to steal saleable information.
At that time home computers in the form of the BBC Micro, Vic 20 and Sinclair ZX machines were in vogue. The proud owner of a Vic 20 I spent hours laboriously copying line after line of code out of magazines to get games running.
The end result was a program that does not look great but gets the job done. The process has educated me about modern programming and put me on my guard about what goes on my phone.
Mobiles, he said, offered a potentially more tempting target to those criminals.
“Mobile phones are really personal devices,” said Mr Wysopal. “You might have one computer for a family but every family member has a personal device and it is with them all the time.”
Simeon Coney, a spokesman for mobile security firm AdaptiveMobile, said criminals were focused on handsets for one simple reason: money.
“In the PC domain the only way a criminal can generally take money from a user is by having them click on a web link, go to a website, purchase a product and enter their credit card details,” said Mr Coney.
“In a mobile network the device is intrinsically linked to a payment plan, to a user’s credit,” he said. Nothing happens on a mobile network, no call is made or text is sent, without money changing hands.
Criminals have tapped into that revenue stream by getting phone owners to dial or contact premium rate numbers. Now they are turning their attention to applications and the lucrative information they scoop up.
The App Genome project by mobile security firm Lookout was set up to map what applications produced for smartphones do. It tried to find out if they do everything they claim and if they do more than expected.
The project has looked at 300,000 smartphone applications and mapped the internal functions of one-third of them.
It found that about one-third of applications it has studied seek to get at a user’s location and about 10% try to get at contact and address lists. The study also found that a significant proportion of applications included code copied and pasted from other programs.
To get a better understanding of the barriers to creating malicious programs the BBC downloaded a widely used application development kit, learned the basics of programming in Java and gathered some snippets of code already released on the net.
It was possible in a few weeks to put together a crude game that also, out of sight, gathered contacts, copied text messages, logged the phone’s location and sent it to a specially set up e-mail address.
The spyware took up about 250 lines of the 1500 making up the entire program. The code was downloaded to a single handset but was not put on an application store.
All of the information-stealing elements of the spyware program were legitimate functions turned to a nefarious use.
“That’s kind of the scary thing,” said Mr Wysopal from Veracode. “The face of the application, be it a game or a simple application that is for fun, can have behaviour that is not visible at the surface.”
It’s way less effort to hack into someone else’s application, as you do not have to write it yourself”
By contrast, he said, stealing a popular application, packing it with booby-trapped code and offering it for free can reap rewards.
Some application makers have found that 97% of the people using their software are doing so via pirated versions.
Application stores are making efforts to police the programs they offer. So far the number of booby-trapped applications remains low. But many feel the threat is only likely to grow.
From: http://www.bbc.co.uk/news/technology-10912376