NEWS

WIRES

OTHER

Dasient Research Discovers Major Privacy and Security Threats in Mobile Applications

The report, "Mobile Malware Madness, and How to Cap the Mad Hatters: A Preliminary Look at Mitigating Mobile Malware" was authored by Dasient's research team including Neil Daswani, Gerry Eisenhaur, Michael N. Gagnon and Tufan Demir. In a Black Hat presentation scheduled at 4:45pm PT on Thursday, August 4, Dasient's co-founder and Chief Technology Officer (CTO) Neil Daswani will reveal details on this behavioral analysis study of 10,000 applications downloaded from the Android Market, which found that 842 of those applications are leaking personal information. He will also discuss Dasient's findings on mobile drive-bys - a method by which malware is delivered to users via legitimate markets or applications.

"Our research indicates that mobile devices and applications are subject to a number of security considerations that may cause them to leak personal data, or expose users to infection via malicious drive-bys," said Daswani. "These issues need to be recognized immediately, both by those who write mobile applications and by the people who use them."

Some of the key findings of Dasient's research include:

    --  842 of the 10,000 apps analyzed from Google's Android marketplace were
        leaking private information. The apps transmitted International Mobile
        Equipment Identity (IMEI) and International Mobile Subscriber Identity
        (IMSI) numbers to remote servers, potentially exposing this personally
        identifying information to compromise.  The leaks occurred most
        frequently when application developers used IMEIs as user IDs, enabling
        unrelated applications to compare notes on user behavior, and clone
        users' phones.
    --  Hashing IMEI numbers to protect privacy does not protect user privacy.
        While some mobile application developers seek to protect the personal
        IMEI data via cryptographic "hashing," the Dasient security team found
        that the hashing techniques used on IMEI were relatively easy to
        circumvent.
    --  Mobile drive-by attacks can become a very real and new threat vector for
        malware distributors. Dasient's security team prototyped a mobile
        drive-by attack for Android. While drive-bys on desktop PCs on the Web
        are very common, the ability to conduct mobile drive-by attacks is a
        new, and potentially attractive, method of deployment for malware
        distributors.

"Mobile devices and applications are becoming a more popular platform for malware creation and distribution," Daswani concluded. "It's likely that we are on the threshold of another new wave of malicious attacks, and the time to start preparing is now."

The full Dasient report on mobile malware, including detailed results of the Android application study, can be found at: http://www.dasient.com/mobile-malware-madness/. More information can also be found on Dasient's blog: http://blog.dasient.com/

About Dasient

Dasient, the leader in Web anti-malware technology, envisions an Internet that is safe and malware-free for users and online businesses. Dasient protects the websites of leading financial services, e-commerce, media, web hosting and other global enterprises from losses of data, revenue and reputation caused by web-based malware attacks. Furthermore, Dasient's adaptive security intelligence redefines Internet security by scanning the expanses of the Web and harnessing the power of data to mount defenses against future malware attacks. For more information about the company and its services, visit www.dasient.com.

SOURCE Dasient