Devastating cellphone hacks that hijack your most personal gadget and rob you of privacy and money have long been forecast. But even as smartphone users in Asia are beginning to suffer exploding bills and emptied bank accounts at the hands of hackers, U.S. users largely remain safe and blissfully unaware of the gathering threat.
Not for long.
Criminals have been probing the systems that protect U.S. smartphone users for years, searching for the right combination of programming tricks and social engineering that would allow them to sneak onto users’ phones. Recently, one hacker group hit the jackpot.
They took a year-old mobile virus named NotCompatible, which allows hackers to take complete control of a phone, and posted the malicious code on websites. Then they sent out enticing spam emails with links to the booby-trapped sites. The emails were all the more tempting because they appeared to come from friends or others on the recipients’ contact list. Victims who clicked on the link from their phones and downloaded the file surrendered control of their Android phones to the criminals. Security firm Lookout says 10,000 customers per day are still being tricked to click on the bogus link and landing on the booby-trapped pages, and virtually all of them are in the U.S.
Tim Strazzere, Lookout’s lead research and response engineer, said the sudden “staggering increase” in detection of the of the NotCompatible, which initially appeared one year ago, shows that the marriage of spam and mobile malware might be a recipe for real trouble.
“This Android malware is unique,” he said. “It’s exactly the same scheme and end game as before, but it’s just being circulated through different means. And it’s working.”
U.S. smartphone users have been spared much grief from mobile malware so far for a variety of reasons. Chief among them: Most users get their apps from a centralized and safe source. Apple keeps tight controls on its App Store, so malware writers are largely ignoring that platform. And while Google’s Play Store for Android is not as tightly controlled, criminals haven’t had much luck sneaking infected software onto that platform, either. That leaves hackers with time-consuming, clumsy methods, such as tricking users to visit a rogue website and electing to install an app.
Android attackers in other parts of the world have an easier time. In China, for example, it’s hard to access Google’s Play store, so consumers often get their apps from websites. That means rogue apps on random websites raise less suspicion.
But Strazzere warns that the criminals behind NotCompatible have found a way to make U.S. users almost as vulnerable as those in Asia – a direct email invitation from a friend to install what turns out to be a bogus app.
Those who might dismiss this scenario should beware: Last month, when a report by Mandiant Corp. alleged that hundreds of U.S. companies had been hacked by an arm of the Chinese military, the initial method of attack was almost the same — a “spear-phishing” email that appears to come from a co-worker or friend, sent to entice the recipient into clicking on a virus-laden link.
Smartphone users might fear that a criminal with access to their devices might destroy all their data, “brick” the phone or prank call all their contacts. But the real nightmare from a hacked phone is much more subtle, and can be much more expensive, than having to replace a phone.
dailyalternative | alternative news – Smartphone hacking comes of age, hitting US victims