Fortinet Sees Surge In Android Adware, Evolution To Zitmo Mobile Banking Trojan

PRESS RELEASE

SUNNYVALE, Calif., October 8, 2012 ― Fortinet® (NASDAQ: FTNT) − a world leader in high-performance network security – today released its threat landscape research. During the period beginning July 1, 2012 and ending September 30, 2012, FortiGuard Labs researchers reported a marked increase in Android adware, new evidence suggesting that Zitmo (Zeus-in-the-Mobile) mobile banking Trojan is evolving into a botnet and the detection of Romanian hackers performing large scale scanning for Web vulnerabilities.

Android Adware on the Rise

In the last three months, FortiGuard Labs reported a surge in Android-based mobile adware with a volume of activity comparable to Netsky.PP, one of the most infamous and prolific spam generators encountered in Internet history. Two adware variants Android/NewyearL and Android/Plankton were detected by close to one percent of all FortiGuard monitoring systems in the APAC and EMEA regions and four percent in the Americas. These two adware variants cover various applications that embed a common toolset for unwanted advertisements displayed on the mobile's status bar, user tracking through their International Mobile Equipment Identity (IMEI) number and dropping of icons on the device's desktop.

"The surge in Android adware can most likely be attributed to users installing on their mobile devices legitimate applications that contain the embedded adware code. It suggests that someone or some group is making money, most likely from rogue advertising affiliate programs," said Guillaume Lovet, senior manager of Fortinet's FortiGuard Labs Threat Response Team.

These types of applications require too many unnecessary rights for a normal application, indicating it has a hidden agenda. Such data request includes permission to access parts of the device that are irrelevant to the application, to get access to the device's browser history, bookmarks contact data, phone logs and identity as well as system log files.

For best practices, FortiGuard Labs recommends paying close attention to the rights asked by the application at the point of installation. More generally, it is also recommended to download mobile applications that have been highly rated and reviewed.

Zitmo Gets More Sophisticated

In the last quarter, FortiGuard researchers discovered that Zitmo (or Zeus-in-the-mobile) has evolved into a more complex threat, with new versions recently released for Android and Blackberry.

Zitmo is the notorious mobile component of the Zeus banking Trojan that circumvents two-factor authentication by intercepting SMS confirmation codes to access bank accounts. The new versions for Android and Blackberry have now added botnet-like features, such as enabling cybercriminals to control the Trojan via SMS commands.

"The new version of Zitmo may already be in the wild in Europe and Asia. While we're detecting only a few instances of the malware in those regions, it's leading us to believe the code is currently being tested by its authors or deployed for very specific, targeted attacks," Lovet continued.

As more banks and online merchants roll out two-factor authentication − usually through the use of an SMS code to bring the second authentication factor and confirm a transaction − Android and Blackberry users should be mindful anytime their financial institution asks them to install software onto their computing device, as this is something banks rarely if ever request from their customers. For complete security, FortiGuard Labs recommends conducting online banking from the original operating system CD. If that is not an option, users should install an antivirus client on their phone and desktop PCs and make sure they are updated with the latest patches.

Romanian Hackers Scanning for phpMyAdmin Vulnerability

In the last three months, FortiGuard Labs has detected large scale scans for vulnerability. These scans were performed through a tool developed by Romanian Hackers to seek Web servers running vulnerable versions of the mySQL administration software (phpMyAdmin) in order to take control of those servers.

The tool, called ZmEu, contains code strings in the payload that refers to AntiSec, the global hacking movement initiated by Anonymous and Lulzsec last year. The scans are being performed around the world, and in September, almost 25% of FortiGuard monitoring systems were detecting at least one such scan per day.

"The goal behind an attack on this vulnerability is open to speculation," added Lovet. "But if these hackers are indeed related to AntiSec, possible scenarios include exfiltering sensitive data, using the compromised servers as a direct denial of service (DDoS) launch base or defacing the Websites they've infiltrated."

To secure Web servers against this threat, Fortinet recommends updating to the latest version of PhPMyAdmin.

About FortiGuard Labs

FortiGuard Labs compiled threat statistics and trends for this threat period based on data collected from FortiGate® network security appliances and intelligence systems in production worldwide. Customers who use Fortinet's FortiGuard Services should be protected against the vulnerabilities outlined in this report as long as the appropriate configuration parameters are in place.

FortiGuard Services offer broad security solutions including antivirus, intrusion prevention, Web content filtering and anti-spam capabilities. These services help protect against threats on both application and network layers. FortiGuard Services are updated by FortiGuard Labs, which enables Fortinet to deliver a combination of multi-layered security intelligence and zero-day protection from new and emerging threats. For customers with a subscription to FortiGuard, these updates are delivered to all FortiGate, FortiMail&trade and FortiClient&trade products.

Ongoing research can be found in the FortiGuard Center or via FortiGuard Labs' RSS feed. Additional discussion on security technologies and threat analysis can be found at the FortiGuard Blog.

Follow Fortinet Online:

Subscribe to threat landscape reports: http://blog.fortinet.com/feed/

Twitter at:www.twitter.com/fortinet

Facebook at:www.facebook.com/fortinet

YouTube at: http://www.youtube.com/user/SecureNetworks