DOROS HADJIZENONOS, Country Manager of Check Point South Africa, explores why mobile ransomware has become the biggest mobile security threat, and how users can guard against it.
Imitation is a quick way to learn, which is why mobile malware is evolving so rapidly – it frequently imitates attack behaviours and trends that were first trialled and proven to work in the PC world. Mobile ransomware is following this path, with the aim of replicating the success that PC-based ransomware has had in extorting money from individuals and organisations. So it’s no surprise that the number of mobile ransomware variants detected in Q1 2016 grew 45% compared with Q4 2015.
Like its cousins that target PCs, mobile ransomware has become more complex and malicious in the way it works, too. The first mobile ransomware types were ‘screen blockers’, which displayed prominent alerts and made normal interaction with the screen impossible – similar to lock-screen PC ransomware. First seen in 2013, the malware posed as anti-virus software and informed victims their device was infected, demanding they purchased a full version of the software to ‘disinfect’ the device and make it usable again.
In 2014 the first mobile ransomware which encrypts files was detected, again following the success of Windows cryptolocker-style malware. The most recent mobile ransomware type is the Pin locker, which emerged in 2015. One example, called PornDroid, pretends to be a porn player, and tricks the user into granting it Admin privileges. Once it has these, the malware changes users’ Pin codes, locking them out of their devices and displaying a ransom message. We conducted a detailed investigation into how this type of ransomware worked, and we found one variant had infected tens of thousands of devices, with some victims paying $200 to $500 to unlock their data and regain control of the device.
The device divide
While mobile ransomware currently targets Android devices almost exclusively – largely because iOS devices need to be jailbroken in order to download apps from sources other than Apple’s App Store, making them harder to infect – there has been a case in which iOS users were extorted. In 2015, attackers exploited stolen credentials to log into users’ iCloud accounts and remotely locked their devices, and demand ransoms to release them. And in March 2016, the first ransomware targeting Apple Macs, KeRanger, was discovered, so we should expect to see ransomware targeting iOS devices soon.
Check your privilege
Currently, mobile ransomware focuses on locking users out of the device, because the mobile operating systems do not allow malware to access all the device’s areas of memory or storage. However, the privilege escalation exploits referenced earlier point clearly to the next step in ransomware evolution, using techniques to gain ‘root’ privileges on the device which effectively give the criminal complete control of the infected phone or tablet.
Most methods for rooting the device rely on exploiting vulnerabilities either in the OS, the hardware, or individual applications. Unfortunately, these vulnerabilities are widespread: over the past 6 months, over half of Android patches released by Google are for securing devices against privilege escalation exploits – so we can expect to see more ransomware targeting these flaws to gain elevated privileges over the next year.
How can I protect my devices?
The most fundamental principle of mobile device security is never to root or jailbreak your phone – in other words, to avoid deliberate privilege escalations that could then leave you open to malicious ones that may harbour ransomware. A robust security solution should also be applied. Enterprises should select a mobile device management (MDM) solution – but all MDMs are not equal. Some are able to identify when a phone has been deliberately rooted by a user, but not when it has been rooted by malware – and some more advanced malware can disguise itself against such inspection.
A more effective approach is to quarantine and inspect any suspicious apps or attachments in the cloud, before downloading them to the device. This blocks the main vector for privilege escalation, which is from rogue apps.
The mobile threat prevention solution should use a number of components working together to respond to the most common mobile attack vectors. Devices must be continually analyzed to uncover system vulnerabilities and unusual behaviour. Monitoring configuration and behaviour analysis can help identify root access attempts as outlined above. And any downloaded apps must be inspected for the unique binary signatures for known malware; they should also be captured and reverse-engineered for code-flow analysis to expose suspicious behaviour.
And don’t overlook simple steps such as regularly backing-up data on your device so that if the worst does happen, you can recover your files without having to pay.
Help! I’ve already been infected
Unfortunately, there may be little you can do, which is why it’s important to perform regular backups of the data stored on your mobile device. You should certainly avoid paying any ransom, and take your device to a mobile security specialist rather than attempting to decrypt it yourself. But ultimately, when it comes to mobile ransomware, prevention is by far the best protection.
Samsung in lock-step with its rivals?
Tonight Samsung will kick off the next round in the smartphone wars with the S10 range, writes ARTHUR GOLDSTUCK.
When Samsung unveils the new S10 smartphone at an event in San Francisco today, it will mark the beginning of the 2019 round of World War S. That stands for smartphone wars, although Samsung would like it to be all about the S.
Ever since the launch of the Samsung Galaxy S4 in 2013, Samsung has held both technology and thought leadership in the handset world. Back then, Apple’s iPhone 5 was the last device from the American manufacturer that could lay claim to being the best smartphone in the world. With the 2013 launch of the iPhone 5s, Apple entered an era of incremental improvement, playing catch-up, and succumbing to market trends driven by its competitors.
Six years later, Samsung is fighting off the same threat. Its Chinese rival, Huawei, suddenly wrested away leadership in the past year, with the P20 Pro and Mate 20 Pro regarded as at last equal to the Samsung Galaxy S9 Plus and Galaxy Note 9 – if not superior. Certainly, from a cost perspective, Huawei took the lead with its more competitive prices, and therefore more value for money.
Huawei also succeeded where Apple failed: introducing more economical versions of its flagship phones. The iPhone 5c, SE and XR have all been disappointments in the sales department, mainly because the price difference was not massive enough to attract lower-income users. In contrast, the Lite editions of the Huawei P9, P10 and P20 have been huge successes, especially in South Africa.
Today, for the first time in half a decade, Samsung goes into battle on a field laid out by its competitors. It is expected to launch the Galaxy S10 Plus, S10 and S10 e, with the latter being the Samsung answer to the strategy of the iPhone XR and Huawei P20 Lite.
Does this mean Samsung is now in lock-step with its rivals, focused on matching their strategies rather than running ahead of them?
It may seem that way, but Samsung has a few tricks up its electronic sleeve. For example, it is possible it will use the S10 launch to announce its coming range of foldable phones, expected to be called the Galaxy X, Galaxy F, Galaxy Fold or Galaxy Flex. It previewed the technology at a developer conference in San Francisco last November, and this will be the ideal moment to reclaim technology leadership by going into production with foldables – even if the S10 range itself does not shoot out the lights.
However, the S10 handsets will look very different to their predecessors. First, before switching on the phone, they will be notable by the introduction of what is being called the punch-hole display, which breaks away from the current trend of having a notch at the top of the phone to house front-facing cameras and speakers. Instead, the punch-hole is a single round cut-out that will contain the front camera. It is the key element of Samsung’s “Infinity O” display – the O represents the punchhole – which will be the first truly edge-to-edge display, on the sides and top.
The S10 range will use the new Samsung user interface, One UI, also unveiled at the developer conference. It replaces the previous “skin”, unimaginatively called the Samsung Experience, to introduce a strong new interface brand.
One UI went live on the Note 8 last month, giving us a foretaste, and giving Samsung a chance to iron out the bugs in the field. It is a less cluttered interface, addressing one of the biggest complaints about most manufacturer skins. Only Nokia and Google Pixel handsets offer pure Android in the local market, but One UI is Samsung’s best compromise yet.
It introduces a new interaction area, in the bottom half, reachable with the thumb, with a viewing area at the top, allowing the user to work one-handed on the bottom area while still having apps or related content visible above. One UI also improves gesture navigation – the phone picks up hand movements without being touched – and notification management.
The S10 range will be the first phones to feature the latest Qualcomm Snapdragon 855 chip, at least for the South African and American markets. That makes it 5G compatible, for when this next generation of mobile broadband becomes available in these markets.
They will also be the first phones to feature Wi-Fi 6, the next generation of the Wi-Fi mobile wireless standard. It will perform better in congested areas, and data transfer will be up to 40% faster than the previous generation.
The phones will be the first to use ultrasound for fingerprint detection. If Samsung gets it right, this will make it the fastest in-screen fingerprint sensor on the market, and allows for a little leeway if one pushes the finger down slightly outside the fingerprint reader surface. It does mean, however, that screen protectors will have to be redesigned to avoid blocking the detection.
Not enough firsts? There are a few more.
Most notably, it will be the first phone range to feature 1 Terabyte (TB) storage – that’s a thousand Gigabytes (GB) – at least for the top-of-the-range devices. Samsung last month announced that it would be the first manufacturer to make 1TB built-in onboard flash storage. Today, it will deploy this massive advantage as it once again weaponises its technology in the fight for smartphone domination.
- Arthur Goldstuck is founder of World Wide Worx and editor-in-chief of Gadget.co.za. Follow him on Twitter and Instagram on @art2gee
IoT set to improve authentication
By Sherry Zameer, Senior Vice President, Internet of Things Solutions for CISMEA region at Gemalto
As it rapidly approaches maturity, the Internet of Things (IoT) is set to continue a transformational trajectory, introducing new efficiencies in multiple fields by allowing measurement and analysis on a scale that has never been possible before. From agriculture to logistics, from retail to hospitality, from traffic to health, from the home to the office, the applications for monitoring ”things” are limited only by the imagination.
And South African (and African) businesses are showing abundant imagination in their practical deployments of IoT solutions in multiple settings, creating a better tomorrow through almost universal measurement and the introduction of new levels of convenience – including how to access locations, devices and services securely.
Any company, whether South African or international, should bear in mind that understanding consumer expectations can be the key to unlocking the full potential of IoT devices and related smart services.
According to Gemalto’s latest Connected Living study, improving the way consumers authenticate themselves to services is one of the most anticipated benefits of IoT, highlighting a desire for a more seamless and secure IoT experience.
Consumers are interested in advanced ways of authenticating themselves through automatic (based on behavioral patterns) or biometric techniques, lessening the need to have to intervene manually, all in the name of a much more streamlined authentication process. Smartphone manufacturers like Apple and Samsung have already placed fingerprint and facial recognition high on the agenda. There is also a widespread positive sentiment towards IoT’s potential for improving the quality of home life through connected, smart appliances.
Personalised services is something else that wins consumers over. In fact, a fluid, personalised and unified experience with continuity of services, together with security and privacy, is critical for the successful implementation of any technology.
And those types of services are today quite possible. With everything being connected – from small gadgets to digital solutions for large enterprises – IoT is no longer just a buzzword. That much is clear in a piece from Vodacom IoT managing executive Deon Liebenberg. Writing for IOL Online, Liebenberg provides insight into the sheer range of applications for IoT: the 20 use cases he cites range from the obvious, like transport and logistics, to the connected home and wearables; he even suggests tagging pets with IoT transmitters, for those who always need to know the whereabouts of the family cat.
Low-cost tags fitted to cats, dogs, lamp posts, shipping containers or other items are just one part of the puzzle, however. There are other two pieces; arguably the most complex part is the availability of communication networks in areas where there aren’t any WiFi networks, or indeed, anything else.
And that’s where the bigger takeaway from Liebenberg’s piece and other IoT trends articles becomes apparent. The communication networks are there, as are those tags: dedicated IoT networks (like LoraWAN, SigFox and narrowband IoT) are all available in South Africa.
So, too, is the third and final essential component. Software which is able to process the data generated by the tag and transmitted over the IoT network and into the internet. In this regard, there’s no shortage of solutions available from cloud providers like AWS and Azure; electronics giant Siemens, too, is in on the action, having recently launched a new cloud-based IoT operating system to develop applications and services for process industries, including oil and gas and water management.
This combination means it is quite possible right now to enable just about any use case. Business owners, who will know best how IoT can add value in their organisation, can now see their ideas becoming reality. Most crucial of all, IoT solutions delivering new levels of efficiency and convenience are not only possible, they are able to be offered with the simple and effective security that will drive consumer acceptance.