Juniper Networks’ Annual Mobile Threats ReportOver the year since the government decided to implement secure smartphones mostly using a version of Google’s Android platform, mobile malware has begun to focus almost exclusively on Android devices, according to a new report.
Juniper Networks, a network equipment manufacturer, released its third annual Mobile Threats Report this week. It found 92 percent of all mobile malware is targeted specifically at Android, compared to 47 percent last year.
This rise is mostly a reflection of Android’s growing market share; it controls roughly 60 percent of the worldwide market for smartphones, tablets and notebooks, according to Canalys. Driven by a dramatic surge in Europe and India, the Android platform is where the consumer — and cybercriminal — is going.
It’s also where the government has been going. Roughly a year ago, the government decided to work with Android while attempting to roll out a secure smartphone for the military. Federal officials met with Apple, but were denied access to the company’s mobile operating system. So the government — specifically the Defense Advanced Research Project Agency — went with the tinkerable Android software, altering the operating system so users could choose which data from the Android and its applications could be sent over the Internet. Neither the Defense Department nor the Homeland Security Department responded to requests for comment for this story.
During the initial period of government secure smartphone development — the first quarter of 2012 — there were only 38,689 samples of mobile malware across all operating systems. Just under half of those, around 18,000, were targeted at Android. By the first quarter of 2013, Juniper identified 276,259 total mobile malware samples — a more than six-fold increase. But more important for the government, that’s more than a 14-fold increase in Android mobile malware.
Which doesn’t mean Apple’s iOS platform would be more secure for the government.
“Theoretical exploits for iOS have been demonstrated, as well as methods for sneaking malicious applications onto the iOS App store,” the report reads. “But cybercriminals have by and large avoided Apple’s products in favor of the greener pastures offered by Google Android.”
Still, government needs to be vigilant. The vast majority of malware is from third-party application stores in Russia and China, two countries the U.S. government has tangled with over other cybersecurity issues.
“While on one hand the [original equipment manufacturers], carriers and software vendors must collaborate to develop platforms that mitigate large threats, enterprises and government organizations need to take a comprehensive look at protecting their data and networks by adopting a holistic approach to mobile security,” said Michael Callahan, Juniper’s vice president of global product marketing for the security business, in a statement.
And the report did find the “fragmented” nature of the Android ecosystem makes its mobile devices more susceptible to malware.
“Over the years, Google’s decentralized ecosystem has made it difficult for software updates — including security patches — to make their way to Android users,” the report reads. “Each Android update from Google must be adapted and then tested by handset makers for each of their (many) hardware variants. That update is distributed to carriers who, in turn, push it to their customers.”
That creates serious lag time between the introduction of new software and actual implementation. Only 4 percent of Android mobile users are using the Android OS, “Jelly Bean,” over six months after its release. Comparatively, estimates are that 90 percent of Apple mobile users are running iOS 6, Apple’s latest operating platform.
The report found nearly three-quarters of mobile malware gets access through downloads of fake applications or by exploiting the mobile payment system, which allows users to donate money or make payments through text message. Last year, as the government developed its secure smartphone, it also vetted each app individually — such as Angry Birds — to determine whether each was safe for employees.
According to the report, Google Play, where Android users download applications, is the most frequently faked application. That finding only emphasizes the need for the government to continue its vigilance as it rolls out secure smartphones.
