Connect with us

E-Business

McAfee Reveals Threats Prone 5000 Versions of 21 Mobile App

Published

on

mcafee.jpg
Kindly share this post

Intel Security’s McAfee Labs Threats Report of June 2016, has revealed the dynamics of mobile app collusion, where cybercriminals manipulate two or more apps to orchestrate attacks capable of exfiltrating user data, inspecting files, sending fake SMS messages, loading additional apps without user consent, and sending user location information to control servers.

McAfee Labs has observed such behavior across more than 5,000 versions of 21 apps designed to provide useful user services such as mobile video streaming, health monitoring, and travel planning.

Unfortunately, the failure of users to regularly implement essential software updates to these 21 mobile apps raises the possibility that older versions could be commandeered for malicious activity, the report shows.

Widely considered a theoretical threat for many years, colluding mobile apps carry out harmful activity together by leveraging inter app communication capabilities common to mobile operating systems.

These operating systems incorporate many techniques to isolate apps in sandboxes, restrict their capabilities, and control which permissions they have at a fairly granular level. Unfortunately, mobile platforms also include fully documented ways for apps to communicate with each other across sandbox boundaries.

Working together, colluding apps can leverage these interapp communication capabilities for malicious purposes.

McAfee Labs has identified three types of threats that can result from mobile app collusion:

Information theft: An app with access to sensitive or confidential information willingly or unwillingly collaborates with one or more other apps to send information outside the boundaries of the device

Financial theft: An app sends information to another app that can execute financial transactions or make financial API calls to achieve similar objectives

Service misuse: One app controls a system service and receives information or commands from one or more other apps to orchestrate a variety of malicious activities.

Mobile app collusion requires at least one app with permission to access the restricted information or service, one app without that permission but with access outside the device, and the capability to communicate with each other.

Either app could be collaborating on purpose or unintentionally due to accidental data leakage or inclusion of a malicious library or software development kit. Such apps may use a shared space (files readable by all) to exchange information about granted privileges and to determine which one is optimally positioned to serve as an entry point for remote commands.

“Improved detection drives greater efforts at deception,” said Vincent Weafer, vice president of Intel Security’s McAfee Labs group. “It should not come as a surprise that adversaries have responded to mobile security efforts with new threats that attempt to hide in plain sight. Our goal is to make it increasingly harder for malicious apps to gain a foothold on our personal devices, developing smarter tools and techniques to detect colluding mobile apps.”

The McAfee Labs report discusses forward-looking research to create tools, initially used by threat researchers manually but eventually to be automated, to detect colluding mobile apps. Once identified, colluding apps may be blocked using mobile security technology.

The report suggests a variety of user approaches to minimize mobile app collusion, including downloading mobile apps only from trusted sources, avoiding apps with embedded advertising, not “jailbreaking” mobile devices, and most importantly, always keeping operating system and app software up-to-date.

Q1 2016 Threat Statistics

Ransomware: New ransomware samples rose 24% this quarter due to the continued entry of relatively low-skilled criminals into the ransomware cybercrime community. This trend is the result of widespread adoption of exploit kits to deploy the malware.

Mobile. New mobile malware samples grew 17% quarter over quarter in Q1 2016. Total mobile malware samples grew 23% quarter over quarter and 113% over the last four quarters.

Mac OS malware. Mac OS malware grew quickly in Q1, primarily due to an increase in VSearch adware. While the absolute number of Mac OS samples is still low, the total number of samples has increased 68% quarter over quarter and 559% over the last four quarters.

Macro Malware. Macro malware continues on the growth trajectory begun in 2015 with a 42% quarter over quarter increase in new macro malware samples.

The new breed of macro malware continues to attack corporate networks primarily through sophisticated spam campaigns that leverage information gathered through social engineering to appear legitimate.

Gamut botnet. The Gamut botnet became the most productive spam botnet in Q1, increasing its volume nearly 50%.

Prevalent spam campaigns offer get-rich-quick schemes and knockoff pharmaceutical supplies. Kelihos, the most prolific spamming botnet during Q4 2015 and a widespread malware distributor, slipped to fourth place.

McAfee Labs is the threat research division of Intel Corporation’s Intel Security Group, and one of the world’s leading sources for threat research, threat intelligence, and cybersecurity thought leadership.

The McAfee Labs team of researchers collects threat data from millions of sensors across key threat vectors—file, web, message, and network.

It then performs cross-vector threat correlation analysis and delivers real-time threat intelligence to tightly integrated McAfee endpoint, content, and network security products through its cloud-based McAfee Global Threat Intelligence service.

McAfee Labs also develops core threat detection technologies—such as application profiling, and graylist management—that are incorporated into the broadest security product portfolio in the industry.

McAfee Labs is now part of Intel Security. With its Security Connected strategy, innovative approach to hardware-enhanced security and unique McAfee Global Threat Intelligence, Intel Security is intensively focused on developing proactive, proven security solutions and services that protect systems, networks and mobile devices for business and personal use around the world.

 


Kindly share this post

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

NDPC Commits to Balancing Data Privacy, Protection Information

Published

on

Kindly share this post

Nigerian Data Protection Commission (NDPC), has expressed its commitment to balance information around data privacy and protection.

NDPC Commits to Balancing Data Privacy, Protection Information

Dr. Vincent Olatunji, national commissioner, NDPC, stated this in Abuja, at the National Data Privacy Summit with the theme, “Privacy in the Era of Emerging Technologies,” organised by the commission.

Olatunji said the NDPC, at the moment, was looking at balancing information around data privacy and protection.

“What we are doing is just to look at how to balance information around privacy and protection, which is really important, because as we are innovating, at the same time, we have to consider issues around privacy and protection,” he stated.

He added that the commission has been very bold in taking risks that would bring about growth.

“Our starting point is growing at a very alarming rate, and we are not afraid of anything. We can take risks. And that is why a lot is happening in Nigeria, and this is the level of clarity,” he explained.

In his address, Dr. Aminu Maida, executive vice chairman (EVC) of the Nigerian Communications Commission (NCC),  stated that Internet of Things holds promise for Nigeria’s economy.

The EVC, who was represented by Abraham Oshadami, executive commissioner, Technical Services (ECTS), noted that, “in an era in which digital assets, Internet of Things, future digital computing and other transformative technologies are key, and both a cornerstone of building trust for the adoption and a prerequisite for sustainable progress.

“Emerging technologies hold immense promise for Nigeria’s grand economy, but they also introduce complex risks to personal and individual rights.

“So, balancing innovation through post-ethical safeguards and public trust is the first step to ensuring that global digital advancement benefits all Nigerians without compromising their privacy or their security,” he added.

“As we just heard from the Nigeria Police, telecom operators have a vast amount of sensitive historical information daily, including connectivity apps and collaboration on privacy, security, and number protection, both to their and their inheritors,” he said.

Dr. Bako Shurkuk, commissioner for Science, Technology and Innovation, Plateau State, who represented Caleb Mutfwang, Governor of Plateau State, said, emerging technologies can be harnessed to attain sustainable growth.

 


Kindly share this post
Continue Reading

E-Business

OADC Lagos Reinforces Commitment to Local Data Hosting and Digital Transformation @ NDPC’s National Privacy Week Summit

Published

on

Kindly share this post

Open Access Data Centres (OADC) Lagos has reaffirmed its commitment to Nigeria’s data protection and digital transformation agenda through its sponsorship and active participation in the Nigeria Data Protection Commission’s (NDPC) National Privacy Week Summit.

The National Privacy Week Summit, organised by the NDPC, convened policymakers, regulators, technology providers, and industry stakeholders to promote data privacy awareness, strengthen compliance with the Nigeria Data Protection Act (NDPA), and advance conversations around data security, sovereignty, and responsible data governance.

As a sponsor of the event, OADC Lagos demonstrated its continued support for the Federal Government’s drive toward local data hosting and data domiciliation, which are increasingly critical to safeguarding sensitive information, enhancing regulatory compliance, and building trust in Nigeria’s digital economy.

Through its carrier-neutral, Tier III Design certified data centre in Lekki, Lagos, OADC provides secure, resilient, and compliant infrastructure that enables government institutions and private sector organisations to host and manage data locally while meeting international best practices.

Commenting on the engagement, Adesola Adesugba, Country Marketing Manager, Open Access Data Centres Nigeria, said: “We are proud to have supported the Nigeria Data Protection Commission through the National Privacy Week Summit and to stand alongside the government in advancing Nigeria’s digital transformation objectives.

“Strengthening local data hosting and domiciliation is fundamental to national data sovereignty, improved security, and sustainable digital growth, and OADC Lagos remains committed to enabling this future.”

OADC’s participation at National Privacy Week Summit underscores its role as a trusted digital infrastructure partner to government and enterprise, supporting secure cloud connectivity, regulatory compliance, and the long-term development of Nigeria’s digital ecosystem.

Open Access Data Centres is part of the WIOCC Group and operates open-access, world-class data centres across Africa, serving cloud providers, network operators, enterprises, and public sector institutions.


Kindly share this post
Continue Reading

E-Business

Kaspersky Launches OT Calculator to Align Cybersecurity Investments with Business Goals

Published

on

Kindly share this post

Kaspersky’s new online tool has been specially developed for industrial organisations to assess the potential costs associated with insufficient operational technology (OT) security.

By offering detailed financial forecasts, the calculator empowers senior management to make well-informed decisions regarding security investments.

Industrial organisations increasingly depend on interconnected systems, elevating cybersecurity to a critical factor in business resilience and profitability.

According to VDC Research, over 60% of industrial companies last year reported that cybersecurity breaches had led to significant costs. Despite this, a persistent disconnect remains between security teams and executive leadership as security professionals focus on minimising risk, while executives must balance cybersecurity concerns with broader business objectives. This misalignment often results in competing priorities and underfunded security initiatives.

To bridge this gap, Kaspersky has launched the OT Cybersecurity Savings Calculator, an innovative online tool designed specifically for industrial organisations to assess the potential costs of inadequate operational technology (OT) security¹.

The primary aim of this tool is to translate cyber risks into tangible financial metrics and support strategic discussions around priorities and budget allocation. By entering details such as their sector, sub-sector, region, company size, breach history, and existing cybersecurity measures, organisations can estimate their potential cost savings and receive customised, actionable recommendations.

The calculator benchmarks performance against industry peers and highlights the company’s position within the current threat landscape.

“We believe this calculator is a powerful resource for transforming complex cyber risk data into straightforward financial insights. It enables OT leaders, security professionals, and executive teams to develop clear, data-driven business cases and recognise the value of cybersecurity investments. With actionable guidance, it promotes a comprehensive approach to resource management and strengthens overall organisational resilience,” comments Andrey Strelkov, Head of Industrial Cybersecurity Product line at Kaspersky.


Kindly share this post
Continue Reading

Trending