Kindsight reports that 8.7 per cent of all covered home networks experienced a malware infection during the quarter. That's down from 9.6 per cent the previous quarter, but wow, it still must represent a lot of infections.
The infection rate for mobile devices is up from last quarter, to 0.55 per cent. That figure may seem low, but Kindsight estimates that it represents 11.6 million mobile devices infected with malware at any given time. Over 60 per cent of those are Android devices.
At the start of 2013, Windows devices with a mobile connection made up over 60 per cent of the infected mobile devices detected by Kindsight. By the end of the year, Android had taken the lead, and not just by a little bit. December's figures show Android at well over 60 per cent of the total. As for BlackBerry, iOS, Symbian, and Windows Phone, well, taken all together they still don't come to one per cent of the total.
The report calls Android "the Windows XP of mobile," and notes several reasons that Android is the preferred platform for mobile malware. First, it has the biggest mobile market share, and hence the biggest number of potential victims. Second, users can load any program on an Android device if they're willing to use a non-approved app store. Third, Trojanising an Android app is ridiculously simple. I can attest to that; I've seen it done in less than five minutes.
The number of Android malware samples in Kindsight's database grew by a factor of 20 during 2013. However, that doesn't actually mean there are 20 times as many distinct malicious payloads. Trojanised apps are by far the most common type of Android malware. To get maximum coverage, an attacker will add precisely the same malicious code to as many apps as possible. The report states: "Often we will discover a third-party app store distributing a single malware type disguised as hundreds of different wallpaper apps."
The report does note that generally speaking, mobile malware seriously lags behind Windows malware in terms of sophistication, stating that: "A lot of Android malware is currently fairly naïve and simplistic in its design and operation." Many Windows-based botnets can "rally" to a new command and control server if their existing one gets knocked offline. Some, like ZeroAccess and GameOver Zeus, transmit commands via peer-to-peer networks, with no central server. Mobile botnets, on the other hand, tend to use a single, hard-coded IP address for command and control. Take out that server and the botnet is dead.
The full report, available to download here, offers more information than I can begin to summarise. It charts the most common infestations for home networks and Android devices, for example, and separately charts those with a high threat level. It describes the more interesting ones in detail.
What's coming in 2014? Kindsight suggests that cyber-crooks will move to mobile malware only if they can see a profit in it, either due to new opportunities opening or old cash sources drying up. Mobile malware can be incredibly useful in advanced persistent threat attacks or cyber-espionage. Plant a spy app on a victim's phone and you can track him anywhere, slurp down personal info, and circumvent network security at his workplace.
Mobile danger doesn't have to come in the form of malware. "Imagine an underground hacktivism organisation that provided their own app for Android and iPhone," suggests the report. Its authors go so far as to posit an "Occupy the Internet" movement. Will it happen? We'll certainly find out.