Online banking malware continued to thrive and grow more sophisticated with the emergence and modification of new malware families, while the number of mobile malware and high-risk apps continued to grow, hitting 2 million since the introduction of the Android platform, according to security specialist Trend Micro’s first quarter security roundup for 2014.
Though they sported new routines such as the emergence and modification of new malware families, online banking malware practitioners retained their core characteristics.
They continued to be widespread in the same countries—United States (23 percent), Japan (10 percent) and India (9 percent)—and grow in number amid the steady rise of the number of Internet users and online transactions.
The report revealed the online banking malware volume showed a 3 percent increase to 116,000 this quarter from 113,000 in the first quarter of 2013.
Attackers also went on an unexpected spree with massive breaches through point-of-sale (PoS) systems, led by spectacular breaches of security in the United States, most notably Target, though the report pointed out a South Korean ratings firm also lost the credit card information of around 200,000 of its customers in a similar attack.
“Organizations continued to struggle with attacks that were targeted in nature, which could be directly aimed at the energy, financial, health care and retail industries or critical infrastructure,” JD Sherry, vice president of technology and solutions at Trend Micro, said in a statement. “It came down to a simple equation—high-value targets that promised massive payouts were compromised despite the determined efforts of organizations to protect their valuable information.”
On the mobile front, vulnerabilities or flaws within the Android platform with far-greater implications like rendering devices unusable were reported alongside the usual spate of mobile threats.
The report noted recent bug-related incidents proved that even customized app permissions could be bypassed. For instance, a newly discovered flaw in the Android platform also bricked devices, causing them to endlessly reboot and rendering them unusable.
It’s not just Android, though–iOS users were also plagued by the so-called “goto fail” bug this quarter, which, if exploited, would block iOS’s implementation of Secure Sockets Layer (SSL)—the Internet’s standard defense against eavesdropping and Web hijacking.
“More and more cyber-criminals are shifting targets, riding the popularity and widespread use of mobile devices, apart from the fact that they are not as protected as computers,” Kenny Ye, a Trend Micro mobile threat researcher, wrote in the report. “We are bound to see more vulnerabilities in mobile platforms, especially Android, because of its huge user base.”