Skip Navigation

Close and don't show again.

Your browser is out of date.

You may not get the full experience here on National Journal.

Please upgrade your browser to any of the following supported browsers:

How Zombie Phones Could Create a Gigantic, Mobile Botnet How Zombie Phones Could Create a Gigantic, Mobile Botnet

NEXT :
This ad will end in seconds
 
Close X

Not a member? Learn More »

Forget Your Password?

Don't have an account? Register »

Reveal Navigation
 

 

Tech

How Zombie Phones Could Create a Gigantic, Mobile Botnet

Android at the Google I/O conference in San Francisco on June 27, 2012.(AP Photo/Paul Sakuma)

photo of Brian Fung
June 26, 2013

You've heard of the "botnet"—a collection of enslaved, malware-infested computers that act together to pump out spam and DDoS attacks, often unbeknownst to their owners. For the past decade, botnets have mostly been a problem for the PC world. But, according to a new report on mobile malware, it may not be long before we start seeing botnets built out of an increasingly sophisticated type of device: cell phones.

"It's only a matter of time before that's pervasive," said Karim Toubba, a vice president at Juniper Networks, the publisher of the study.

(Juniper Networks)

Google's Android operating system is by far the most vulnerable to outside attackers. Unlike Apple, which forces its iPhone apps through an infamously strict approval process before storing them in a single app store, Android phones are capable of downloading and installing apps from third-party websites.

 

As with Web browsing, visiting random sites and downloading software whose credentials you can't verify is a recipe for disaster. Yet many of us do it, even without realizing it. Ninety-two percent of the attacks detected by Juniper's mobile security research team last year took place on Android. The remaining 8 percent targeted smaller platforms like Windows Mobile, BlackBerry, and Symbian.

It's not just malicious apps—or bugs in legitimate apps—that let attackers get through. Mobile operating systems themselves have vulnerabilities. Hackers sometimes will disguise a piece of malware as a valid system update. Once it's installed, the malware can run in the background, monitor a user's behavior, and report that activity to a central command-and-control machine.

From there, it's not a huge jump to turn a compromised device into a slave. We already know it's possible, because it happens all the time to desktops and laptops. 

"The capabilities there are very similar," said Toubba, "to the underlying capabilities of the desktop operating system Linux." 

Android could neutralize the vast majority of malware threats out there, the Juniper report said, if it made sure every one of its devices were running the latest version of the operating system. The problem is, even after Google makes updates to Android, the burden is on your wireless carrier to actually push the update to your phone. And they aren't doing it. More than a third of all Android devices haven't been updated since February 2011. More than a quarter of Android devices haven't been updated since Dec. 2011. 

When I asked Toubba whether carriers needed to do a better job of updating their customers' phones, he said simply that many were "taking these risks and these threats quite seriously."

LIKE THIS STORY? Sign up for Tech Edge

Sign up for our daily newsletter and stay on top of tech coverage.

Sign up form for Tech Edge
Job Board
Search Jobs
Digital and Content Manager, E4C
American Society of Civil Engineers | New York, NY
PRODUCT REVIEW ENGINEER
American Society of Civil Engineers | CA
Neighborhood Traffic Safety Services Intern
American Society of Civil Engineers | Bellevue, WA
United Technologies Research Fellow
American Society of Civil Engineers | New York, NY
Process Engineering Co-op
American Society of Civil Engineers | Conshohocken, PA
Electrical Engineer Co-op
American Society of Civil Engineers | Findlay, OH
Application Engineer/Developer INTERN - Complex Fluids
American Society of Civil Engineers | Brisbane, CA
Application Engineer - Internships CAE/CFD Metro Detroit
American Society of Civil Engineers | Livonia, MI
Chief Geoscientist
American Society of Civil Engineers
Application Engineer - Internships CAE/CFD Metro Boston
American Society of Civil Engineers | Burlington, MA
Professional Development Program Engineer
American Society of Civil Engineers | Farmington Hills, MI
Civil Enginering Intern - Water/Wastewater/Site-Development
American Society of Civil Engineers | Sacramento, CA
Staff Accountant
American Society of Civil Engineers | Englewood, CO
Biomedical Service Internship Position
American Society of Civil Engineers | Flint, MI
 
Comments
comments powered by Disqus