In 2010, network managers faced a growing number of smartphones and similar devices connecting to corporate networks, and security bodies warned that some of them carried malware. The US-CERT, vendors such as WatchGuard and Juniper Networks, and researchers all addressed the problem that year.
The concern was practical. Employees were bringing personal phones to work and joining them to company email, Wi-Fi and VPNs, often without IT approval. An infected handset on the internal network could expose more than the handset itself.
What US-CERT described in April 2010
A US-CERT technical information paper (TIP-10-105-01, dated 15 April 2010) surveyed cyber threats to mobile devices. It traced the history from Cabir, a Bluetooth worm for Symbian Series 60 phones and the first widespread sample of mobile malware. Cabir drained batteries by repeatedly trying to make Bluetooth connections. The paper said that the mobile malware of 2010 was more insidious than that early nuisance.
It named two later examples. Ikee.B, which the paper called the first iPhone worm with a clear financial motive, searched for financially sensitive data stored on iPhones. It also tried to coordinate infected phones through a botnet command server. The paper said it infected only iPhones that had been modified.
The second was the Sexy Space worm, which spread as a digitally signed Symbian application. It stole subscriber, device and network information, and it could build a botnet. The paper said it spread through spam text messages containing a link to a site hosting malicious applications. At the time it affected only Symbian devices.
Vendor advice in March 2010
WatchGuard Technologies published its 2010 security predictions, and senior security analyst Corey Nachreiner was interviewed about them in a March 2010 Network World piece. He called an outright ban on smartphones unreasonable. He said smartphones could benefit from firewall and antivirus software, but he cautioned that phones are far more resource-constrained than PCs.
He also suggested configuring phones to send all data traffic through a VPN tunnel to headquarters. That would put phone traffic behind the same perimeter defences as local users, for example a WatchGuard UTM appliance.
Juniper’s figures in October 2010
In October 2010, Juniper Networks announced a Global Threat Center focused on mobility and described it as the world’s first. The company said its research showed mobile-focused malware had risen 250 percent from 2009 to 2010. It reported the following findings:
- Nearly 80 percent of users accessed their employer’s network without the employer’s knowledge or permission, and 59 percent did so every day.
- A Fortune 15 company found that 5 percent of its mobile devices, or 25,000, were infected with malware.
- Spyware made up 61 percent of reported smartphone infections, and text-message Trojans made up 17 percent.
- In Android Market applications capable of malicious activity, 1 in 20 asked for permissions that could let the application place a call without the user’s knowledge.
These were Juniper’s own figures, and they came from its research. They were not an independent census.
Android enters the picture
Android malware also began in 2010. The security firm SecAlliance records that Trend Micro found the first Android Trojan that year. It was a Russian SMS fraud application that sent messages to premium-rate numbers. Another Trojan from the same year posed as a game called Tap Snake and transmitted the phone’s GPS location.
What happened next
The trend continued. Cisco’s 2013 Annual Security Report said Android malware encounters grew 2,577 percent during 2012. It also said that mobile malware was still a tiny fraction of the attacks Cisco intercepted. The same coverage cited Gartner as saying employee-owned devices were more than twice as likely to be infected with malware as company-owned computers.
In 2014, Lookout described NotCompatible.C, an Android malware family that acted as a proxy on the infected phone. Lookout said an infected phone on an enterprise network could give attackers access to protected networks, including over corporate Wi-Fi and VPNs.
The advice from 2010 was largely about control rather than prohibition. It meant knowing which devices were on the network and securing their traffic. Security software on the phones was part of it, but only a part.