Have we been mis-sold a mobile malware ‘epidemic’?

iphoneJust finished an interesting story from security firm Damballa on mobile malware.

Breaking ranks with most of the rest of the industry, the vendor suggests in its new report that the amount of mobile malware on US networks is actually pretty minimal, and that if most users stick to the official app stores they should steer pretty clear of danger.

Indeed, it found in its analysis of half of the mobile traffic in America, only 0.0064% – or 9,688 devices out of 151 million – contacted a domain on the mobile black list.

This was even down on the 0.015% that did so in 2012.

Now the caveat is that this is just in the US, and only focusing on malicious network traffic rather than installs, but it’s still a pretty interesting piece of research.

It tends to fly in the face of the picture painted by many anti-malware companies, some of which perhaps are talking slightly disingenuously about malware epidemic on Android.

There undoubtedly is an awful lot of malware designed for Android. But how much of it actually makes its way on users’ devices? Especially if those users only stick to the first party app stores.

I’ve a feeling that if you took China and Russia out of the equation, for example, the Android malware problem wouldn’t be even remotely as acute.

“I do not know when if ever mobile malware (as we see it on the PC) will become a problem on mobile devices. I really think the app stores can control distribution of ‘money-making’ malware,” Damballa CTO Brian Foster told me by email.

“The risks and threats of around insecure cloud apps or insecure access to cloud apps are already here. The risk of losing your device and giving a 3rd party inappropriate access to your data is already here.”

It is those latter risks that IT managers would do well to get a handle on, says Foster.

Another part of the research worth mentioning is that only 1.3% of mobile hosts weren’t also in the set of hosts contained by historical non-cellular traffic.

This means that mobile apps are using the same hosting infrastructure as desktop applications and, as such, IT security teams can apply the same network-based security to spot domains with bad reputation scores etc.

F-Secure security advisor, Sean Sullivan, agreed that most Western netizens would be safe sticking to the authorised channels.

He admitted to me too via email that the mobile malware epidemic had been “overstated by *some* in the AV industry”.

However, he felt justified in sharing threat intelligence on new mobile malware, given that F-Secure’s customer-base stretches far and wide globally.

“We don’t just sell mobile AV – we sell mobile security with multiple security features and sell/bundle it with our other services in our cross-platform ‘SAFE’ offering,” he explained. “When you buy our PC software, you also get Android software – it’s all part of the package.”

That’s completely understandable and I think even if Vendor A doesn’t sell into markets where mobile threats are higher risk (like Asia, for example) they still have a responsibility to reveal major new discoveries.

However, unfortunately it doesn’t take much for responsible disclosure of threat intelligence to turn into FUD-y marketing hyperbole.

Advertisements

Baidu’s $2 BILLION gamble on mobile apps

baidu logoChinese search giant Baidu has just agreed to pay $1.9 billion (£1.3bn) to acquire mobile app store provider 91 Wireless Websoft in the biggest internet M&A deal ever in the People’s Republic.

Commentators have already been arguing over whether nearly $2bn for effectively two mobile app stores is a good deal for China’s biggest search company.

As with all acquisitions, only time will tell, although it’s certainly a statement of intent for the firm and one it needed to make with the likes of Alibaba and Tencent all making big mobile internet plays.

Beijing-based Forrester analyst Wang Xiaofeng said in comments sent to me that it was a smart move for Baidu to “assure its competitiveness in the age of the mobile internet”.

“Alibaba is working on its m-commerce strategy through its investment in Sina Weibo and an [offline to online] strategy through the acquisition of Autonavi; Tencent is digging out monetisation possibilities from its killer product WeChat, including eBusiness and mobile payment,” she explained.

“91 Wireless’ strength in mobile applications will be a great complement to Baidu’s current business.”

As to exactly what Baidu is buying, well the main bit of 91’s business is two app stores – 91 Assistant and HiMarket – which apparently lead the domestic market with over 10 billion downloads.

This will give Baidu a great distribution channel for its own apps, and to be honest the deal shows a good degree of self-awareness from the web giant – it knows more users in China find info on the mobile net via apps than mobile web-based search engines.

Whether it proves to be a great piece of business or a stunningly ill-judged waste of money remains to be seen but I’d lean towards the former.

Baidu certainly couldn’t sit back and let its rivals gain the initiative in the brave new world of mobile and if this acquisition doesn’t work out it could well be because it left it too late before pouncing.