The research firm shies aware from pointing a finger of blame at anyone or any organization, but asks the rhetorical “What happens when anyone can develop and publish an application to the Android Market?”
In fact, says Juniper, these days all you need is a developer account – which is relatively easy to anonymize, it notes - pay $25 and you can post your applications.
“With no upfront review process, no one checking to see that your application does what it says, just the world’s largest majority of smartphone users skimming past your application’s description page with whatever description of the application the developer chooses to include”, it says in its latest security blog.
“Sure, your application can be removed after the fact—if someone discovers that it is actually malicious and reports it. But, how many unsuspecting people are going to download it before it is identified as malicious and removed? This is precisely what is playing out in the mind of mobile malware developers today”, the firm adds.
This approach, notes the research firm, has led to major increases in research into and discovery of vulnerabilities with in the Android platform as the delivery mechanisms of mobile malware.
According to Juniper’s annual malicious mobile threats report issued earlier in the year, the firm reported a 400% increase in Android malware from 2009 to the summer of 2010.
Since then, Juniper says its has seen an exponential grow in Android malware over the last several months, adding that its global threat center found that the months of October and November are shaping up to see the fastest growth in Android malware discovery in the history of the platform.
For example, notes the research firm, the number of malware samples identified in September increased by 28% over the number of the known Android malware samples. October, meanwhile, showed a 110% increase in malware sample collection over the previous month and a striking 171% increase from what had been collected up to July 2011.
The majority of malicious applications target communications, location, or other personal identifying information, notes the research firm.
“Of the known Android malware samples, 55%, acts in one way or another as spyware. The other major type of attack, which make up 44%, are SMS Trojans, which send SMS messages to premium rate numbers owned by the attacker in the background of a legitimate application, without the person’s knowledge”, it says.
“Once these messages are sent, the money is not recoverable, and the owners of these premium rate numbers are generally anonymous”, it adds.
Juniper concludes that the people writing the Android apps are the same players that wrote malicious code for the legacy platforms of Symbian and older versions Windows Mobile.
They shifted to Android, the firm claims, because of the significant market share that the portable operating system has when compared these legacy platforms.
“Statistically, this amounts to month-to-month sample collections on those platforms of 6%, 4%, 1.4%, and 0.93% for August, September, October and November,” the firm notes.