PRESS RELEASE
QR codes delivering malware, stolen digital certificates and the persistence of rootkits
AMSTERDAM, 25 January,2012 - AVG Technologies, a leading provider of internet and mobile security, today presents the "AVG Community Powered Threat Report - Q4 2011", providing insight, background and analysis on the trends and developments in the global online security threat landscape. Highlights in this quarter's report are the risks of QR codes, stolen digital certificates bypassing security on mobile phones and the persistence of rootkits.
Cybercrime has come a long way since it was mostly a digital form of vandalism. It has developed into a criminal business operated for financial gain and is now worth billions. In this report AVG focuses on some of the most notable cybercrime developments in the last quarter.
QR codes are becoming popular for mobile users to insert text and URLs into the mobile device without typing. Unfortunately they are also being discovered as an ideal way to distribute malware to unsuspecting victims. The user does not know what lurks behind the QR code until the malware is already installed and running. This report describes in detail the new technique already used by hackers and expected to gain momentum in 2012. Putting a malicious QR code sticker onto existing marketing material or replacing a website's bona fide QR code with a malicious one could be enough to trick many unsuspecting people.
"In Q4 we clearly saw the convergence between computers and mobile phones applies to malware too. As phones become more like computers, so do the risks," said Yuval Ben-Itzhak, Chief Technology Officer, AVG Technologies. "Many sophisticated tricks of the trade from computers are now being repurposed for phones. However, as phones are often tied into billing systems the gains can be far greater."
2011 saw a surge in both Android users and Android malware samples. In December, Google removed another 22 malicious apps from the Android Market, making the total for 2011 pass the 100 mark. 1 Cyber criminals have now clearly discovered phones as an interesting target. In another sign that mobile phones are becoming more like computers every day, the use of stolen certificates is now making its way to mobile devices. Digital certificates are often used to certify the identity of the author of an application. If a criminal can get their hands on the certificate belonging to a major software developer, their malware can circumvent security provisions and give users a false sense of security.
Rootkits have been one of the more serious threats to target operating systems in recent years. Rootkits evolved from commercial and financial use to cyber warfare with a very specific target (Stuxnet, Duqu 2). Currently we are witnessing the first phase of the rootkit evolution on mobile devices (CarrierIQ3). They are ever evolving to be much more sophisticated with some interesting samples showing up every few months.
In this report we focus on one of the latest rootkits called ZeroAccess, a very sophisticated, very effective rootkit using advanced anti-forensic features. ZeroAccess is a kernel mode rootkit spying on users and is controlled from a remote server. Waiting for commands from the criminals behind it, the rootkit allows the criminals to use the infected machine when and how they wish.
Other key findings in the report:
- The Blackhole toolkit is currently the most active threat on the web with a share of nearly 50% of all detected instances and over 80% of all toolkits
Around a million malicious mobile events have been detected during this quarter
The USA is still the largest source of spam, now followed by the UK. Compared to the previous quarter, the UK jumped from fourth to second place overtaking India and Brazil.
Brazil is not just a very active banking Trojan market4, the report highlights Portuguese as the second most used language in spam messages
JR Smith, CEO of AVG Technologies, said "With threats such as ID theft, phishing attacks and Trojans, cyber criminals create an environment of increased risk that puts people off going online. At AVG we believe our role is to give people the tools and peace of mind to enjoy their online experience."
About the report
The AVG Community Powered Threat Report is based on the Community Protection Network traffic and data, collected over a three-month period, followed by analysis by AVG. It provides an overview of web, mobile devices, Spam risks and threats. All statistics referenced are obtained from the AVG Community Protection Network.
The AVG Community Protection Network is an online neighborhood watch, helping everyone in the community to protect each other. Information about the latest threats is collected from customers who choose to participate in the product improvement program and shared with the community to make sure everyone receives the best possible protection.
AVG has focused on building communities that help millions of online participants support each other on computer security issues and actively contribute to AVG's research efforts.
Full Q4 Threat Report: AVG_Community_Powered_Threat_Report_Q4_2011
* 1 https://www.computerworld.com/s/article/9222595/Google_pulls_22_more_malicious_Android_apps_from_Market
* 2 https://www.computerworld.com/s/article/9185919/Is_Stuxnet_the_best_malware_ever_
* 3 http://www.guardian.co.uk/technology/2011/dec/15/carrier-iq-faces-us-probe
* 4 http://www.circleid.com/posts/20111123_brazil_the_newest_up_and_comer/
About AVG Technologies:
AVG's mission is to simplify, optimize and secure the Internet experience, providing peace of mind to a connected world. AVG's powerful yet easy-to-use software and online services put users in control of their Internet experience. By choosing AVG's software and services, users become part of a trusted global community that benefits from inherent network effects, mutual protection and support. AVG has grown its user base to approximately 106 million active users as of September 30, 2011 and offers a product portfolio that targets the consumer and small business markets and includes Internet security, PC performance optimization, online backup, mobile security, identity protection and family safety software.
