Between the beginning of July and the end of September, FortiGuard Labs researchers reported a marked increase in Android adware, new evidence suggesting that Zitmo (Zeus-in-the-Mobile) mobile banking Trojan is evolving into a botnet and the detection of Romanian hackers performing large scale scanning for Web vulnerabilities.


Android adware on the rise

In the last three months, FortiGuard Labs reported a surge in Android-based mobile adware with a volume of activity comparable to Netsky.PP, one of the most infamous and prolific spam generators encountered in Internet history.

Two adware variants Android/NewyearL and Android/Plankton cover various applications that embed a common toolset for unwanted advertisements displayed on the mobile’s status bar, user tracking through their IMEI number and dropping of icons on the device’s desktop.

“The surge in Android adware can most likely be attributed to users installing on their mobile devices legitimate applications that contain the embedded adware code. It suggests that someone or some group is making money, most likely from rogue advertising affiliate programs,” says Guillaume Lovet, senior manager of Fortinet's FortiGuard Labs Threat Response Team.

These types of applications require too many unnecessary rights for a normal application, indicating it has a hidden agenda. Such data request includes permission to access parts of the device that are irrelevant to the application, to get access to the device’s browser history, bookmarks contact data, phone logs and identity as well as system log files.

Zitmo gets more sophisticated

Zitmo (or Zeus-in-the-mobile) is the notorious mobile component of the Zeus banking Trojan that circumvents two-factor authentication by intercepting SMS confirmation codes to access bank accounts. The new versions for Android and Blackberry have now added botnet-like features, such as enabling cybercriminals to control the Trojan via SMS commands.

“The new version of Zitmo may already be in the wild in Europe and Asia. While we’re detecting only a few instances of the malware in those regions, it’s leading us to believe the code is currently being tested by its authors or deployed for very specific, targeted attacks,” Lovet continues.

As more banks and online merchants roll out two-factor authentication − usually through the use of an SMS code to bring the second authentication factor and confirm a transaction − Android and Blackberry users should be mindful anytime their financial institution asks them to install software onto their computing device, as this is something banks rarely if ever request from their customers.

Romanian hackers scanning for phpMyAdmin vulnerability

In the last three months, FortiGuard Labs has detected large scale scans for vulnerability. These scans were performed through a tool developed by Romanian Hackers to seek Web servers running vulnerable versions of the mySQL administration software (phpMyAdmin) in order to take control of those servers.

The tool, called ZmEu, contains code strings in the payload that refers to AntiSec, the global hacking movement initiated by Anonymous and Lulzsec last year. The scans are being performed around the world, and in September, almost 25 percent of FortiGuard monitoring systems were detecting at least one such scan per day.

“The goal behind an attack on this vulnerability is open to speculation,” adds Lovet. “But if these hackers are indeed related to AntiSec, possible scenarios include exfiltering sensitive data, using the compromised servers as a direct denial of service (DDoS) launch base or defacing the Websites they’ve infiltrated.”