Cybercriminals go mobile

The increasing use of smart mobile devices will make them a major target for cybercriminals, a security analyst warned today.

Rick Howard, director of intelligence for US security specialist iDefense, said mobiles are becoming the world's most used web-access device, which makes them a tempting target.

Software development kits for the new Google G1 phone, Apple's iPhone and the Blackberry, are available to anyone. "We are basically giving the hacker community a tool so that they can figure out how the thing works so that they can hack it," he said.

Also likely to increase are 'fast flux' attacks that change parameters such as DNS addresses as often as each new infection. "They are very difficult to track from the outside," he said.

Organisations inside the system, such as service providers and domain registrars, can more easily spot such activity but they have no incentive to do anything about it.

"Registrars actually make money when a DNS (Domain Name Server) is changed. Some are very good and report suspicious activity but many don't."

Professional hackers have largely replaced the early prankster amateurs. They were often motivated by a desire for notoriety and wanted to make as big a splash as possible, creating worms and other malware that swept to world.

"There hasn't been one of those for around five years," said Howard. " Attacks are becoming more targeted."

He cited the BBB gang, so called because they sent out phishing emails purporting to come from the US watchdog Better Business Bureau. These were sent to executives warning them that their company faced legal action and directing them to a legitimate-looking site to get details.

"If they clicked on the link they downloaded code which basically gave BBB control of their machine."

The point was that these were executives with access to corporate accounts that could be milked by the criminals.

Howard was in London because iDefense, a division of Verisign, is expanding into the UK. The company provides intelligence, including early warnings of vulnerabilities, risk assessment and other consultancy services to enterprises and government organisations.

Some Hackers are state sponsored, Howards said. See Wicked Rose and China's information war