http://www.nytimes.com/2014/10/02/technology/personaltech/mobile-malware-small-numbers-but-growing.html 2014-10-01 22:41:11 Mobile Malware: Small Numbers, but Growing A soaring percentage increase in phone infections is tempered by the fact that some basic tech hygiene will usually protect you. === THE warning was dire: A small security company revealed a flaw in millions of smartphones that could allow dangerous software to masquerade as a legitimate app and seize control of a phone. The threat was a big conversation topic at this year’s Perhaps that should not be surprising. For some time, computer security companies have been on the lookout for apps meant to do harm to smartphones. But for all the concern, so-called mobile malware has had not had much of an impact on regular people. A recent report by the security company McAfee The actual number of phones hit by mobile malware, however, is tiny. McAfee said one of the largest mobile infections it was tracking recently — a kind of malware that can lock your phone and all the data on it and hold it for ransom — had infected 20,000 to 40,000 mobile users in the United States. By comparison, the recent hack of So is mobile malware a threat? Sure. But your threat level depends on who you are. For example, it was But if you’re not a celebrity or a protester, and you’re not carrying corporate or government secrets on your device, it is certainly not your biggest computer security problem. And if you practice basic security hygiene on your mobile phone — good passwords, downloading apps from reputable sources and treating email on a phone with the same caution as on a computer — it is easily avoided. Phones can get infected when someone accidentally downloads a malicious app. Clicking some ads can also start downloads of malware, and hackers can even pretend to be a public Wi-Fi hot spot to steal personal data. Google’s popular Android operating system is the overwhelming target of all these mobile hacking attempts. But Google argues that actual infections are rare, especially in the United States and Europe where most Android phones are running official versions of the operating system and the Google Play or Amazon App Store. Take the Android security hole called “Master Key” as an example. The flaw, revealed by It could even, researchers warned, take control of the phone and make it part of a so-called botnet, a network of hacker-controlled computers or phones usually used to send spam or break encryption schemes. But Adrian Ludwig, who is in charge of Android security at Google, said Master Key and the flaw identified this year, called Fake I.D., didn’t end up causing much trouble. “Neither of them ever had any meaningful impact on user security,” said Mr. Lugwig. “On the order of one or two out of every million installs were actually potentially harmful to users.” Google, like Apple, Microsoft and BlackBerry, works to verify the apps it allows into the Google Play store and even the alternative Amazon App Store. Malicious apps can sometimes find a way in, but it’s unusual. Google says most of the infections it sees are in Russia and Vietnam, and they come through unauthorized app stores that aren’t vetted by either Google or mobile phone operators. So, downloading apps only from approved sources is an easy preventive step. And Google recently introduced updated app scanning that will You might encounter more malware if you get programs from other app stores, like those that come preinstalled on non-Google Android phones in other countries or even third-party alternatives that anyone can access, like The system, called Some carriers in the United States also install security software on the phones they sell, like an app called Lookout Mobile Security. Lookout is included on Android phones you buy from T-Mobile, AT&T; and Sprint, and can be downloaded from the Apple App Store as well. The company says it has about 60 million users. Kevin Mahaffey, the chief technology officer at Lookout, said about 4 percent of its users encountered one or more pieces of mobile malware a year. The numbers are much higher in Russia, at 63 percent, and China, at 28 percent, he said. “On the scale of PC threats, that is lower,” Mr. Mahaffey said. “But it’s still something people need to be careful of.” But security companies like McAfee maintain that mobile malware is on the rise and that, while it might not be a major problem now, it’s a rising tide. “We think the threat is real; we think it’s a growing threat,” said Gary Davis, McAfee’s chief consumer security evangelist. “We think there’s a laissez-faire attitude with consumers not giving it the same kind of attention they give other threats.” Malware concerns are more acute in the workplace, where people increasingly bring their own devices and use them for conducting business. McAfee and other security software companies offer apps for both Android and iOS that will scan other apps for potential security threats and known malware. The apps can also alert you if a program is asking for access to more of your phone than seems necessary, Mr. Davis said. “Why would a flashlight app need to see contact list and call records?” he said. “That just opens them up for abuse from other sources.” These apps, along with Lookout, are free. But common sense can keep the average consumer covered. When you’re downloading apps, security experts say you should pay attention to how long they’ve been on the market and whether they have good ratings from other users. Use a good password to lock down your phone in case it’s lost or stolen. And if you get an email with a link to a site that looks like your bank but is asking for your password, stop and double-check the link. Or just call the bank.