One can argue that for any adult right now, the smartphone is highly likely the most personal piece of technology he or she owns. Indeed, there are a lot of reasons supporting this idea -- after all, we carry our smartphones just about everywhere we go, and our handsets basically carry all sorts of very personal information, including passwords, bank and credit card information, contact information of family, friends, and colleagues, and loads of potentially sensitive pictures. It is no surprise then that hackers now are looking to hack our mobile devices more than our personal computers.
During the recent Kaspersky Security Analyst Summit held in the city of Cancun in Mexico, Andrew Blaich (a member of Lookout’s mobile security research team) and Eva Galperin (who heads the cybersecurity division of the Electronic Frontier Foundation) shared their findings and thoughts with regards to Dark Caracal.
For those not in the know, Dark Caracal is a malware campaign on a worldwide scale, and it has already infected smartphones and tablet devices in over 20 countries across the globe. The campaign was said to have been carried out from Lebanon’s capital city, Beirut, specifically in a building owned by the Lebanese General Security Directorate. The malware has proven to be effective in disguising itself as a legitimate mobile app (like WhatsApp or Signal), and as soon as it was installed in people’s devices, it proceeded to give hackers access to the affected device.
According to researchers Blaich and Galperin, the recent success of Dark Caracal will likely become a trend for hackers in the near future. Personal computers used to be the most prime targets for these types of attacks, but as we inch closer to the end of the decade, consumers’ smartphones have become their new personal computers.
What makes malware attacks such as Dark Caracal so deceptively effective is that they do not actually take advantage of any exploit. Instead, what the Trojan app does is ask permission from the user, just like any other app would, to take photos, share the user’s location information, or even record sound. Apple and Google are pretty good at developing security fixes for exploits, but permissions are a lot harder to deal with because there is nothing wrong with the software to begin with -- it is just the user being tricked into allowing intruders access into his or her device.
Various experts in the field of mobile and cybersecurity mostly agree that the next wave of attacks will mostly involve mobile devices more than personal computers. It is quite possible that the shift is actually already happening right now -- Lookout and the EFF observed that during the Dark Caracal campaign, a separate attack was orchestrated on computers running the Windows operating system, and the volume of affected computers was nothing compared to the number of infected mobile devices.
