Instructor: In this lesson, we're going to talk
about mobile malware infections.
Now, when it comes to mobile malware infections,
this occurs anytime your device becomes the victim
of malware, which could be a virus, a worm, a Trojan,
or things like that.
When you hear the term "malware,"
I want you to think about bad things happening
to your device because somebody else is in control of it.
For example, one of the most common things
that's targeting end users these days is text messages
with shortened links in them.
If the person clicks on that link,
it will open it in their mobile web browser,
and that mobile web browser will then download malware
and install it onto that handset.
This is just another form of phishing, going against users
and trying to get them to click on links
so the attackers can install malware on a particular device.
Now, when you're looking at your device,
how can you tell if it's been infected with malware?
Well, there's a couple of ways.
The first and most obvious is if you're running an antivirus
or anti-malware solution and it identifies
that there is malware on your device.
There are lots of different programs for mobile devices,
just like there are for your desktop computers,
where you can actually scan those devices
for malware to identify if bad things are on that device.
Most corporate mobile device management systems
do have the ability to remotely scan their devices
for malware using these systems.
Another symptom that indicates you might be infected
with malware is anytime your device
is having an excessive power drain
or high resource utilization
over what you'd normally suspect.
For example, if you have an Android device
and it starts overheating in your hand
even though you don't see any applications running,
this could be an indication
that there is some malware or rogue application operating
in the background that you're not seeing,
and it is using all that extra processor cycles
on your handset.
That extra processor activity is going to heat up the system
because it's generating a lot more heat
while using that processor,
and it's going to drain your battery significantly.
Another symptom that you might see
if the mobile device has been infected with malware
is that your data transmissions
are going to be going up significantly.
A lot of times, this is because the malware is designed
to steal your data.
If you think about your mobile device these days,
how much of your personal life exists in that mobile device?
You have access to things like your bank accounts,
your emails, your files, your photos,
and all of that stuff is being held
by this mobile computer in your hand.
Well, if the hacker can get into that device
and create a tunnel between that device and their server,
they can download all of your data from that smartphone
into their server,
and this can then allow them to hold that data for ransom
or use it for other malicious purposes.
So if you identify that there's a lot more data usage
than you were expecting and you get large data bills,
you should definitely check and see what data is being used
by which application
in order to figure out is this something that was valid
and that you've actually done,
or has somebody hacked your device.
One way to check your data usage is to look at your bill
at the end of the month,
but the other way is to check your data usage
from within the handset itself,
and this will tell you which applications are responsible
for sending how much data over a given period of time.
Another thing to consider is your camera
and your microphone.
Now, all these devices that we carry
in our pockets these days have cameras and microphones.
We use them all the time
to FaceTime with our friends or to make phone calls,
but an attacker who gets malware installed
on your device can also use it to spy on you.
In order to check for this,
one of the easiest things to do is look
at the front of your device,
and if you see the camera LED is activated,
this tells you that the camera is on.
Now, some malware is actually more sophisticated,
and if they can install what's called a root kit,
they can block the LED from lighting up
when the camera's in use,
but most malware isn't that sophisticated.
So an easy giveaway is anytime your camera LED is activated
and you're not actively using your camera,
this could be a sign that there's malware on your device.
Another thing to consider is any applications
that are asking for additional permissions
that they shouldn't have.
For example, I had one game that start asking for access
to my contact list or my camera or my microphone,
and in this case, that game didn't need access
to any of those three things,
so I blocked all three of them.
So when you're installing an application,
always consider what permissions you're going to give it,
and only give it the permissions it actually needs
to be able to use that application.
Otherwise, that application could use
those excessive permissions as an attack vector against you
if it was written by a malicious author.
Or some malicious hacker may hack that application
and use those already existing permissions
against you as well.
So these are all things that you have to worry about
when you're dealing with malware on a mobile device.
So what do you do if you find malware on your mobile device?
Well, the best thing to do
is back up the user's personal data
to make sure you have access to all their photos, videos,
personal documents, and contacts.
Then you want to fully format that device
and reinstall it with the base operating system.
At this point,
you want to make sure you've installed a good antivirus
or anti-malware application,
and then install all their applications
and data back onto the device.
Now, I've been working in the cybersecurity industry
for over 20 years, and one of the tenets
that we have is that you always know
when you've been hacked,
but you can't always be sure when you remove the attacker
from your system.
So when you have a device that has been hacked,
it's not good enough just to remove
the one application you think it is.
Instead, you should fully format the device,
reinstall the operating system
and then reinstall all the applications
from a known good baseline.