How Has the Mobile Threat Landscape Changed?

TL;DR

Mobile threats developed in a different order from PC threats: advanced persistent threats appeared first and remain the majority of the mobile attacker landscape, while cybercrime emerged later. Effective post-perimeter security must address spyware, surveillanceware, device vulnerabilities, network risks, malicious web content, and phishing because mobile devices frequently operate on personal or unsecured networks outside traditional controls.

Transcript

Hello, and thank you for joining this, uh, quick look today at our RSA Conference twenty nineteen talk on mobile security in the post-perimeter world. Um, with me today is Apurva Kumar, who's one of our threat intelligence analysts at Lookout, and I'm Mike Murray, the chief security officer of Lookout. And what we wanna talk about, um, o-on the RSA... Read More

Key Insights

• The mobile threat landscape developed in a fundamentally different sequence from the PC threat landscape. Advanced persistent threats appeared first on mobile, cybercrime followed later, and the type of unresourced attacker associated with early PC viruses has yet to emerge in the same form.
• The early PC threat landscape was dominated by relatively unresourced attackers. Malware such as ILoveYou, Melissa, SQL Slammer, Nimda, Blaster, and Code Red spread between computers, caused disruption, or enabled website defacement without representing the nation-state espionage campaigns discussed later.
• PC threats evolved from disruptive malware into financially motivated cybercrime during the mid-2000s. Data breaches and credit card theft became visible before the later rise of advanced persistent threats, creating a progression that differed sharply from the development of attacks against mobile platforms.
• Security controls on PCs evolved alongside attacker capabilities. Basic antivirus products and early firewalls or intrusion detection systems were followed by more numerous security products and controls as adversaries became better resourced and their operations grew more sophisticated.
• Advanced persistent threats are the majority of the mobile attacker landscape described by Lookout. Their early prominence suggests that mobile platforms were targeted by sophisticated actors before the ecosystem experienced the same broad progression from unresourced disruption to cybercrime seen on PCs.
• Unresourced mobile attackers have not produced an equivalent to SQL Slammer, according to the speakers, and they probably never will. This absence is a central distinction between mobile threats and the historical PC pattern, where rapidly spreading disruptive malware appeared early.
• Post-perimeter mobile security must account for several risk categories simultaneously. The speakers identify spyware, surveillanceware, device threats, device vulnerabilities, network issues, web content, and phishing as important parts of the varied threat environment surrounding smartphones, tablets, and related devices.
• Personal and unsecured networks weaken the usefulness of traditional security assumptions. Because mobile users connect through networks outside conventional organizational controls, mobile defense requires an approach designed for devices that operate beyond the established enterprise perimeter.

Questions & Answers

Q: How has the mobile threat landscape changed?

The mobile threat landscape began with advanced persistent threats rather than the relatively unresourced attackers that characterized early PC threats. The speakers describe advanced persistent threats as the majority of mobile attackers, with meaningful cybercrime appearing only in more recent years. They also note that an unresourced mobile equivalent to disruptive PC malware such as SQL Slammer has not emerged and probably never will.

Q: How do mobile threats differ from early PC threats?

Early PC threats largely came from unresourced attackers whose viruses spread between systems, caused annoyance, or enabled website defacement. Nation-state-level espionage was not the defining feature of that period. Mobile developed differently because advanced persistent threats appeared first and dominate the attacker landscape described by the speakers, while cybercrime arrived later and unresourced attackers remain largely absent.

Q: What was the historical progression of PC security threats?

The PC landscape first featured relatively unresourced attackers and spreading malware such as ILoveYou, Melissa, SQL Slammer, Nimda, Blaster, and Code Red. During the mid-2000s, cybercrime expanded through activities such as data breaches and credit card theft. Advanced persistent threats emerged afterward, while security products and organizational controls developed in parallel with increasingly capable attackers.

Q: Why did PC security controls become more extensive?

PC security controls expanded as attackers improved their capabilities and the threat landscape progressed beyond disruptive viruses. Early environments might have included McAfee or Norton antivirus, a stateful inspection Check Point Firewall-1, or ISS RealSecure IDS. As cybercrime and advanced persistent threats emerged, the industry added more products and controls to respond to better-resourced and more sophisticated adversaries.

Q: Why is mobile security considered post-perimeter security?

Mobile devices regularly operate on personal or unsecured networks rather than remaining inside a conventional organizational perimeter. That operating pattern exposes them to network issues, web content, phishing, spyware, surveillanceware, device threats, and vulnerabilities. Because traditional security rules assume a more controlled environment, securing mobile devices requires a model designed to evaluate risks that arise beyond established enterprise boundaries.

Q: What risks must a mobile security solution address?

A mobile security solution must account for spyware and surveillanceware as well as threats and vulnerabilities affecting the device itself. It must also consider network problems because users connect through personal or unsecured networks. Web content and phishing are additional risk categories. Together, these factors require broader coverage than a traditional model built around devices operating within a controlled perimeter.

Q: Why are advanced persistent threats important in mobile security?

Advanced persistent threats are important because they appeared at the beginning of the mobile threat progression and represent the majority of the attacker landscape described by Lookout. This reverses the historical PC sequence, where advanced persistent threats followed unresourced malware and cybercrime. Their prominence helps explain why mobile security cannot simply reuse assumptions derived from the earlier evolution of PC threats.

Q: What can mobile threats reveal about the future of cybersecurity?

The speakers argue that mobile threats foreshadow the direction of the broader security industry because smartphones, tablets, and related devices already operate outside traditional perimeters. Their threat environment combines sophisticated attackers with device, network, web, phishing, spyware, and surveillance risks. Studying these patterns can therefore inform future risk management as more technology operates under similarly distributed and less controlled conditions.

Summary & Key Takeaways

• The PC threat landscape began with relatively unresourced attackers spreading disruptive viruses, including ILoveYou, Melissa, SQL Slammer, Nimda, Blaster, and Code Red. Cybercrime involving breaches and credit card theft followed in the mid-2000s, while advanced persistent threats emerged only after attackers and defensive controls had become more sophisticated.

• Mobile threats followed a different sequence from PC threats. Advanced persistent threats appeared first and constitute the majority of the mobile attacker landscape described by Lookout. Cybercrime developed later, and the unresourced attacker category associated with early PC malware has not appeared in the same way on smartphones and tablets.

• Mobile devices operate in a post-perimeter environment that traditional security models do not fully address. Risk management must cover spyware, surveillanceware, device threats, vulnerabilities, network problems, web content, and phishing. Personal and unsecured networks make it difficult to apply the same security rules used in conventional enterprise environments.