Major trends over the past 6 months:
1. The number of Android viruses continues to rise steadily; roughly one in ten apps are now fully or partially malware.
2. Payment-based viruses are becoming more prevalent, endangering the finances of users.
3. Vulnerabilities, such as Heartbleed, presented serious threats to mobile and cloud security.
4. Attacks targETing Wi-Fi networks have proliferated around the world.
Analysis of malware data on the Android platform
The number of Android viruses continues to rise steadily. Cheetah Mobile collected 24.4 million sample files during the first six months of 2014. Of those samples, 2.2 million turned out to be viruses, or roughly 9% of the total.Chart 1. 9% of Android samples are viruses (Jan-June 2014)
In the first half of 2014, the number of samples that contained viruses grew rapidly. Cheetah Mobile’s collection of 2.2 million virus samples constitutes an increase of 20.5 times over 2012’s numbers and an increase of 2.5 times over the total from 2013.Chart 2.Android virus trend; number of infected users (2012-Present)
Increase in mobile payment viruses
2014 is destined to be the year in which mobile payment viruses become the primary threat to Android devices, both in terms of absolute number and proportion of infections. Payment viruses accounted for more than two thirds of the above mentioned viruses, while consumption viruses occupy a distance second place at 16%. These two types of viruses mainly result in financial losses for the user.Chart 3. Worldwide virus sample classification
Asia ranks highest for infection rates, entertainment viruses spread in France and Russia
Asia and select parts of Western Europe have undoubtedly had the highest rates of infection during the past six months. This is due in part to the prevalence of third party app stores in these regions, which have very lax checks to ensure that applications do not contain viruses. Malware, the primary vector for the spread of viruses, is often rife on these sites.
In contrast, infection rates in the United States, Australia and most other parts of Europe are low. As shown below in Chart 5, the probability of a device in Asia being infected is two to three times greater than one in Europe or the Americas.
Chart 4. Global mobile virus infection rates (January – June 2014)
Chart 5. Infection statistics for top regions (January – June 2014)
Asia hosts some of the highest ratings for infection, including Vietnam at 3.65% and India at 3%. In Chart 6 below, we can see the major malware apps that are spreading in these regions.Chart 6. Mobile virus infection rates in Asia (January – June 2014)
Table 1. Top 3 viruses in Asia by infection rate (January – June 2014)
Similar to Asia, Europe also has top infection hotspots, including France and Russia at 2.97% and 1.88% respectively. The infection rates of the remaining areas are comparatively low.Chart 7. Mobile virus infection rates in Europe (January – June 2014)
The most popular malware apps are entertainment applications.Table 2. Top 3 viruses in Europe by infection rate (January – June 2014)
Infection rates in the Americas are low; the highest rate being in Mexico at 1.07% and all other countries below 0.6%. The app markets here are more vigilant, which hampers the ability of malware to spread at the same pace as it does in Asia. Similar to Europe, entertainment applications are the most commonly infected apps in North and South America.Chart 8. Mobile virus infection rates in the Americas (Jan–Jun 2014)
Table 3. Top 3 viruses in the Americas by infection rate (January – June 2014)
3rd party markets are the biggest virus sources
Various 3rd party markets are the main source vector for virus transmission. According to our analysis, viruses coming from 3rd party markets account for 99.86% of infections - 713 times more compared to Google play at 0.14%.Chart 9. Channels for Android malware
The main Android markets are, by country: Korea (Samsung, T-store); U.S. (Amazon); Russia (Yandex store). In China, there are countless markets. These 3rd party markets generally do not check for or remove malware, which provides ample OPPOrtunities for viruses to spread.
Go check your Android system version!
According to our analysis, infection rates differ among the various Android systems. Android systems 4.1 and 4.2 have experienced the largest proportion of infections, but this is likely due to these versions having a large number of users compared to other versions. In total, 65.4% of infections are on these two versions. Android system versions 4.3 and 4.4 are more secure, but they still contain major vulnerabilities.
Mobile payments: Malware’s new target
Since 2013, payment viruses have swept the globe and the growth rate in 2014 has reached new heights. In all current virus samples, payment viruses account for 68% of the total. It is theorized that their growth is concomitant with the growth of mobile payment systems worldwide. Hacking SMS or app payment methods is easier for hackers compared to hacking online banking systems.Chart11. Payment virus classification
Table 4. Descriptions of payment malware
An analysis of the spread of payment viruses over the past year shows us that in June 2013 there were on average 1,500 new virus variations popping up each month. However, in May 2014, this number increased to 6,500, increasing fourfold.Chart12. Recent increase in payment malware variants
Chart 13. Infected users of payment malware (March - June 2014)
Payment viruses are prominent worldwide. In the first half of 2014, Russia and southern Asia were the most widely infected areas, as shown below.Chart 14. Users infected by payment malware by country (January - June 2014)
Chart 15. Payment Malware Infections by Country (January - June 2014)