A recent Computerworld article talked about a research paper by Daniel Brodie, Sr. of Lacoon Moblie Security. In this paper, Brodie talked about spyphones, surveillance tools surreptitiously planted on a user’s handheld device, have become more and more common. If you have been watching CBS’ Person of Interest, you would note the first thing that is done is that a spyphone is put on the subject’s cell phone. Now, you might think this is just Hollywood’s version of reality, but the truth of the matter is that it has become reality.

Lacoon Mobile Security partnered with several global cellular network providers to sample 250,000 subscribers in March of last year and again in October. The first sampling showed that 1 of 3000 devices had spyphone software installed. The second sampling showed the infections tripling to 1 in 1000 devices being infected. The initial survey showed that 74% were iOS (Apple) devices while the second showed the percentage dropping to 52% being iOS devices. The following chart from the research paper shows the percentage of devices infected by operating system.

Why the increase in infections? Lacoon Mobile Security identified more than 50 families of spyphones. As stated in the research paper “These spyphones run the gamut from dedicated high-end groups targeting specific nations and corporations, to low-end software targeting the private consumers…. At the lower end of the spectrum are spyphones which most commonly portray themselves as promoting parental controls and spouse monitoring.” What is more amazing is the cost of this type of software. Again from the research paper, Brodie noted

“The difference between the military and non-military grade spyphones? The device infection vectors and accordingly, their cost. Current estimates hold nation-targeted spyphones at $350K1. In the meanwhile, the commoners-targeted spyphones follow a monthly low licensing model– sometimes as low as $4.99.

The amazing part is that the end-result is essentially the same on the targeted devices. So for just a bit more than the price of a Starbucks latte, an attacker can purchase a spyphone with nearly identical capabilities to that of a top-end spyphone.”

The conclusion of the paper is even more interesting. Brodie concludes that “It is important to recognize that infection is inevitable.” But he also notes that we have seen this before in the computer desktop environment. The steps that we use to protect ourselves from malware in the desktop world are needed in the mobile world. The problem is that the tools to prevent mobile device malware are not there yet and the awareness of the problem is not large enough for the tools to be profitably developed.

How can you protect yourself? First follow the same rules on your phone that you do on your desktop computer. Be very careful on what apps you download. Keep up with what is happening on mobile device security. Talk to your IT Professional to help you defend against this new type of malware.