mRAT spyware bypasses mobile enterprise controls, research shows

Mobile remote access Trojan (mRAT) infections are bypassing mobile enterprise security controls, putting businesses at risk of cyber espionage

Mobile remote access Trojan (mRAT) infections are increasing and bypassing mobile enterprise security controls, putting businesses at risk of cyber espionage, research has revealed.

mRATs are capable of intercepting third-party applications such as WhatsApp, despite guarantees of encrypted communications, the study of 2 million smartphone users by Lacoon Mobile Security found.

The research also showed that mRATs are similarly able to bypass security controls in mobile device management (MDM) systems, which a growing number of businesses rely on for mobile security.

mRATs are designed to carry out cyber espionage and typically enable eavesdropping on calls and meetings, extracting information from email and text messages and location tracking of executives.

The spyware requires a backdoor for installation, through the rooting of Google Android or the jailbreaking of Apple iOS devices.

The research found that mRATs can bypass rooting and jailbreaking detection mechanisms installed on handsets, with 52% of infected devices found running iOS and 35% running Android.

Once the smartphone is infected, the spyware then sends mobile content – such as encrypted emails and messages – to the attacker’s command and control (C&C) servers.

The attacks undermine the basic notion of a secure container on which most MDM systems are based, according to Lacoon Mobile Security.

MDM systems create secure containers that separate business and personal data on the mobile, in an attempt to prevent business-critical data from leaking.

However, the research team demonstrated that mRATs do not need to directly attack the encryption mechanism of the secure container, but can grab it at the point where the user pulls up the data to read it.

“At that stage – when the content is decrypted for the user – the spyware can take control of the content and send it on,” said Ohad Bobrov, CTO and co-founder of Lacoon Mobile Security.

“Our researchers adapted a similar method used by mRATs in the wild that intercept third-party applications such as WhatsApp,” he said.

According to Bobrov, the reason mRATs pose such a danger is that, while the software may be installed on a single device, it can be used to target the whole organisation for espionage purposes.

“To mitigate these and other attacks aimed at the mobile devices utilised within the enterprise, organisations need to accurately assess the risk of mobile activity and actively protect against emerging, targeted, and zero-day attacks,” he said.

Bobrov said businesses need to understand that, while MDMs offer static compliance and policy enforcement, they do not offer complete protection.

Mobile best practices and technologies include:

  • Remotely analyse the risk involved with each device, including behavioural analysis of the downloaded applications;
  • Calculate the risk associated with the device's operating system vulnerabilities and usage;
  • Conduct event analysis to uncover new, emerging and targeted attacks by identifying anomalies in outbound communications to C&C servers;
  • Enable network protection layer to block exploits and drive-by attacks and contain the device from accessing enterprise resources when the risk is high.


Read more on Hackers and cybercrime prevention