ICT Security-Sécurité PC et Internet

A new security start-up focused on helping businesses deal with targeted attacks plans to showcase a drive-by download that plans malware silently onAndroid smart phones.

CloudStrike, which emerged from stealth mode last week with $26 million in funding, says the attack is delivered via spear-phishing SMS messages that lure users to a link that exploits a WebKit zero-day vulnerability. ...

While Jeff Schmidt, the CEO of JAS Global Advisors, was surfing the Web on his new Android smartphone (his first Android phone) earlier this year, what appeared to be an ad popped up on his screen.

On a smartphone, drive-by downloads work differently, says Johnson, who is also a senior instructor with the SANS Technology Institute. "With an iPhone, I can't browse to a Website and have it install an app on my iPhone. The iPhone is not capable of doing that, which is good," he says. "The problem is that the drive-by download model has changed to take that into account."

So instead of dumping an app onto your smartphone's OS, the infected Website exploits a vulnerability in,

say, ===> the Safari browser and runs commands or packages within the phone's operating system to change the way it works, says Johnson. <===