ra2 studio - Fotolia
The NotCompatible mobile malware reportedly has a new variant called, NotCompatible.C, which one security firm called the most sophisticated mobile malware it has ever seen. What makes it so different from prior malware and how can its new features/functions be mitigated?
The new mobile variant of NotCompatible -- NotCompatible.C -- includes many advancements. For example, it avoids detection by using a peer-to-peer (P2P) communication protocol, end-to-end encryption for all connections, and other anti-network behavioral analysis techniques to connect to its multiple command and control servers. It can also provide proxy functionality, allowing attackers into the target network through compromised devices; this can also be achieved by issuing execution commands to its bots.
The malware's primary purposes are spam campaigns, bulk ticket purchasing and brute-force attacking. It also provides a botnet-for-hire service.
Additionally, enterprises could supply, securely configure and manage the enterprise mobile devices to prevent social engineering from being successful, however this will not always work, and is not possible in a bring your own device environment.
Prevention will be critical to boosting mobile malware protection since the NotCompatible.C's network evasion tactics make it difficult to detect. NotCompatible.C can be blocked using mobile device management security software. Another option is to segment enterprise networks so that mobile devices -- or any untrusted devices -- are placed on a restricted network with minimal access to corporate data. This is good advice in general and will help manage other risks.
While NotCompatible.C has advanced functionality to evade network behavioral analysis, there is no SSL session initialization in the custom protocol used, making it stand out from legitimate SSL traffic -- network monitoring tools like an intrusion detection system should be able to detect it.
Ask the Expert:
Perplexed about enterprise security? Send Nick Lewis your questions today. (All questions are anonymous.)
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Nick Lewis
Sophos researchers believe the SamSam ransomware campaign could be the work of one or a few threat actors using manual techniques. Learn how it works... Continue Reading
The hacking group Magecart was recently found to have run a card skimming campaign that put customer information at risk. Learn how this attack ... Continue Reading
A new version of GandCrab was discovered by researchers in July 2018 and involves the use of legacy systems. Learn how this version differs and who ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.