1

I am analyzing a mobile application, which has embedded files(Worms) to attack a desktop OS. But this application does not do any harm to the mobile platform. Mobile is just a medium to deliver malware to the PC. If we connect mobile to PC then worm will infect PC.

Can it be considered a cross-platform attack, even when first(mobile) OS is unharmed?

Improve this question
7
  • It's only "cross platform" if the software is intending to attack both. If it's not meant to work on both then it's not "cross platform".
    – RoraΖ
    Jan 23, 2015 at 13:32
  • @raz Do you know if there is some other specific category for the scenario I have explained?
    – blackfyre
    Jan 23, 2015 at 13:40
  • Well I'm not really sure what you mean by first and second OS. Which operating systems are we talking about? What's your setup?
    – RoraΖ
    Jan 23, 2015 at 13:55
  • First OS is a mobile OS, second is a desktop OS. If we connect mobile to PC, then worm can infect the PC.
    – blackfyre
    Jan 23, 2015 at 14:00
  • 1
    I'd argue that this is in fact a cross-platform attack. The mobile app has embedded worms, thus qualifying it as either a malware-infested device or an attack mechanism of some sort. The intention behind how the app/worms got there is irrelevant. As soon as it tries to harm another platform, it's considered cross-platform.
    – willc
    Jan 23, 2015 at 14:17

1 Answer 1

Reset to default
1

The scenario you describe qualifies as a cross-platform attack simply by the fact that one device attacks another.

The mobile app containing worms may not harm the mobile device itself, but it is by any other name a malicious, infected device. When plugged into the PC, it launches the attack to that platform, thus making it a cross-platform attack.

A specific example can be found on the TrendMicro antivirus website here.

That page describes the method of attack used by the TROJ_DROIDPACK.A trojan, which does exactly what you have asked about in your question, and is referred to as a cross-platform attack.

Improve this answer
4
  • 2
    Platform independent code runs on multiple platforms successfully without modification to the executable. Using one platform to inject yourself into another is not platform independent or "cross platform" in any way.
    – RoraΖ
    Jan 23, 2015 at 16:17
  • 2
    Does the mobile application try to keep itself in the phone? From what he said above, it is just a normal application that is only used as the delivering media to the attack. If you qualify it as cross-platform, you should also tag those pendrive malwares as such. The mobile application is not trying to change the smartphone behavior in any way, so you cannot say that it was attacked.
    – DarkLighting
    Jan 23, 2015 at 18:04
  • 1
    This page shows that this scenario can be considered cross-platform attack. Here they say that one example of cross-platform threat is 'Threats that begin their attack routine on one platform to lead to more malicious routines on another platform', which is somewhat similar to our scenario.
    – blackfyre
    Jan 23, 2015 at 20:03
  • 1
    "ANDROIDOS_USBATTACK.A" and "TROJ_DROIDPAK.A", show that the executables do not have to be platform independent. In "ANDROIDOS_USBATTACK.A" a mobile application(APK) downloads an exe and delivers it to PC, and in "TROJ_DROIDPAK.A" PC program downloads APK and delivers it to mobile. Here, exe can not run on mobile, and APK can not run on PC, but still they are considering these cross-platform attacks. In "TROJ_DROIDPAK.A", no harm to computer is reported, but still it is considered cross-platform attack by trendmicro.
    – blackfyre
    Jan 23, 2015 at 20:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .