Carlos Castillo is a mobile malware researcher at McAfee, where he specializes in the analysis of mobile threats and Android malware. Castillo performs static and dynamic analysis of suspicious applications to support McAfee’s Mobile Security for Android product. He is the author of the McAfee-published white paper, "Android Malware Past, Present, and Future,” and wrote the “Hacking Android" section of the book, "Hacking Exposed 7: Network Security Secrets & Solutions.” As a recognized mobile malware researcher, Castillo has presented at several security industry events, including 8.8 Computer Security Conference and Segurinfo, a leading information security conference in South America.
Prior to his position at McAfee, Castillo performed security compliance audits for the Superintendencia Financiera of Colombia, and worked at security startup Easy Solutions Inc., where he conducted penetration tests on web applications, helped shut down phishing and malicious websites, supported security and network appliances, performed functional software testing, and assisted in research and development related to anti-electronic fraud. Castillo joined the world of malware research when he won ESET Latin America’s Best Antivirus Research contest with a paper titled, “Sexy View: The Beginning of Mobile Botnets.” Castillo holds a degree in systems engineering from the Universidad Javeriana in Bogotá, Colombia.
Following the recent discovery of Android/Chuli.A, yet another Android malware has now been found using the same method as Chuli.A: via forged email messages with the Android malware (APK file) as an attachment. However, instead of creating a standalone malicious application that shows a fake invitation about an upcoming congress, this time the attackers compromised Read more…
Tags: Android, Android/Chuli.A, KakaoTalk, KaoSpy, malware, phishing, targeted attack
The Android threat landscape continues to evolve in 2013. To distribute Android threats, malware authors are transitioning away from attacking traditional vectors like the Google Play Market and third-party Android markets to vectors like spam and phishing emails and SMS. Recently a new information-stealing Android malware was found being distributed as an attachment in emails Read more…
Tags: Android, Android/Chuli, malware, phishing, targeted attack
See March 20 update at end of page. A very profitable line for mobile malware developers is Android banking Trojans, which infect phones and steal passwords and other data when victims log onto their online bank accounts. One recent trend is Android malware that attacks users in specific countries, such as South Korea and India. Read more…
Tags: Android Malware, Android/FkSite, Android/FkSite.A, banking fraud, banking trojan, Trusteer
Almost exactly one year ago, Google announced the addition of a “new layer to Android security,” a service codenamed Bouncer that was intended to provide automated scanning of the Android Market for potentially malicious software. However, as my colleague Jimmy Shah wrote in a previous blog post, Bouncer has not been enough to keep all Read more…
Tags: Android Malware, Android Market, Autorun, Google Play, phishing, Ssucl
In March a new type of financial attack on Android devices was found targeting customers of several banks in Europe. Dubbed FakeToken, one of the principal differences of this new threat–compared with previous Trojan bankers for Android such as Zitmo/Spitmo–was the fact that both authentication factors (Internet password and mTAN) were stolen directly from the Read more…
Tags: Android Malware, Cybercrime, faketoken, SpyEye, trojan banker, zeus
The huge popularity of games such as Angry Birds Space, currently in the Top 50 of the most popular Free Apps in the Google Play Market, makes them a perfect cover for malware authors to distribute new malicious code and to target many users. Recently a new malware that downloads and rates apps in the Read more…
Tags: Android, Backscript, downloader, malware, Mobile
In recent years one of the most prevalent malware threats for PCs (and lately Mac users) is fake-antivirus software, which pretends to be a legitimate security program. Its real purpose is to charge victims a fee to remove a nonexistent threat. The same threat has now been ported to mobile devices. In some cases we Read more…
Tags: Android, fake anti-virus software, fake-av, Google Play, Mobile, pup
Recently we discovered a new Android Trojan in the official Google Play market that displays a video downloaded from the Internet–but only if some sensitive information is previously sent to a remote server. The malicious applications are designed for Japanese users and display “trailers” of upcoming video games for Android. Here’s one example: Or anime/adult Read more…
Tags: Android, DougaLeaker, Google Play, Japan, malware
Based on the Android malware that we’ve seen so far, one of the principal motivations to develop and spread malware on Android is to gain financial profit. We often see deceptive applications that send SMS messages to premium-rate numbers without the user’s consent or that run man-in-the-middle attacks to forward SMS messages to an attacker Read more…
Tags: Android Malware, Android/FakeToken, banking fraud, SpyEye, zeus
[March 1: See update at end] Google Code is a well-known platform that provides a collaborative environment for developers working on open source projects. It’s also a target for malware developers. Contrary to what you may think, this is not the first time that Google Code has been used to spread or store malware. (You Read more…
Tags: Android, Android/FakeUpdates, downloader, fake updates, google code, malware, pup
Posts by Carlos Castillo