Rise of Mobile Security Threats
Cyber criminals are stepping ahead with variations in their weapons to launch attacks on mobile devices. Even a decade ago, mobile malware was a very unlikely threat. Today, all mobile devices, irrespective of manufacturers, are under the threat radar and no one is immune. Dimensional research shows the rise of mobile security threats, around 20% mobile devices have been breached. Almost 94% users expect that the frequency of mobile attacks are going to increase.
Apple and Android have already started to work on creating more robust and secured operating systems. On the other hand, malicious actors continue to come up with newer malware variants. Till now, app security is not a top priority in app design and the proliferation of BYOD policy is alluring the criminals to chalk out newer plans for mobile attacks in the organization. According to Forrester’s annual security survey, almost 68% employees are using their own smart phones at work and 69% use their own tablets. Thus, mobile attacks become too obvious and easy for hackers to get access of enterprise data.
Researchers have identified some new security threats to mobile devices that can impact the business. eScan highlights them below:
Infecting mobile device with spyware
Today mobile devices are used by employees in almost every aspect of their lives. Due to the close proximity of corporate network, the criminals are continuously looking for innovative ways to infect mobile devices with spy-ware. This has been successful on both iOS and Android devices.
Last year, the arise of Pegasus spy-ware hacked iPads and iPhones to steal data about and conduct surveillance on the victim. Researchers also discovered few iOS vulnerabilities that were exploited to attack Apple’s strong security environment. However, Apple quickly fixed all three Trident iOS vulnerabilities.
In April 2017, malware authors came again with the Android version of Pegasus spy-ware which apparently seemed to be a normal app. It secretly gained root access to any Android device to scrutinize the user broadly. Since then, Google has re-enforced security measures, including Play Protect security within the Play Store.
Converting mobile device into botnets
New malware can convert mobile devices into a botnet which is managed by the criminals keeping it secret from the owners. Just a year ago, the first mobile botnet namely Viking Horde targeting Android devices was revealed. It used to create a botnet on any rooted / non-rooted device which uses proxy IP addresses to disguise ad clicks and generate revenue for the hacker. After that, the researchers have identified few more mobile botnets, which infected millions of Android users.
Accessing mobile device with click fraud
This is a growing concern of mobile threat. Compromising any mobile device through ad and click malware is a smart way for a criminal to get access of the company network, mostly by sending a malicious SMS, with a link pursuing the user to download a malicious app. After that, the hackers get hold of the phone and can steal credentials to get official network. What is more alarming is that, it acts as an adware, but then spread to the entire botnet easily.
Update relevant apps and remove redundant apps
Employees need to check the status of their mobile apps regularly by updating them if required or deleting them if not. Security teams for both Android and iOS have been quietly removing huge number apps from their stores incessantly, though there is no official record of the same. The reasons behind them are mainly malware issues, copyright infringement or discovery of data leaking signs. The lack of transparency could impact the enterprise because there is more sensitive data at stake by infiltrating enterprise networks.
User behavior awareness and training should be continued to evolve with the newer threats, mobile researchers say. In order to reduce risk, through encryption and visibility into all devices, access to the enterprise network has been reduced significantly.
Read more about mobile security – click here
