Mobile device security threats are on the rise. In 2014, Kaspersky Lab detected almost 3.5 million pieces of malware on more than 1 million user devices. And as reported by IT Web, the number of new malware programs detected each day has reached over 230,000–many of which target mobile devices. Here’s a look at some of mobile device threats and what the future holds.
Most damaging mobile security threats
The use of corporate and personal mobile devices inside the corporate network is nowadays becoming a part of routine. However, employees do not always think about the risks the company often face due to their reckless actions. They may store or transmit sensitive business data via mobile, open malicious emails when using the company’s mobile devices, or install unverified mobile applications being connected to the corporate network.
Therefore, the employees create the conditions for the spreading of the following most common and harmful mobile security threats.
There are different types of mobile security threats to be aware of. They include application-based, web-based, network-based and physical threats.
Here’s how they work:
- Application-based threats happen when people download apps that look legit but actually skim data from their device. Examples are spyware and malware that steal personal and business information without people realizing what’s going on.
- Web-based threats are subtle and tend to go unnoticed. They happen when people visit affected sites that seem fine on the front-end but in reality, automatically download malicious content onto devices.
- Network-based threats are especially bad because cybercriminals can steal unencrypted data while people use public WiFi networks.
- Physical threats happen when someone loses their mobile device or has it stolen. Because hackers have direct access to the hardware where private data is stored or where they have access to data, this threat is especially dangerous to enterprises.
The following are a combination of these types of mobile security threats.
1. Data Leakage
Mobile apps are often the cause of unintentional data leakage. As noted by eSecurity Planet, for example, “riskware” apps pose a real problem for mobile users, who give them sweeping permissions, but don’t always check security. These are typically free apps found in official app stores that perform as advertised. But also send personal and potentially corporate data to a remote server, where advertisers or even cybercriminals mined.
Data leakage can also happen through hostile enterprise-signed mobile apps. Here, mobile malware uses distribution code native to popular mobile operating systems like iOS and Android to spread valuable data across corporate networks without raising red flags. To avoiding this problem. only give apps permissions they absolutely insist on, and forgo any program that asks for more than necessary.
3. Phishing Attacks
Email remains the preferred method of communication for the majority of organizations. Due to the low visibility of personnel’s activities, there is a risk someone of your employees opens a malicious email. Thus, hackers may get access to confidential data. About 26% of enterprises lose their sensitive data in the result of phishing attacks.
4. Trojan Droppers
Trojan droppers are a strange beast, as they themselves don’t do any direct harm. Instead, they’re designed to be a payload for a nastier piece of kit. They masquerade as a beneficial app or program, then slip malware onto your phone after being installed.
Sometimes, they either download or unpack a piece malware, install it, then immediately delete themselves to avoid suspicion. They might also bury themselves deeper, continuing to infect the system after the user has deleted the main malware.
Either way, a Trojan dropper’s main goal is to be the transport for something far nastier. Malware authors like them because they add an extra layer of protection around the malware they want to spread.
How to Fight This Threat?
Trojan droppers sound complicated, but they still follow the same rules as most malware. They have to be downloaded onto your system before they can infect anything. As such, the general rules for avoiding file-based malware applies here.
Don’t download any suspicious files from shady sites or emails. Be careful with what free apps you download, even ones from the official app store. Be sure to grab a good mobile antivirus to catch out a Trojan dropper when it tries to deliver its payload.
5. Unsecured Wi-Fi
No one wants to burn through their cellular data when wireless hot spots are available. But free Wi-Fi networks are usually unsecured. According to V3, in fact, three British politicians who agreed to be part of a free wireless security experiment were easily hacked by technology experts and had their social media, PayPal and even VoIP conversations compromised. To be safe, only use free Wi-Fi sparingly on your mobile device, and never using it to access confidential or personal services, like banking or credit card information.
6. Malicious Apps
When your employees visit Google Play or the App Store to download apps that look innocent enough, the apps ask for a list of permissions before people are allowed to download them. These permissions generally require some kind of access to files or folders on the mobile device.
Most people just glance the list of permissions and agree without reviewing them in great detail. This lack of scrutiny leaves devices and enterprises vulnerable to mobile threats.
Dave Jevans, CEO and CTO of Marble Security explains, “enterprises face a far greater threat from the millions of generally available apps on their employees’ devices than from mobile malware.”
Even if the app works the way it’s supposed to, it still has the potential to mine corporate data and send it to a third party, like a competitor, and expose sensitive product or business information.
How to Fight This Threat?
Fight with mobile security threats by asking employees to check the permissions apps request before they approve the download. If the list of permissions seems too invasive, employees should skip the download.
7. Malvertising and Adware
Unlike other strains of money-making malware, adware doesn’t target the user’s bank account. Malvertising instead tries to harvest advertisement revenue through ad interaction, and is usually delivers via an infected app.
Advertisements don’t pay a lot per click, however, so adware authors have to flood their victims with adverts to turn a good profit! This makes infection very obvious, as the user will have to fight past ads to use their phone.
Unfortunately, if the adware developer has been clever, they’ll ensure ads appear outside of the infected app. This can make it hard for a user to figure out which app is delivering ads to the user.
How to Fight This Threat?
Be careful what apps you install and only download apps from official sources. If you do notice stray advertisements popping up on your phone, think back to any apps you’ve installed recently and delete them ASAP. Then, grab an antivirus to clean up anything that remains.
Some strains of adware can wait a bit before displaying advertisements. This is done to take heat off of the app that infected your phone in the first place. As such, it may not always be the most recent app you downloaded that’s infected with adware!
8. Banking SMS Malware
If a hacker has your bank account details, but you’ve set up an SMS two-factor authentication (2FA) guard on your phone, the hacker won’t be able to get in without the code. That’s why hackers are turning to malware that reads SMS messages on the victim’s phone.
When they go to log into the victim’s bank account, the malware reads the SMS code that is sent to their phone. This gives the hacker all the information they need to log into their account.
In order to do its job, this malware has to get permission to read SMS messages. As a result, they often masquerade as messenger apps like WhatsApp. When they ask for the SMS permissions, the user believes it’s simply part of the messaging services and gives it free rein.
Hackers have since upgraded their attacks to take advantage of the new accessibility services that Android provides. In order to help those who have trouble reading screens, the accessibility service can read out SMS 2FA codes to the user.
As such, malware can target this service and read what is sent. When the user receives a 2FA code, the malware reads the code and sends the information back to the malware author.
How to Fight This Threat?
Be very careful with apps that ask for messaging or accessibility services permissions. Banking malware needs this to read SMS messages, and denying them this should keep your account safe.
When you’re installing a messenger app, always make sure it’s from a legitimate source. Scammers will often upload fake apps to try to catch people out, so always make sure you’re getting the real deal!
9. Lack of End-to-end Encryption
A recent study found that only 5.5% of mobile app development budgets go towards security. This is shocking considering the amount of information uploaded to apps. Depending on the platforms employees use to access corporate data on their phones, a lack of mobile app security doesn’t bode well for you.
For example, a lot of communication happens electronically. You send, share and receive countless amounts of data every day. So leaving that unencrypted leaves the door open for anyone to look at what’s being said or done in your company.
And it’s not just hackers who’ll have access. Your service provider and any online applications that host your conversations with employees will have access to view and collect private data.
How to Fight This Threat?
In order to fight these mobile security threats, use communication apps that encrypt data transfers to make sure that communication between you and your employees can’t be accessed by anyone outside of the business. Use an encryption-based application to help manage communication.
10. Miner Trojans
2018 was a very bad year for avoiding miner Trojans—it saw a five-fold spike in the year alone! This is a symptom of malware authors moving away from malware that simply bricks devices and moving more toward money-machine schemes.
Miner Trojans perform “cryptojacking,” where a malicious agent hijacks your device’s processor in order to mine cryptocurrency at your expense.
The current rate of development in smartphones makes miner Trojans a good choice for malware developers. Phones are getting increasingly more powerful, which in turn makes a mining attack more profitable.
Given the high adoption rate of phones in modern society, miner Trojan authors also have a swathe of potential zombies for their miner horde.
Fortunately, it’s very easy to spot when a miner Trojan is working away on your phone, as the entire system will slow down. As such, miner Trojan authors are working on making their software more resistant to removal.
How to Fight This Threat
If you notice your phone comes to a crawl when you’re using it, there’s a chance a miner Trojan is sapping your processing power. Be sure to run an antivirus scan to see if you can remove it and protect your phone against mobile security threats.
Not all phone slowness is a symptom of a miner Trojan, though! It may be that you’re running too many apps, or your phone is low on memory. If the virus scan comes back clean, perhaps try cleaning up some apps to see if it helps.
Summing It Up
As we move further into the digital age, it’s important that we do as much as possible to protect devices and the information they give us access to.
Mobile devices face a lot of security threats but there’s a lot you can do to protect yourself, your data and your employees. Follow these guidelines and you’ll be well on your way to protecting yourself against mobile security threats through your mobile security journey.