Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

What’s Up with Your Mobile Apps? Identifying and Mitigating Digital Risk

I’ll venture to guess you’re using a mobile device to read this. In the most recent Ericsson Mobility Report (PDF), the total number of mobile subscriptions at the end of 2016 was appr

I’ll venture to guess you’re using a mobile device to read this. In the most recent Ericsson Mobility Report (PDF), the total number of mobile subscriptions at the end of 2016 was approximately 7.5 billion and growing around 4 percent year-on-year. Greater speed, power and storage capabilities of mobile devices means they are used more frequently for activities previously reserved for laptops or PCs.

In this increasingly mobile-first world, organizations are turning to mobile applications that enable them to better interact with their customers and provide new tools for employees. While mobile applications offer a host of new opportunities, they can also introduce risk.

At the end of last year, the US Federal Trade Commission warned of fake apps impersonating well-known retailers and stealing consumers’ personal information. More recently, the UK’s National Cyber Security Centre (NCSC) and the National Crime Agency (NCA) released a joint paper on the cyber threats to UK businesses. The report included an examination of the emerging threat from malicious mobile applications. While at the time no cases of mobile malware being used in an attack to pivot into a corporate enterprise network had been reported, the threat is growing and overall attacks involving mobile malware have increased in volume and sophistication.

Risks of Mobile AppsMobile devices and applications are highly lucrative and viable targets to threat actors. Although the majority of individuals download apps from Apple App Store and Google Play, which mitigates risk, this is not the case for all users.

There are many unofficial stores that allow your customers or employees to install mobile applications that are often not actively managed by their developers or rigorously reviewed prior to listing. In addition these stores often require than a user’s device is “jailbroken” or “rooted,” placing it at even greater risk of exploitation by malicious actors.

There have also been instances where apps infected with malware have managed to infiltrate official stores – so even those stores aren’t risk-free. For example, in January 2017 ransomware was identified bundled together with an information stealer masquerading as a battery saving app available for download from the Google Play store. The app has since been removed from the store.

So what can you do to better protect yourself from such threats? First, all mobile users should benefit from knowing what threats are lurking. There are five aspects to mobile device risk that organizations and users need to be on the lookout for:

1. Your apps – Suspect behavior and code within your own apps, such as self-signed certificates or the presence of malware.

2. Modified apps – Versions of your own mobile applications that have been modified by a third party.

Advertisement. Scroll to continue reading.

3. Copied apps – Copies of your own mobile applications on stores that you are not actively managing them on.

4. Impersonating apps – Mobile apps that spoof or mimic your branding or identity.

5. Affiliate links – Links to your own mobile applications that may mislead or confuse users.

Even if your organization doesn’t use mobile apps or SMS communication, you still may be at risk of threat actors targeting your customers through malicious and illegitimate applications, or through SMS phishing (aka SMishing) attacks. SMishing attacks use
the same techniques as traditional phishing attacks to persuade the user into disclosing personal information, downloading a file or app, or visiting a malicious site.

With knowledge of these risks, now you can begin to mitigate them. A good starting point is to institute user education around mobile application risks. This includes the risk of purchasing from third-party stores, downloading cracked versions of applications, and granting requests for intrusive permissions and privileges. Organizations should also ensure that mobile device operating systems are up to date, helping to prevent against the exploitation of vulnerabilities by threat actors. Finally, companies should monitor not just third-party apps but internal company mobile apps, and take appropriate remediation measures including: blocking the use of older versions, resetting passwords, blocking jailbroken devices from your services and white listing apps that are sanctioned.

We can expect bad actors will increasingly take advantage of the rise in mobile device and application use to steal customer data and intellectual property, divert revenue, and damage your brand and reputation. But by understanding what’s up with your apps, you can mitigate the digital risk to your organization, employees and customers.

Written By

Alastair Paterson is the CEO and co-founder of Harmonic Security, enabling companies to adopt Generative AI without risk to their sensitive data. Prior to this he co-founded and was CEO of the cyber security company Digital Shadows from its inception in 2011 until its acquisition by ReliaQuest/KKR for $160m in July 2022. Alastair led the company to become an international, industry-recognised leader in threat intelligence and digital risk protection.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Mobile & Wireless

Samsung smartphone users warned about CVE-2023-21492, an ASLR bypass vulnerability exploited in the wild, likely by a spyware vendor.

Malware & Threats

Apple’s cat-and-mouse struggles with zero-day exploits on its flagship iOS platform is showing no signs of slowing down.

Fraud & Identity Theft

A team of researchers has demonstrated a new attack method that affects iPhone owners who use Apple Pay and Visa payment cards. The vulnerabilities...

Mobile & Wireless

Critical security flaws expose Samsung’s Exynos modems to “Internet-to-baseband remote code execution” attacks with no user interaction. Project Zero says an attacker only needs...

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

Asus patched nine WiFi router security defects, including a highly critical 2018 vulnerability that exposes users to code execution attacks.