Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


12:58 AM

4 Mobile Device Dangers That Are More Of A Threat Than Malware

Worried about malware? Other threats should come to mind first for North American users, from losing the phone to inadvertently connecting to an insecure or rogue access point

From Trojan horses to viruses, botnets to ransomware, malicious software garners a great deal of attention from security vendors and the media.

Yet mobile users -- especially those in North America -- should worry more about other threats. While smartphones and tablets could be platforms for a whole new generation of malicious functionality, the ecosystems surrounding the most popular devices work well to limit their exposure to malware. The number of malware variants targeting the Android platform is certainly expanding -- surpassing 275,000 as of the first quarter of 2013, according to security firm Juniper Networks -- but few of the malicious programs have snuck into the mainstream application marketplaces.

Instead, the top threats to organizations grab fewer headlines. While security experts continue to put malware as a significant threat, lost and stolen devices, insecure communications, and insecure application development affect many more users. Juniper, for example, puts insecure communications at the top of its list, says Troy Vennon, director of the mobile threat center at Juniper Networks.

"We see a lot of organizations that have gone to the BYOD model, and they are encouraging their users to connect back into the enterprise for access to data and resources," he says. "They are trying to figure out how they are going to secure that communication and secure that transfer of data."

Enterprises also have to be aware of what their users are installing on their phones and how they may be using the devices for handling sensitive corporate data, says Con Mallon, a senior director of Symantec's mobility business.

"You can only secure what you know about, so knowing what you have walking around your enterprise is important," he says, adding that the defenses should extend to applications and how those applications deal with data. "I should not be able to take the company data and put it in my own personal Dropbox folder."

Based on data and interviews with experts, here are the top four threats:

1. Lost and stolen phones
In March 2012, mobile-device management firm Lookout analyzed its data for U.S. consumers who activated the company's phone-finding service, estimating that the nation's mobile users lose a phone once every 3.5 seconds. In another study released around the same time, Symantec researchers left 50 phones behind in different cities and found that 83 percent of the devices (PDF) had corporate applications accessed by the person finding the phone.

"Mobile phones and tablets are being lost or stolen on an increasing basis," says Giri Sreenivas, vice president and general manager for mobile at vulnerability management firm Rapid7. "The challenge is that there is relatively easy techniques for evading some of the on-device security controls, such as bypassing a lock screen password."

[Embedded device dangers don't just plague consumers or industrial control systems. See Tackling Enterprise Threats From The Internet Of Things.]

While Apple's TouchID, announced this week, may help consumers and employees better secure their devices against theft, the majority of users still do not even use a passcode to lock their devices against misuse. Companies should train users to lock their smartphones and tablets and use a mobile-device management system to erase the device if necessary, Juniper's Vennon says.

In the company's latest mobile-security report, Juniper found that 13 percent of users used its MDM solution to locate a phone and 9 percent locked a device. Only 1.5 percent of users -- or about one in every eight that lost a device -- wiped the smartphone, indicating that the device was likely not found, Vennon says.

"Every company should be able to locate, lock, and wipe," he says. "It's hugely necessary."

2. Insecure communications
While there is a lot less data on how often mobile users connect to open networks, companies consider insecure connections to wireless network a top threat, Rapid7's Sreenivas says. The problem is that wireless devices are often set to connect to an open network that matches one to which it had previous connected.

"A lot of people will look for a WiFi hotspot, and they won't look to see if it is secure or insecure," he says. "And once they are on an open network, it is quite easy to execute a man-in-the-middle attack."

The solution is to force the user to route traffic through a mobile virtual private network before connecting to any network, he says.

3. Leaving the walled garden
Users who jailbreak their smartphones or use a third-party app store that does not have a strong policy of checking applications for malicious behavior put themselves at greater risk of compromise. For example, while only about 3 percent of users in North America have some sort of suspicious or malicious software on their smartphones, the incident of such badware is much higher in China, with more than 170 app stores, and Russia, with more than 130 stores, according to Juniper's Third Annual Mobile Threats Report.

A well-secured app store, which vets each submitted application, is part of the overall ecosystem that secures a mobile device. Users who buy from a marketplace with little security put their phones at risk, Juniper's Vennon says.

"There is no question that if you, as a user, are making the decision to download an app from an unknown source in a third-party app store, you are opening yourself up for the potential of malware," he says.

4. Vulnerable development frameworks
Even legitimate applications can be a threat to the user if the developer does not take security into account when developing the application. Vulnerabilities in popular applications and flaws in frequently used programming frameworks can leave a device open to attack, Rapid7's Sreenivas says.

The Webkit HTML rendering library, for example, is a key component of the browser in most smartphones. However, security researchers often find vulnerabilities in the software, he says. Companies should make sure that employees devices are updated -- currently the best defense against vulnerabilities.

"Understand the corresponding vulnerability risk and make sure that the devices are patched," Sreenivas says. "It is very interesting that proximity attacks, and techniques for jailbreaks, and other attacks can all be mitigated by bringing the mobile platform for your device up to date."

Malicious And Suspicious Software
Malware, adware, and other questionable software are a threat, but mainly in China, Russia, and other countries. Yet, while North American users have less to worry about malware, suspicious software -- including privacy-invasive apps -- is quite rampant. Juniper, for example, has blocked infections of malicious and unwanted software on 3.1 percent of its customers' devices.

Moreover, security researchers continue to analyze mobile devices for vulnerabilities, and cybercriminals are getting better at monetizing mobile-device compromises -- two prerequisites for the malware to take off on mobile devices, Symantec's Mallon says.

"We can see malware and monetization happening; toolkits are out there -- all of these things parallel the development of malware in the Windows world," he said.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio


Recommended Reading:

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-10
Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
PUBLISHED: 2020-07-09
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when u...
PUBLISHED: 2020-07-09
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most T...
PUBLISHED: 2020-07-09
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A ...
PUBLISHED: 2020-07-09
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is execu...