Endpoint //

Privacy

Phishing Threats Move to Mobile Devices

Mobile devices are emerging as a primary gateway for phishing attacks aimed at stealing data.

A mobile user is 18 times more likely to be exposed to a phishing attempt than to malware, according to a new report on techniques and technologies that try to get a user to be an accomplice in their own victimization.

While employees have been taught to be suspicious of links and attachments in email, there is considerably less scrutiny of channels like SMS, Skype, WhatsApp, games, and social media. "As more communications take place over mobile devices, organizations haven't changed their thinking to cover the modes of communications taking place on the devices," says Michael Covington, vice president of product at Wandera, which published the report.

Mobile devices are the technology channel on which personal employee and corporate apps and data come together, and criminal hackers are taking advantage of that to reach enterprise credentials through personal communications.

"You can train an employee to not be a victim, but the mobile attacks are so compelling that education isn't enough," Covington says. "We want to see corporations move into the present, recognize the risk and mitigate the risk."

That risk is considerable. According to Wandera's mobile phishing report, the average iOS user has 14 different accounts on their work phone, typically including services such as Amazon, Paypal, and Airbnb. On Android, the number jumps to 20 unique apps. And both messaging and social media apps increased in popularity as an attack vector by more than 100% in 2017, with no sign of that growth slowing in 2018.

While email remains the most common target of phishing attackers, the effectiveness has been dramatically reduced by improving defense systems and years of employee training, the report notes. Fewer than one in five successful attacks originate with email phishing campaigns on desktop and mobile devices. That's not to say that phishing as a tactic is going away.

According to the Verizon 2018 Data Breach Investigations Report, 90% of cyberattacks begin with phishing. There's a good reason for that, Covington says, especially in the mobile domain. "To be perfectly honest, these mobile devices are pretty hardened," he says. "They do have problems, we have seen them exploited, but if you look at something like the current iOS it's pretty hardened. Phishing allows an attacker to bypass all of those protections."

There are companies that see statistics such as those around phishing through apps and decide that the solution is to lock down apps. But that's not an effective solution to the problem, according to Wandera.

"Phishing attacks have been observed in practically every single form of communication on mobile devices, including Skype, QQ, WeChat, Viber and Kik. Clearly this is a problem at scale that cannot be solved through blocking certain apps, or through app- centric controls," the report said. "Phishing attacks have been observed in practically every single form of communication on mobile devices, including Skype, QQ, WeChat, Viber and Kik. Clearly this is a problem at scale that cannot be solved through blocking certain apps, or through app-centric controls."

Mobile phishing attacks have become more sophisticated and effective as the stakes have increased. As Mike Murray, vice president of security intelligence at Lookout said in an InteropITX session, "Mobile has become not just a target, but the primary target in the enterprise."

"Mobile has a gap and often it's the user sitting on the other side of the interface," says Covington. That danger of that gap is amplified by the behavior of the companies where they work. Covington explains, "Most organizations want to stop phishing and protect data with GDPR coming online. Neither is being addressed with mobile."

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6499
PUBLISHED: 2019-01-21
Teradata Viewpoint before 14.0 and 16.20.00.02-b80 contains a hardcoded password of TDv1i2e3w4 for the viewpoint database account (in viewpoint-portal\conf\server.xml) that could potentially be exploited by malicious users to compromise the affected system.
CVE-2019-6500
PUBLISHED: 2019-01-21
In Axway File Transfer Direct 2.7.1, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request with %2e instead of '.' characters, as demonstrated by an initial /h2hdocumentation//%2e%2e/ substring.
CVE-2019-6498
PUBLISHED: 2019-01-21
GattLib 0.2 has a stack-based buffer over-read in gattlib_connect in dbus/gattlib.c because strncpy is misused.
CVE-2019-6497
PUBLISHED: 2019-01-20
Hotels_Server through 2018-11-05 has SQL Injection via the controller/fetchpwd.php username parameter.
CVE-2018-18908
PUBLISHED: 2019-01-20
The Sky Go Desktop application 1.0.19-1 through 1.0.23-1 for Windows performs several requests over cleartext HTTP. This makes the data submitted in these requests prone to Man in The Middle (MiTM) attacks, whereby an attacker would be able to obtain the data sent in these requests. Some of the requ...