Why Mobile App Vulnerabilities are Dangerous for a Business

Why Mobile App Vulnerabilities are Dangerous for a Business

​Ninety-nine percent of the business workforce currently uses mobile devices to perform their jobs, this according to the IBM-sponsored 2016 Mobile Security & Business Transformation Study.
 
While this reliance on mobile devices brings enhanced productivity and other business benefits, it also comes with a greater number of security risks.
 
According to Statista, there were 1.86 billion smartphone users worldwide in 2015. This number is expected to grow to 2.32 billion in 2017. In the smartphone operating system (OS) market, Gartner reported that the battle is clearly between Android (an OS developed by Google) and iOS (an OS developed by Apple). For the first quarter of 2017, Gartner reported that 86.1% of the smartphones sold worldwide runs on Android, 13.7% runs on iOS, and 0.2% runs on other OS.

The Malicious Apps Issue

​One of the security risks of using a mobile device at work is the malicious app. There’s an app – short for application program – for almost everything today. As of March 2017, according to Statista, 2.8 million apps can be downloaded from Google Play and 2.2 million apps from Apple App Store.
 
While Google and Apple have strong security measures in preventing malicious apps from being part of their app stores, some of these malicious apps still slip right through the security nets of these app stores. In the first quarter of 2017, security firm G DATA discovered over 750,000 malicious apps in Android mobile devices.
 
McAfee in its 2016 Mobile Threat Report said that in 2015, thousands of apps were pulled out from both Google Play and the Apple App Store for security reasons. “Both Google and Apple have been very quick to remove malicious apps from their associated app stores, however it’s inevitable that some infected apps will still slip through the screening process,” McAfee said.

Business risks after your phone is hacked

​Once your phone is hacked, your business data is at risk of being exploited by cyber criminals. Here are 2 ways that put business data at risk after your phone is hacked:

1. Ransomware Attack

Ransomware – a type of software that’s programmed to block users until a sum of money is paid – is often associated with PCs. The reality is ransomware isn’t just a PC problem anymore.
 
In January 2017, security firm Check Point discovered the ransomware called “Charger”. This ransomware was hidden inside an app called EnergyRescue – a malicious app that was briefly available on Google Play and attacked Android devices before being pulled. The Charger ransomware demanded 0.2 Bitcoins (worth $180) from the affected mobile device users and warned that personal information would be sold on the black market if the ransom was not paid.
 
The ransomware locks the mobile device and displays the following message:
“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes. WE GIVE 100% GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT. WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER! TURNING OFF YOUR PHONE IS MEANINGLESS, ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS! WE STILL CAN SELLING IT FOR SPAM, FAKE, BANK CRIME etc… We collect and download all of your personal data. All information about your social networks, Bank accounts, Credit Cards. We collect all data about your friends and family.”
 
The Charger ransomware demonstrates how a malicious app can be a dangerous threat to your business.

2. Danger of Dead Apps

​A dead app is an application that’s removed from the app store, without notice. It also refers to an application that’s abandoned by the developer, also without notice. Like other defective products, applications that are removed from the app stores and those abandoned by developers need recall notices.
 
McAfee identified over 4,000 apps that were removed in 2015 from Google Play without notification to users. McAfee’s 2016 Mobile Threat Report revealed that 500,000 mobile devices still have these dead apps installed and are active. “These users, and the organizations they work for, are still exposed to any vulnerabilities, privacy risks, or malware contained in these dead apps,” McAfee said.

Malicious Apps Prevention 

Here are some of the ways to keep your business mobile device safe from malicious apps:

1. Pay close attention to the apps that you’re downloading.
A 3.5 rating for an app on Google Play or Apple App Store isn’t enough in evaluating an app. For instance, sometime before Google Play pulled from its app store, EnergyRescue app – hidden with it was the Charger ransomware – had a 3.6 review rate from 11,584 users. Before downloading an app from known app store such as Google Play and Apple App Store, conduct thorough research about the app developer first.
 
2. Delete apps that are no longer on the app store.
Apps that are deleted on any app store are vulnerable to cyber criminals as they may have been removed from the app for security reasons or the developer abandoned the app, leaving it without patches or security updates.
 
3. Update
To keep the data in your business mobile phone secure and private, it’s a good practice to keep your mobile operating system and the apps up to date. Most of the malicious apps can be blocked by simply updating your mobile operating system. Legitimate app developers also issue patches or security updates.
 
Skycure’s Mobile Threat Intelligence Report for the 4th Quarter of 2016 showed that the majority of malicious app exploits relies on the existence of unpatched vulnerabilities in the mobile operating systems to be successful. In analyzing the adoption of Android security patches among the five leading wireless carriers in the United States, Skycure found that 71% of Android mobile devices in the 4th Quarter of 2016 were running on security patches that were at least 2 months old, leaving millions unnecessarily vulnerable to malicious app breach.
 
“About half of devices in use at the end of 2016 had not received a platform security update in the previous year,” said Google in its 2016 Year in Review report.

Pro tip: Administrators, restrict employee access to freely download apps without evaluation and IT approval to prevent device infection and a potential data breach.