1.888.900.DRIZ (3749)
The Driz Group
  • Managed Services
    • SME CyberShield
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog
  • Managed Services
    • SME CyberShield
    • Web Application Security >
      • Schedule WAF Demo
    • Virtual CISO
    • Compliance >
      • SOC1 & SOC2
      • GDPR
    • Third-Party Risk Management
    • Vulnerability Assessment >
      • Free Vulnerability Assessment
  • About us
    • Testimonials
    • Meet The Team
    • Resources
    • In the news
    • Careers
    • Subsidiaries
  • Contact
    • Newsletter
  • How WAF Works
  • Blog

Cybersecurity Blog

Thought leadership. Threat analysis. Cybersecurity news and alerts.

6/20/2017

0 Comments

Why Mobile App Vulnerabilities are Dangerous for a Business

 
mobile app vulnerabilities - iPhone apps

Why Mobile App Vulnerabilities are Dangerous for a Business

​Ninety-nine percent of the business workforce currently uses mobile devices to perform their jobs, this according to the IBM-sponsored 2016 Mobile Security & Business Transformation Study.
 
While this reliance on mobile devices brings enhanced productivity and other business benefits, it also comes with a greater number of security risks.
 
According to Statista, there were 1.86 billion smartphone users worldwide in 2015. This number is expected to grow to 2.32 billion in 2017. In the smartphone operating system (OS) market, Gartner reported that the battle is clearly between Android (an OS developed by Google) and iOS (an OS developed by Apple). For the first quarter of 2017, Gartner reported that 86.1% of the smartphones sold worldwide runs on Android, 13.7% runs on iOS, and 0.2% runs on other OS.

The Malicious Apps Issue

​One of the security risks of using a mobile device at work is the malicious app. There’s an app – short for application program – for almost everything today. As of March 2017, according to Statista, 2.8 million apps can be downloaded from Google Play and 2.2 million apps from Apple App Store.
 
While Google and Apple have strong security measures in preventing malicious apps from being part of their app stores, some of these malicious apps still slip right through the security nets of these app stores. In the first quarter of 2017, security firm G DATA discovered over 750,000 malicious apps in Android mobile devices.
 
McAfee in its 2016 Mobile Threat Report said that in 2015, thousands of apps were pulled out from both Google Play and the Apple App Store for security reasons. “Both Google and Apple have been very quick to remove malicious apps from their associated app stores, however it’s inevitable that some infected apps will still slip through the screening process,” McAfee said.

Business risks after your phone is hacked

​Once your phone is hacked, your business data is at risk of being exploited by cyber criminals. Here are 2 ways that put business data at risk after your phone is hacked:

1. Ransomware Attack

Ransomware – a type of software that’s programmed to block users until a sum of money is paid – is often associated with PCs. The reality is ransomware isn’t just a PC problem anymore.
 
In January 2017, security firm Check Point discovered the ransomware called “Charger”. This ransomware was hidden inside an app called EnergyRescue – a malicious app that was briefly available on Google Play and attacked Android devices before being pulled. The Charger ransomware demanded 0.2 Bitcoins (worth $180) from the affected mobile device users and warned that personal information would be sold on the black market if the ransom was not paid.
 
The ransomware locks the mobile device and displays the following message:
“You need to pay for us, otherwise we will sell portion of your personal information on black market every 30 minutes. WE GIVE 100% GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT. WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER! TURNING OFF YOUR PHONE IS MEANINGLESS, ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS! WE STILL CAN SELLING IT FOR SPAM, FAKE, BANK CRIME etc… We collect and download all of your personal data. All information about your social networks, Bank accounts, Credit Cards. We collect all data about your friends and family.”
 
The Charger ransomware demonstrates how a malicious app can be a dangerous threat to your business.

2. Danger of Dead Apps

​A dead app is an application that’s removed from the app store, without notice. It also refers to an application that’s abandoned by the developer, also without notice. Like other defective products, applications that are removed from the app stores and those abandoned by developers need recall notices.
 
McAfee identified over 4,000 apps that were removed in 2015 from Google Play without notification to users. McAfee’s 2016 Mobile Threat Report revealed that 500,000 mobile devices still have these dead apps installed and are active. “These users, and the organizations they work for, are still exposed to any vulnerabilities, privacy risks, or malware contained in these dead apps,” McAfee said.

Malicious Apps Prevention 

Here are some of the ways to keep your business mobile device safe from malicious apps:

1. Pay close attention to the apps that you’re downloading.
A 3.5 rating for an app on Google Play or Apple App Store isn’t enough in evaluating an app. For instance, sometime before Google Play pulled from its app store, EnergyRescue app – hidden with it was the Charger ransomware – had a 3.6 review rate from 11,584 users. Before downloading an app from known app store such as Google Play and Apple App Store, conduct thorough research about the app developer first.
 
2. Delete apps that are no longer on the app store.
Apps that are deleted on any app store are vulnerable to cyber criminals as they may have been removed from the app for security reasons or the developer abandoned the app, leaving it without patches or security updates.
 
3. Update
To keep the data in your business mobile phone secure and private, it’s a good practice to keep your mobile operating system and the apps up to date. Most of the malicious apps can be blocked by simply updating your mobile operating system. Legitimate app developers also issue patches or security updates.
 
Skycure’s Mobile Threat Intelligence Report for the 4th Quarter of 2016 showed that the majority of malicious app exploits relies on the existence of unpatched vulnerabilities in the mobile operating systems to be successful. In analyzing the adoption of Android security patches among the five leading wireless carriers in the United States, Skycure found that 71% of Android mobile devices in the 4th Quarter of 2016 were running on security patches that were at least 2 months old, leaving millions unnecessarily vulnerable to malicious app breach.
 
“About half of devices in use at the end of 2016 had not received a platform security update in the previous year,” said Google in its 2016 Year in Review report.

Pro tip: Administrators, restrict employee access to freely download apps without evaluation and IT approval to prevent device infection and a potential data breach.
0 Comments

Your comment will be posted after it is approved.


Leave a Reply.

    Author

    Steve E. Driz, I.S.P., ITCP

    Picture
    View my profile on LinkedIn

    Archives

    March 2025
    February 2025
    January 2025
    November 2024
    October 2024
    September 2024
    July 2024
    June 2024
    April 2024
    March 2024
    February 2024
    January 2024
    December 2023
    November 2023
    October 2023
    September 2023
    August 2023
    July 2023
    June 2023
    May 2023
    April 2023
    March 2023
    February 2023
    January 2023
    December 2022
    June 2022
    February 2022
    December 2021
    November 2021
    October 2021
    September 2021
    August 2021
    July 2021
    June 2021
    May 2021
    April 2021
    March 2021
    February 2021
    January 2021
    December 2020
    November 2020
    October 2020
    September 2020
    August 2020
    July 2020
    June 2020
    May 2020
    April 2020
    March 2020
    February 2020
    January 2020
    December 2019
    November 2019
    October 2019
    September 2019
    August 2019
    July 2019
    June 2019
    May 2019
    April 2019
    March 2019
    February 2019
    January 2019
    December 2018
    November 2018
    October 2018
    September 2018
    August 2018
    July 2018
    June 2018
    May 2018
    April 2018
    March 2018
    February 2018
    January 2018
    December 2017
    November 2017
    October 2017
    September 2017
    August 2017
    July 2017
    June 2017
    May 2017
    April 2017
    March 2017
    February 2017
    January 2017
    December 2016
    October 2016
    August 2016
    May 2016
    March 2016
    January 2016
    November 2015
    October 2015
    August 2015
    June 2015

    Categories

    All
    0-Day
    2FA
    Access Control
    Advanced Persistent Threat
    AI
    AI Security
    Artificial Intelligence
    ATP
    Awareness Training
    Blockchain
    Botnet
    Bots
    Brute Force Attack
    CASL
    Cloud Security
    Compliance
    COVID 19
    COVID-19
    Cryptocurrency
    Cyber Attack
    Cyberattack Surface
    Cyber Awareness
    Cybercrime
    Cyber Espionage
    Cyber Insurance
    Cyber Security
    Cybersecurity
    Cybersecurity Audit
    Cyber Security Consulting
    Cyber Security Insurance
    Cyber Security Risk
    Cyber Security Threats
    Cybersecurity Tips
    Data Breach
    Data Governance
    Data Leak
    Data Leak Prevention
    Data Privacy
    DDoS
    Email Security
    Endpoint Protection
    Fraud
    GDPR
    Hacking
    Impersonation Scams
    Incident Management
    Insider Threat
    IoT
    Machine Learning
    Malware
    MFA
    Microsoft Office
    Mobile Security
    Network Security Threats
    Phishing Attack
    Privacy
    Ransomware
    Remote Access
    SaaS Security
    Social Engineering
    Supply Chain Attack
    Supply-Chain Attack
    Third Party Risk
    Third-Party Risk
    VCISO
    Virtual CISO
    Vulnerability
    Vulnerability Assessment
    Web Applcation Security
    Web-applcation-security
    Web Application Firewall
    Web Application Protection
    Web Application Security
    Web Protection
    Windows Security
    Zero Trust

    RSS Feed

Picture

1.888.900.DRIZ (3749)

Managed Services

Picture
SME CyberShield
​Web Application Security
​Virtual CISO
Compliance
​Vulnerability Assessment
Free Vulnerability Assessment
Privacy Policy | CASL

About us

Picture
Testimonials
​Meet the Team
​Subsidiaries
​Contact us
​Blog
​
Jobs

Resources & Tools

Picture
​Incident Management Playbook
Sophos authorized partner logo
Picture
© 2025 Driz Group Inc. All rights reserved.
Photo from GotCredit