·      Threats and Vulnerabilities:

-        Data Leakage

§  Mobile apps are often the cause of unintentional data leakage

§  “riskware” apps pose a real problem for mobile users, who give them sweeping permissions, but do not always check for the security

§  The apps are normally free and found in official stores that perform as advertised, but also send personal and potentially corporate data to a remote server, where it is obtained by advertisers or even cyber criminals

§  It also can occur through hostile enterprise-signed mobile apps.

§  The mobile malware uses distribution code native to popular mobile operating system like IOS and Android to spread valuable data across corporate networks without raising any alarms.

-        Unsecured Wi-Fi

§  As no one wants to burn through their cellular data when wireless hot spots are available.

§  However, those free Wi-Fi mostly is unsecured.

§  People who connect to free Wi-Fi outside is more prone to be hacked by attackers and have their personal information compromised.

-        Network Spoofing

§  It is when attackers set up fake access points in high-traffic public location such as coffee shops, libraries and airports.

§  These attackers will normally give the access point common names such as “Free Wi-Fi” or commonly used Wi-Fi name to bait victims into connecting the access point.

§  Some of the access will require the users to create an “account” and complete with a password or input their personal information before they can have access to the Wi-Fi.

§  As most of the user will use the same email, password and username for multiple services, it allows the attackers to compromise their email, e-commerce or other secure information.

-        Phishing Attacks

§  As most of the user is either working through their phone most of the time, most of the work is communicated through emails.

§  Hence, mobile user often receives legitimate-seeming emails and take the bait.

§  The victim will open the link or install an application embedded in the email and together it will install a malware secretly which will compromise the mobile device.

-        Spyware

§  Normally installed by spouses, co-worker or employers to keep track of their whereabouts and use pattern.

§  However, if used wrongly, it can cause a lot of data to be leaked.

§  It can affect the user by spying on their keystrokes on their phone so that they can obtain their password or recording their voices or calls the victim is making.

-        Broken Cryptography

§  It occurs when an app developer uses weak encryption algorithms, or strong encryption without proper implementation

§   When an app developer uses weak encryption algorithm that have known vulnerabilities to speed up the process of app development, hence the result is that the attacker can crack the password and gain access.

§  When an app developer uses strong encryption without proper implementation, it will means that he/she might leave the other “back door” open that limit the effectiveness.

-        Improper Session Handling

§  To facilitate ease-of-access for mobile device transactions, many apps make use of “tokens” which allow users to perform multiple actions without being forced to re-authenticate their identity

§  Hence, attackers can take advantage of it to spoof their identity and perform multiple transactions for themselves







How to respect and protect ours and others mobile devices in an organization:

-        Keep Mobile Devices Operating System Up-to-date

§  Any new version of OS that is introduce on the mobile device is advisable to install.

§  All the OS software updates always includes the latest fixes that deal with new security risks to prevent any attackers from bypassing the devices easily.

-        Be Careful of What We Install

§  Only install an application from a trusted source

§  Check the website before installing any free application we find online.

-        Turn off Inactive Wi-Fi and Bluetooth

§  It is harder for attackers to connect to a device when the pathway to transfer information are closed.

§  This will prevent attackers to intercept the pathway in between the data transfer and steal valuable information or change the data transferred.

-        Be Aware of Text Messages We Receive

§  Delete text messages from unknown sender that ask for our personal information and avoid clicking links embedded within messages

§  Even if friends or someone in related to us send us an anonymous link, we should not even click on it, unless the link is verified.

-        Lock Our Phone with a True Password

§  Rather than using just numerical password such as 123456, we should use an alphanumeric password or password with special characters which will be harder to brute force as the password is unique and harder to figure out.

-        Set Remote Access – Enable Phone Tracking Option

§  To set remote access to help locate missing mobile device if it is stolen or misplaced.

§  It also has a function to erase its memory so if it is stolen, they can’t access the information anymore.

-        Set an Encrypted Auto Daily Backup

§  By setting auto daily backup that is encrypted, it means that even if the phone gets stolen, I will still have all my data.

§  This means that I can erase all the data in the stolen phone remotely and after that have an auto backup to retrieve all my data to my new device.

-        Don’t Leave Online Sign-ups Open

§  Normally there will be auto logins for most of the application, but this will mean that it has a higher security breach risk.

§  Instead of clicking save password, we should type the password every time to help secure the device

-        Be Careful with Public Wi-Fi

§  Only use secure Wi-Fi only as Open Wi-Fi is one of the attackers’ favourite targets to obtain valuable information from the user connecting to the open Wi-Fi.