Mobile Cybercrime Puts Your Business at Risk

The opening ceremonies of the Olympic games are always a spectacle, and the people of Pyeongchang County in the Republic of Korea didn’t disappoint. While the world watched, behind the scenes there was a cyberattack going on. The attack, carried out by Russian hackers, seemingly retaliating for a nationwide ban placed on their athletes at the games, paralyzed LAN and Wi-Fi communications, prevented tickets from being printed from the Olympics website, and took until 8 a.m. the following day to restore.

We reference the Olympics because for the past three Olympic games, the Pyeongchang games, The 2016 Summer Olympics in Rio De Janeiro, Brazil, and the 2014 Winter Olympics in Sochi, Russia have all been marred somewhat by cybersecurity issues. If an event that is planned for years in advance--and has the cybersecurity budget the Olympics has--what does that mean for you and your smartphone? This month, we will take a long look at mobile cybercrime, its increased relevance, and what you need to know to combat hackers that target mobile.

Mobile Is Just the Next Step
When you consider just how much people depend on Internet-connected computing, and how many applications are developed that require Internet access, it can’t really be a surprise that Internet-related crime increases at similar rates. The problem is that the rate is substantially higher that many people were ready for; and it is causing a lot of problems for computer users all over the world.

When we talk about mobile cybercrime, however, we are mostly talking about the act of using mobile devices as a revolving door in which hackers access secure networks, steal data, and personally identifiable information by the terabyte. In a study conducted by Nokia in 2016, over 1.3 of every 100 phones has some form of malware on it, a whopping increase of 400 percent over 2015. The percentage is growing, and fast. Now four-in-every-five malware infections happens on a smartphone.

Mobile constructs are being infected, and hacked, and data is being stolen, repurposed, and sold. There are several ways that people are able to accomplish this. They include:

Data Leakage
Mobile apps have transformed the way that computing constructs work. They are so effective that the largest software company in the world, Microsoft, altered the way they go about application development when developing Windows 8. Using the format used by mobile platforms developed by Apple and Google, the “app” allows developers to utilize the touchscreen to create a more “hands on” approach than the traditional mouse and keyboard approach used by desktop applications.

All apps aren’t created equal, however, and some are developed with vulnerabilities, or worse yet, developed to appear to be a useful app and are just malware or spyware. Today, the term for these types of apps is “riskware”. When you download an app (or install it as an .apk), almost immediately there is a screen that pops up where you get to choose which permissions the app can have on your phone. The best way to avoid this kind of data seepage is to:

1. Ensure the app you are installing on your device is the real McCoy.
2. Only allow the app to have the permissions it needs to be effective.

By keeping apps from having full run of your device, all you are doing is mitigating potential problems.

Network Spoofing and Unsecured Connections
With so much content available to the mobile user, and carrier-enforced data caps still prevalent, many people will want to access any Wi-Fi they can to save their data. While this is great if you are at home or places you trust, connecting to just any wireless network could get you in a lot of trouble. When you consider that some networks are effectively traps, where the minute you connect your mobile device to it, the people that are presenting the subterfuge of a secured network just scour and strip the personal data off of your phone; and, if you use your phone for work, you likely have, at the very least, put your employer’s network, and all the data on it in peril.

Mobile Phishing & Spyware
Mobile devices are most useful when they are powered-on; and, most mobile users have a tendency to check their email routinely, some compulsively. That means they are typically more susceptible to seemingly legitimate emails that end up being completely illegitimate, putting them, and the data they have access to, in harm's way. Ensuring that any links, attachments, or other media is from legitimate senders is crucial to keep malware off of your phone, and the networks it connects to.

Additionally, spyware is a major concern for mobile security professionals. Some spyware is legitimate, used mostly to monitor the mobile use of another user. Some organizations take liberties they shouldn’t and install spyware through a mobile management policy that not only is a major breach of privacy, but could have disastrous ramifications if that data were to fall into the wrong hands.

Poorly Developed Software
Some apps aren’t exactly reliable. This happens when developers use weak encryption algorithms, strong encryption that isn’t properly implemented, or improperly implement authentication tokens on their software. As a result, some apps are just vulnerabilities masquerading as useful applications. By using software that is well regarded and from reputable developers, your chances of falling victim to issues decreases exponentially.

The Cost of Mobile Cybercrime
We’ve looked at the problems all mobile users have to be cognizant of, but if you don’t deal with it directly, it may be hard to know just what the cost of it is. There are a few indicators that can tell you just how big of an issue this has become. There have been a litany of highly sophisticated and extraordinarily complex strains of malware (mostly ransomware) and numerous extremely high-profile data breaches over the past few years. Traditionally, cybercrime was an IT issue, but with the level of devastation that cybercriminals can bring to your organization, it is now very much a C-level problem.

According to a study funded by Accenture and carried out by the Ponemon Institute titled, 2017 Cost of Cyber Crime Study: Insights on the security investments that make a difference, the financial consequences of being the victim of a cyber attack isn’t just more likely, it’s worsening. The global average of cybercrime for the 254 businesses that took part in the study sat at a staggering $7.2 million in 2013; but, in 2017 it had grown to a whopping $11.7 million, a shift of 62 percent over five years.

What’s interesting about the study is that it found that smaller organizations actually saw larger percentages of loss, per seat, on major cybercrime issues like malware, web-attack, phishing and other social engineering, and botnets. Larger companies had more problems with Denial of services attacks, sabotage, and theft. Currently information theft remains the most expensive consequence of a cyber crime, with downtime and revenue loss also being major results.

Ransomware, which made up for nearly 10 percent of all cybercrime-related monetary loss for the reported companies, was equally devastating to each type of organization. With ransomware attacks doubling in 2017, many experts are trying to extrapolate the role it will have going forward, and it isn’t pretty. Most of the cybercrime that happens over mobile is as a result of phishing/social engineering, so it’s impossible to take anything away from the Accenture report that doesn’t suggest that whatever cybercrime your organization has to deal with, and it likely will have to deal with some, it can get extraordinarily costly fast.

What Can You Do?
Since this is a major problem for organizations, governments, and companies of all types, there are strategies emerging that can help your organization curb your exposure to these types of attacks. They include:

1. Set Mobile Policy - You have policies in place for all types of things in the workplace, but you may not have had to consider putting regulations on smartphone use inside your office. With many organizations not investing money in providing mobile devices to their employees, there has been an uptick in development and use of the so-called Bring Your Own Device (BYOD) policy. In essence, it is a policy put in place that allows people to use their personal device on the work network, and use the work apps, but gives administrators the authority, through a mobile device management system, to control aspects of the phone in the case that company information could be made available. By setting a dedicated and well-considered mobile strategy, it can go a long way toward protecting your network from threats that would be carried in by careless mobile users.
2. Training - When you don’t know about the risks you are taking, you can’t expect to know how to react if those risks were acted upon. You especially won’t be proactive about handling a potentially detrimental situation. That’s why it is important to train everyone in your organization on the best practices of using mobile for work purposes. Talk about social engineering, phishing, and other sneaky ways that hackers can gain access to your company’s network, and how to go about repelling their forays with knowledge and patience.
3. Implement Mobile Security and Secure Networking Software - Most mobile platforms have some sort of defense in place, but if you want to be sure that you and your people are working to protect your organization’s network, installing mobile security applications on each device has been proven to catch and repel malware. The use of a Virtual Private Network application adds another layer of encryption to mobile communications, ensuring that data that is sent and received from your organization’s network gets to where it needs to get safely.

Business is going mobile, and so are hackers. In order to secure your organization against all manners of threats it’s essential that you have a comprehensive network security plan designed, implemented, and maintained. AT Computerware, we help our clients navigate their mobile connections securely through experience, knowledge, and action. For more information about mobile cybercrime or to talk to us about your organization’s network security, call us today at (703) 821-8200.