Protect smartphones from malware and misuse

Attacks on mobile devices increase during the holiday season

During the summer season and holiday season, the threats to mobile devices and their users increase significantly. New devices offer more and more features for convenience and support, but often at the expense of security. This also makes it increasingly difficult to detect threats: Attackers are increasingly adapting their methods in scope and complexity to the multitude of these features.

Modern mobile phones are networked computers with permanent internet connection, data storage, navigation devices and location trackers as well as sound and video recorders in one device. The proper apps turn smartphones into mobile banks, communication platforms for social networks, cameras with photo galleries and many other tools.

Security risks for smartphones & tablets: Malware in software shops

Once again, a new set of malicious Android apps containing adware and malware has been found in the Google Play Store. Nearly 10 million downloads of the apps show a wide spread. The malicious programmes pose as image editing tools, virtual keyboards, system optimisers, wallpaper changers and more. However, their real function is to serve intrusive ads, subscribe to premium services and steal victims’ login details. [1]

Protect smartphones from malware and misuse: Use app stores safely

Malware will always find a way to sneak into the app markets. You should therefore not blindly trust any app. It often helps to check user reviews and ratings, visit the developer’s website, read the privacy policy and pay attention to the requested permissions during installation.

Furthermore, it should always be questioned whether the promised functions are necessary. Limiting the number of installed apps to a minimum is also a reliable way to minimise risks. In addition, install a (legitimate) malware scanner on the device to scan apps and other downloads from the internet. On Android smartphones, activate Google’s Play-Protect protection. Monitoring the data and battery consumption of installed apps can help identify suspicious processes that run in the background and perform unnecessary activities.

NSA recommendations for smartphone security

The National Security Agency (NSA) provides further best practices that go beyond the general recommendations. [2]

• Install updates regularly and as soon as they are released
• Use multi-factor authentication for Google/Apple account
• Enable biometric authentication and self-lock feature
• Avoid unknown WiFi hotspots
• Disable Bluethooth when not in use, especially in unfamiliar environments
• Disable location tracking, especially before travelling

Especially for mobile devices in corporate environments, but also for more demanding private users, complementary measures can further increase security:

• Restarting the smartphone once a week (preventing zero-click malware).
• Cover the camera and microphone in sensitive areas and meetings
• Only use original accessories and do not connect unknown hardware, data carriers or other charging devices to the phone
• Do not modify the firmware (jailbreak)
• Use device encryption
• Activate remote wipe to actively protect sensitive data in case of loss
• Central management and monitoring of smartphones in companies (MDM)

Conclusion

Cyber attacks on smartphones are not exceptional. Mobile devices are just as vulnerable, if not more so, than PCs and other types of computers. Typical threats include malware, social engineering, web attacks, network attacks and physical theft.

Awareness and sensitisation to these threats is the first step to better manage the risks. Technical protection measures such as secure authentication measures, malware scanners and MDM systems for devices with access to company data strengthen mobile security.

Reading recommendations:

Tips to better secure Smart Home devices
Seamless data protection even with mobile working
Enterprise Mobility Management has become an indispensable part of everyday IT life

Sources: