Mobile devices and privacy breaches – data leakage through BYOD

December 5, 2013 |

The increasing use of bring your own devices (BYOD) is a causing a very significant problem in maintaining data security and avoiding breaches of the Privacy Act.  Often the BYODs are unencrypted; a USB stick, a flash card or just the memory on a phone or MP3 device.  Easy to use and easier to lose track of the data.  Or worse, to lose the data.

The Economist in Thief in your pocket? considers the dangers of using mobile devices and their weaknesses.

The article provides:

Mobile security: When it comes to mobile devices, viruses are not the problem they are made out to be—at least, not yet. Instead, the biggest risk for organisations comes from absent-minded or nefarious employees

GIVEN all the talk about mobile malware—Trojans, viruses, keyloggers, phishing expeditions and other scams infecting the phones in people’s pockets—you might be forgiven for thinking cybercrooks are cleaning up at their expense. The truth is that surprisingly little malware has found its way into handsets. Smartphones have turned out to be much tougher to infect than laptops and desktop PCs. But that may change.

The makers of security software, of course, do not mind at all if mobile-phone users are led to believe their devices are vulnerable to attack. Certainly, the BYOD (bring your own device) trend that is being adopted by many companies has created headaches for network managers trying to keep up with different hardware and software. It is one thing for an individual to find a malicious app they have downloaded has racked up a large phone bill by spewing out text messages to pricey pay-to-use services, but quite another for a manager to learn that company secrets—contact lists, passwords, authentication keys, business plans and the like—have been leaking via employees’ phones to competitors or criminals.

Even so, Adrian Ludwig, a senior security engineer at Google, reckons only one in 100,000 apps downloaded by Android users from all sources, legitimate or otherwise, poses any threat. Researchers at the Georgia Institute of Technology working with Damballa, a security firm based in Atlanta, agree. After surveying two networks with some 380m users between them, the researchers found evidence of malware infection on fewer than 3,500 phones—ie, one in 108,000. Given that there are around 1.5 billion smartphones and tablets in the world, that means probably fewer than 15,000 of them are harbouring mischievous software.

Why so few? Firstly, mobile-phone users are rarely “administrators” by default—unlike, say, users of Windows XP computers, where everyone has administrative privileges unless they have taken the trouble to set up individual user accounts with separate passwords. The danger, of course, is that administrators (or super-users in Linux-speak) can tinker with the settings of a device’s operating system. That leaves a door ajar for hackers to sneak in, sniff around and steal secrets.

It is possible to grant administrator rights to phone users by overriding the manufacturer’s security safeguards, a practice known as “jailbreaking” or “rooting” that is done to allow new functions to be added to a mobile device. Doing so, however, not only voids the maker’s warranty, but can easily “brick” the device, turning it into an expensive paperweight, and also risks opening up vulnerabilities that can be exploited by malware. Fortunately, because people who jailbreak or root their phones constitute such a small minority, cyber-criminals tend not to waste too much time attacking them. Mainstream computer users still provide easier and more lucrative targets.

Another reason why mobile phones have so far remained largely free of malware is that they lead relatively sheltered lives. Most users download any apps they want (the average is around 40) from one of two official sites: Google’s Play Store for Android devices and Apple’s App Store for iPhones and iPads. Both are reasonably well policed. Despite its laissez-faire reputation, Google’s marketplace for apps is curated far better than most third-party sites, though not as rigorously as Apple’s.

With 1m apps available for both the Android operating system and Apple’s iOS, users have little reason to venture outside these walled gardens. Those who do should be aware that many third-party app stores, especially for Android devices, can be dens of iniquity, offering free downloads of pornography or pirated tunes, videos and games as honeypots for the gullible. Downloads from such sites may well have malware embedded in them.

Such tainted downloads may contain nothing more than “nuisanceware”—software that causes adverts to pop up, unnecessary toolbars added to browsers, and home-pages diverted to inappropriate sites. Or it could be “scareware”—software that offers to scan the device for viruses and the like, and then demands payment to fix the problems it finds, which probably do not exist.

Though rare, more toxic mobile malware can collect personal data and contact lists, monitor keystrokes, track a phone’s location or even take photographs or video of users and their surroundings. It can then transmit this booty back to servers run by organised crime for extortion, identity theft, scams or phishing trips. Even more worryingly, thanks to improvements in “near-field communication”, phones are beginning to morph into wallets—with all the necessary links to bank accounts and credit cards—so users can make incidental payments at stations, convenience stores and elsewhere merely by waving their phone near a terminal. Cybercrooks must be rubbing their hands in glee.

The weakest link

Yet for personal phones and tablets used at work, the biggest hazard for organisations is not mobile malware, but data leakage caused by employees losing their devices, or selling sensitive corporate information collected on their mobiles. Gartner, an information-technology consultancy based in Stamford, Connecticut, advises clients not to worry too much about malware penetrating their networks through the devices employees bring to work. It is the users themselves who are the problem. How, for instance, do companies prevent employees from innocently responding to “spear-phishing attacks” in the form of individually targeted, and very official-looking, e-mail or text messages, apparently from trusted colleagues, that request sensitive information? Security measures need to focus more on educating users, says Gartner, rather than on the relatively minor problem of mobile malware.

At the very least, everyone should use an app that enables their devices to be tracked or wiped clean if lost or stolen. They can also install a mobile-security suite to block all known malicious software. That will not, of course, protect the device from unknown threats (“zero-day” attacks), but it will cut out most of the nuisance. And steer clear of third-party download sites making offers that seem too good to be true. Invariably, they are.

Interestingly the article makes clear that for all the potential threats to mobile devices, malware etc, the real problem is the human operator.  Losing the devices or othewise leaking the data or getting caught by a spear phishing attack.  That is a real problem.  The amendments to the Privacy Act will expose operators who don’t device proper protocols and procedures to maintain data security to possible civil penalties.

Leave a Reply