Data protection secrets: The skeletons in a cybercriminal’s closet
With 2017 on track to be another big year for data breaches, taking a look into the closet of an average cybercriminal can reveal some dark truths about mobility and data protection. You can blame it on the open sale of mobile malware on the darknet and the abysmal state of consumer mobile security behaviors, but it’s easier than ever to be a cybercriminal. In fact, thanks to prepackaged mobile exploit kits, a cybercrimnal doesn’t even need to know anything about programming now, according to Radware’s Daniel Smith.
Though the mobile threat vector is definitely scary, research reveals cybercriminals generally rely on a few tried-and-true tactics to breach mobile devices. Social engineering, knowledge of user trust and devices that really need to be updated are the primary drivers of these breaches. It’s terrifying to think about an attack happening in your organization, but in the spirit of Halloween, understanding how cybercriminals pull off their tricks can keep your enterprise’s sensitive data from being another treat. Here are some skeletons from the average cybercriminal’s closet:
Social engineering and vulnerability scanning are popular
Most cybercriminals use social engineering in their attack strategies. A Nuix survey at the DEF CON hacker conference revealed 84 percent use social media and other methods to research their targets, while 86 percent deploy vulnerability scanning to plan out how they’ll gain traction through a mobile attack. Exactly half of the cybercriminals who participated in this survey admitted each mobile attack is fully customized based on findings about individuals and technical vulnerabilities during the research phase.
Malware sales thrive due to long-standing mobile vulnerabilities
Illegal transactions on the darknet and long-delayed OS updates have driven the proliferation of mobile malware. Open commerce for illegal sales of bot-as-a-service thrives between anonymous buyers and sellers in dedicated cybercriminal communities. An INTERPOL specialist told Kaspersky Lab that cybercriminals know most devices don’t receive regular updates and are taking advantage of these vulnerabilities.
Poor user mobile security behaviors are a bonanza
Phishing attempts through SMS messages and messaging apps are proliferating, which is due in part to lax mobile user security behaviors.
“Users tend to trust text messages, as opposed to email,” security researcher Stephen Cobb said in a USA Today article. Perhaps even more concerning, Pew Research Center reports a full 10 percent of smartphone users admit to never applying updates to apps or their OS. Twenty percent admit to using public wireless networks for online banking.
Not only are users lazier about behaving securely on mobile devices, cybercriminals are able to take advantage by URL padding or creating messages that appear to be from a trusted friend or family member to steal credentials, gain access to the mobile device or extort embarrassing information from their targets.
Enterprise mobile app security and data protection are lacking
Enterprise mobility teams are fighting against a lack of resources and pressure to innovate — and might be creating a cybercriminal’s paradise in the process. A Ponemon Institute survey reveals 71 percent of organizations are using mobile applications that haven’t been subject to vulnerability testing. This figure increases to 80 percent when considering IoT apps.
Though most enterprise IT professionals believe mobile apps increase security risks, many are simply trying to wrap their arms around network endpoints. Ponemon reports 63 percent of respondents admitted to having either little or no knowledge of how many mobile apps were in use at their workplaces.
Reduce your mobile data protection risks
Insight into cybercrime trends reveals there are plenty of opportunities to reduce your organization’s risk. Smarter mobility management can reduce your vulnerability to many types of mobile threats. Cybercriminals don’t want you to know the value of comprehensive app testing, user education about mobile risks or the value of regular updates to devices on your network.