Careless use of mobile communication becomes fatal

At the beginning of December 2015, 14 people were killed in a terrorist attack in the Californian state of San Bernardino. A further 21 people were injured, some of them seriously. A short time later, the two perpetrators of the most serious act of Islamist terrorism in the USA since 9/11 were shot dead by the police. In the course of the investigation, the FBI was able to recover the iPhone of one of the terrorists. However, as access to the iPhone was encrypted, not even the world's best-equipped secret service was initially able to decrypt the data. It was only with the help of a specialized company from Israel that the data on the iPhone was finally made accessible to the authorities. The data was so well secured by PIN and encryption that it could not even be decrypted immediately if the mobile device was extracted. But are mobile devices really that secure? The answer is clearly no! The average user in particular is often unaware of how many vulnerabilities a mobile device has and therefore how many attack surfaces it has for malicious third parties.

All vulnerabilities pose a growing threat to private individuals and companies. This is because criminal attackers can gain access to sensitive data by accessing the mobile device.When we talk about mobile devices, we mean both cell phones and tablets. As mobile devices often also function as digital wallets, credit card information and bank accounts can be accessed almost without difficulty in the event of a successful attack on a mobile device. However, numerous passwords for internet accounts, cloud storage of data such as Dropbox or social media such as Facebook or LinkedIn can also be easily read if an iPhone, for example, is not handled with sufficient care. Mobile devices are also frequent victims of ransomware. Malware installed by an attacker on the mobile device blocks access to certain files such as photos, videos and audio files or even to the hard disk and demands a ransom from the user to release the data. The latest example of this is the "Wanna Cry" malware, which encrypts users' data and then asks them to pay bitcoins to get their data back. According to the engineers at Kudelski Security, there are four areas of vulnerability in mobile devices: the network, the apps used, the respective operating system and the hardware of the mobile device.

Public WiFi: more dangerous than expected

One of the key vulnerabilities of such devices is the use of external networks. External networks, such as WiFi hotspots, often open the door for attackers to access the data of mobile device users. Who hasn't connected to a hotspot that provides a free Internet connection while on vacation? If you have ever done this, you have negligently risked third parties being able to read your personal data or even gain direct access to your cell phone or tablet. This delicate use of public WiFi networks is now a widespread need to stay permanently online free of charge. The danger here comes primarily from so-called network (authentication) spoofing. This means that the user is deceived by a supposedly trustworthy WiFi node. This involves infiltrating users' mobile devices by faking a trustworthy identity of a WiFi access node. This is a popular method for cyber criminals as it allows them to gain access to sensitive user data without being noticed. The label "Free WiFi" should therefore be treated with caution, as it is impossible to verify the provider of the Internet access or their intentions. In addition, man-in-the-middle attacks can be used to intercept data traffic between two communication partners by the attacker, who acts as a middleman in the network, and redirect it to a manipulated server or a dangerous website under false pretenses.

Apps: friend or foe?

Apps are probably one of the most important elements of any mobile device. Today, there is an app for almost every need. It's hard to imagine communicating without WhatsApp or Facebook, setting off on a journey without checking the SBB mobile app, or paying a recently received bill without a payment app. Although mobile apps simplify our private and professional lives enormously, increasingly sophisticated dangers are lurking. This is because apps make it easy for cyber criminals to install malicious software on mobile devices. As can be clearly seen with Android, the enormous number of apps and app stores poses a considerable risk to the security of mobile devices. Many mobile device users download apps that are not subject to sufficient quality control. Pretender apps in particular, which are nothing more than copies of well-known apps, are very difficult for users to recognize. Cyber criminals can thus install spyware on mobile devices without being noticed. This enables, for example, direct access to the user's video camera without them noticing. In addition, apps usually automatically record a user's location. Criminals can therefore not only determine the exact location, but also deduce a user's current activity.

Like an Emmental cheese

The holes in the security of the Android and iOS operating systems are comparable to an Emmental cheese. A major threat to the security of a mobile device is its operating system. It is often used as a gateway for attacks, such as the Pegasus spyware, which exploited three vulnerabilities in iOS. Through a vulnerability in the Safari web browser and two other vulnerabilities in the core of the iOS mobile operating system, attackers were able to read messages and emails, track calls, intercept passwords, make audio recordings and track the user's location, among other things. However, Android is known to be the most insecure operating system in the world. Last year alone, 523 security vulnerabilities were discovered. The latest virus is called Judy, which was installed on the mobile device using an app from the South Korean company Kiwini. According to experts, up to 36 million devices are infected with this virus, mostly without the knowledge of the device owner. This malware does not target the data of its victims, but generates clicks on Google ads via a hidden window. The malware developers collect money from the click fraud, as these come from their homepage from the point of view of the ad switcher. Cloak and Dagger is also a newer malware on Android. Hackers can use it to generate invisible screen notifications that go unnoticed by the user. Cloak and Dagger enables the undetected recording of keystrokes, the theft of sensitive data and the installation of additional apps that can give access to almost all functions. However, due to a very rigid quality security process, apps from Apple's App Store have a much higher level of security. Every new app must first undergo a complex security test by Apple. Only then is it released for use in the App Store.

If the hardware is infected, it gets expensive

Even the hardware of a mobile device is not free from security vulnerabilities. Last year, it became known that almost 900 million Android devices were affected by a security vulnerability in chipsets from the supplier Qualcomm. A chipset is a set of integrated circuits that together perform one or more tasks in a mobile device, such as GPS or device sensors. If the vulnerabilities are exploited, attackers have complete access to the entire mobile device, making it easy for them to manipulate the chipset software and install malicious applications directly on the mobile device. As such vulnerabilities in chipsets are pre-installed on the respective mobile devices, closing a security gap is a very time-consuming and costly process. In the worst case, the mobile device has to be completely replaced. Until a new device with the security update is available again, the entire logistics chain from the factory to the customer has to be run through.

Employers in danger

Mobile device users are not aware that private use of mobile communication can also put their employer at risk. Private mobile device users often fail to adequately protect their devices with a suitable PIN or password. Where a password exists, it is often created according to the "12345" scheme, i.e. it does not provide sufficient protection against unauthorized persons. In general, users tend to secure their cell phone or tablet with single factor authentication only. This means that only one security level, for example a password, is needed to protect the mobile device from attackers. Two-factor authentication, where two security levels protect the mobile device from criminal third parties, would be much better. For example, security tokens or SMS codes are often used for logging into e-banking systems in addition to entering the user name and password. Fingerprints, iris scanners or GPS can also provide increased security in addition to a password. Without two-factor authentication, professionals often only need a few seconds to crack a simple password. Using the "brute force method", software tries out all possible character combinations until the password is found. With a password length of six letters (lower case), a quad CPU only needs 6.8 seconds to crack the password. This was precisely what proved fatal for the internet company Yahoo in 2014. Cyber criminals succeeded in stealing at least half a billion user data, which they then offered for sale on the darknet for good money.

It is becoming increasingly difficult to distinguish between private and business use. In companies, mobile devices are usually the weakest link in the security chain and are still neglected and inadequately protected. The problem is that the private and business use of mobile devices makes it difficult to differentiate between the two worlds and to control them in a business environment. Despite this, companies are beginning to either increasingly restrict the use of mobile devices or provide better protection against misuse.

Phishing can be massively curbed

Mobile devices are the main gateway for phishing and social engineering attacks. Targeted manipulation of employees causes billions in damage every year. Recent examples show that a lot of money can be stolen from large companies: Toy manufacturer Mattel lost three million US dollars through social engineering in 2016, while automotive supplier Leoni even lost 40 million euros. According to the FBI, the aforementioned security hack at Yahoo also had its origins in a phishing email sent to a Yahoo employee. Small and large Swiss companies such as RUAG, Digitech, Galaxus and others have also been severely affected in the past. For example, Russian hackers presumably succeeded in stealing 20 gigabytes of data from the RUAG armaments group with the help of malware from the Turla family, causing corresponding damage. In a recent study by KPMG, 88% of Swiss companies surveyed stated that they had been the victim of a cyberattack in the last twelve months. This is an increase of around 34 percent compared to the previous year. For more than half of the companies (56%), the attack led to an interruption of business activities, and for more than a third (36%) of the companies surveyed, the attack resulted in direct financial damage.

The reasons for successful phishing and social engineering are not only gullible employees, but in many places there is also a lack of training to make employees aware of the dangers of social engineering. Once the attackers have infected a single mobile device with malware, they can quickly access the company-wide network and download or modify sensitive data undisturbed.

Most companies do not have a whitelist for permitted and secure apps. As a result, employees lack a binding framework for downloading trustworthy applications. Without such restrictions, harmful apps from third parties often find their way onto personal or even company-owned cell phones and tablets. In addition, companies often do not update their software systems regularly. This makes it easier for attackers to gain access to important information about the existing security gap. In addition, companies are often relatively slow when it comes to updating their own software. Although they are aware of a security vulnerability, companies often negligently assume that they are the only ones who know about it. As a result, many vulnerabilities are not improved for years. On average, it takes 153 days from the time a vulnerability is discovered to the time it is closed.

Digital business models very much at risk

Mobile devices are often the first thing you use in the morning and the last thing you have in your hand before going to bed. According to a study, people look at their cell phones on average 88 times a day and unlock an app 53 times. As the use of mobile devices is becoming ever more intensive, the threat of cyberattacks is also increasing rapidly. Paradoxically, although new digital business models with even more innovative mobile devices and apps are constantly coming onto the market, private individuals and companies still give far too little thought to their security. In the KPMG study, around 65% of the Swiss companies surveyed stated that they do not systematically work on user-friendly cyber security measures. Only 53% of the companies surveyed stated that they even recognize attacks and have the ability to respond appropriately. In addition, only 11 percent consult appropriate specialists. It is therefore still far too easy for attackers to gain access to highly sensitive data from private individuals and companies, as there is either no protection at all or it does not meet the necessary standards. So what is the point of digital transformation and the use of new technologies such as 3D printing, mobile payment or Industry 4.0 if we do not attach enough importance to protecting mobile communication and critical infrastructure? People and their behavior or how they use mobile technology stand in the way of effective protection. Specific awareness training in the company is a suitable measure to change human behavior with mobile devices. It is imperative that the effectiveness of security measures in the use of mobile communication be trained and thus increased so that technical progress does not endanger people and their environment in the long term - and better yesterday than tomorrow. (Franco Monti)

This article first appeared in the industry report "Madia Trends I" from July 14, 2017

The Author: After many years as a partner in international consulting companies, Franco Monti founded his own company, Monti Stampa Furrer & Partners AG, at the beginning of 2016, which focuses on cyber security and telecom regulations. Franco Monti has also made his wealth of experience available to the telecoms, media and energy sectors, among others. Franco Monti began his professional career on the line at AT&T before later becoming Deputy Managing Director of a technology company and a member of the Board of Directors of a start-up and a construction company. He is President of the Swiss Mobile Association (Smama) and holds a degree in engineering from the Swiss Federal Institute of Technology (ETH) and a lic. oec. HSG.

_{Graphic: Monti Stampa Furrer & Partners AG, Photo: zVg}