The ease of mobility and the ease of convergence, have made not only the Domestic Users of IT and ICT, but even the Enterprise Users, switch to the Smartphone for both the Domestic as well as the Enterprise Driven usage. The advent of 5G, has also providing speed and has facilitated the lowering of use of bulky hardware compute, and increase in Smartphone as the popular endpoint asset. The availability of applications on the cloud, has also been a catalyst, for the users to invest in High end Smartphone for Enterprise usage. The advent of APIs on Android and Apple has also enabled High Resource Seeking Applications, to be available from Smartphones. These Smartphones are also seen to be providing extraordinary capabilities and clear advantages over the Bulky Hardware Devices. Smartphones have also become a trend, as it can cater for both the domestic use and enterprise use from the same converged device; also for the fact that the Smartphone is able to replace many of the hand-held devices in our routing working, can also be considered as reasons for its popularity. Notwithstanding the fact that, Smartphones make its users stronger, faster, smarter and better (at nearly everything) yet, they cannot be absolved form the threat that they are exposed to, while on the Cyber Highway.
Yet, Mobile Devices, or Smartphones, are vastly more complicated than they appear on the surface and certainly more vulnerable. The users have acquired a false sense of Security, by virtue of the device being always alongside the user. The Threat Perception, of Smartphone Users is presently a little coloured, for the fact that the device is viewed as a gadget with better security and carriable in comparison to the Laptop/Desktop/Server.
We at Cyber Secure India, have endeavoured to evaluate the trend on Cyber Breach incidents among Smartphone users, based on statistics in the previous years and have made an effort to arrive at the “top five (5) potential cybersecurity threats that a smartphone user” may face in the year 2023:
Malware Threats:
One should is well aware, that a Malware injection into a device, is independent of the Level of Hardware Build it has got. The ease of inserting Malware into a Smartphone is otherwise much easily achieved, due to the nature of the Operating System and BIOS Build, that a Smartphone has. But Malware is the last thing that one would want on the Phone. The habit of clicking on any link, becomes the source of delivery, and more for the fact that the Mobile is used to access application like SMS, WhatsApp and such Similar Chat Applications very often. All these modern-day Malwares that make ways without you even providing, need no explicit permission, due to the way an existing application is configured in the mobile. Once it’s there, it can do all sorts of damage, from stealing your personal information to crippling your system. Hence, it is important to review all the permissions that are granted to all the application in the Phone.
There are a few things you can do to protect yourself from malware. First, keep your operating system and all your software up to date. Software updates often include patches that close security holes that malware can exploit. Second, use a reputable security suite to protect your Phone; these programs include firewall protection and anti-malware scanning tools that can help stop threats before they can do any damage. Also, routinely undertake study of the permissions that is provided to an Mobile App, while installation or while using the app. In some instances, to perform an activity, the application already installed will seek an additional permission, this then will be required to be reviewed one the activity is not more required. There are also settings available to override the application usage, by implicitly turning of the app while it is not in-used for a stipulated period of time on the phone.
Zero Day Threats:
In a report published in the year 2022 on a global front, it was projected that there has been a whopping 466% increase in zero-day attacks on just the mobile devices. This can be also attributed to the large-scale penetration of the Handheld Device in the recent decade. In the recent past, the number of Patches and Updates that is percolated by Smartphone OEM, is also seen to be much more than that of any Laptop or Computers. Apple OEM, has time and again been instructing its user to install certain patches pertaining to zero-day threats that could disrupt phones’ functionalities and also can be cause of harassment to owners.
Zero Day attacks on mobile devices are still a nascent activity for the attacker community. Zero-day attacks on mobile devices can result in unexpected network traffic, cyber espionage, intellectual property theft, extortion, and other cyber perils. The adverse impact of a zero-day attack (or attacks) can lead to crush all the dependencies that one builds over the phone; like banking, booking apps, etc.
The present trend, of using the Mobile Phone, for both Enterprise usage and Domestic Usage, has made the device more dependent and mobile-first; Hence, the susceptibility of exploiting the Smartphone for zero-day attacks is expected to grow in number. Nearly 60% of cyber security professionals are concerned about zero-day threats on mobile devices. The solution is to maintain all the available security measures on the device. Usage of Mobiles for Enterprise Services should be avoided, unless, such hardened devices on Lite Mobile OS is made popular among users. The habit of reviewing any additional applications in the Phone and also the observation of finding abnormalities is the best solution to evade Zero Day attacks.
Ransomware Threats:
Ransomware infection on a phone has also now been classified as a threat, and the impact of such an attack is based on the material or data that is stored on it. The Android platform as well as Apple, does offer a plethora of options to store the data of a phone on cloud. Yet, there may be exclusive applications that were earlier installed, but being accessed on a PIN or M-PIN is found compromised. The presence of vital data on a Smartphone, by virtue of the large storage it offers these days, is also a matter of contention. Hence, the threat from Ransomware to Smartphone devices, cannot be ruled-out completely.
The fact that a ransomware infection, on a personal smartphone, can lead to denial of the device or downtime, is a cause of concern. The present-day dependency on this convergent device, make the Smartphone, thus demands due protection. More so, for the fact that these Smartphones has become the most used and dependent device in our routine lifestyle. The threat due to Ransom Attack is likely to continue to grow in the coming year. Government, education, and healthcare are often targeted for ransomware attacks, because they hold highly confidential data, and provide essential services that cannot handle large periods of downtime. The threat is also about the demand that the attacker/hacker may make for the unlocking or reversion of data.
The practice of maintain ‘Cyber Hygiene’ and a model of ‘zero-trust’, may be a means to save oneself from falling a victim to Ransomware Attack. Also, the practice of maintaining multi Authentication options and strategic recovery options can also be of good help.
Device Hardware Exploit & Device Theft:
It should be well understood that the Device, being a Smartphone, is more connected to the internet, as most of the time, the WiFi or the GPRS setting is ‘ON’. The focus most of the time is on the top-layer or software, but the lower levels of the software stack that is in direct contact with the Bare-Metal, can contain vulnerabilities and be attacked as well. With mobile devices – like computers – vulnerabilities in the mobile OS or the device itself can be exploited by an attacker. Often, these exploits are more damaging than higher-level ones because they exist below and outside the visibility of the device’s security solutions. Jailbreaking and Rooting and also Juice Jacking, are more related to the Hardware of the Mobile and these forms of Exploitation is very well possible, with the available sophistication. Many mobile users may also explore the features of jailbreak/rooting their own devices to enable them to delete unwanted default apps or install apps from untrusted app stores, making it vulnerable to attacks which is also much more easier to execute by the attacker. The increased permissions enabled by users also enable an attacker to gain access even the Core Hardware, and cause more damage than with the limited permissions available by default.
Threats due to Human-error:
A study by IBM in the recent past has revealed that, most security breaches result from human error and this amounts to about 95% of the total breaches, in the Cyber World. Human error or insider threat (a sort of) has been one of the most contributing factors in Cyber Security Breaches. Earlier, the threat was mostly conceptualised for workplace environment on Enterprise Network; but, in the recent study, it is obvious that the threat due to Human Error have led to compromises on Security even in Mobile or Smartphone Usage. A simple mistake made by a Mobile User, may lead to losses, that is cannot be reversed. The specific crime in which a Remote Software is used to take control of the Primary Devices is quite common.
Although there are many situations that can lead to mistakes, there are five main categories of human error that lead to cyber security threats mostly: Carelessness, Excessive Trust, Weak Access Control, Low Awareness and The Factor of Make-To-Believe.