{"id":78678,"date":"2024-05-30T16:54:41","date_gmt":"2024-05-30T08:54:41","guid":{"rendered":"https:\/\/version-2.com\/?p=78678"},"modified":"2024-05-28T17:04:49","modified_gmt":"2024-05-28T09:04:49","slug":"armor-your-achilles-heel-reduce-your-business-attack-surface-vectoring-from-employee-mobile-devices","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2024\/05\/armor-your-achilles-heel-reduce-your-business-attack-surface-vectoring-from-employee-mobile-devices\/","title":{"rendered":"Armor your Achilles\u2019 heel. Reduce your business’ attack surface vectoring from employee mobile devices"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
\"\"<\/div>

The number of Android threats detected by ESET telemetry in the past four years has tripled.\u00a0 <\/em><\/p>

Trojanized chat apps<\/a>, software development kits turning legitimate apps into spyware<\/a>, or fake websites<\/a> offering malicious mobile applications \u2014 these are just a handful of the growing number <\/a>of threats targeting smartphone users in the past few months discovered and analyzed by ESET researchers.<\/p>

While these threats may sound like the personal problems of private individuals using their own devices, various surveys<\/a> show that smartphone equipped rank-and-file employees are in fact yet another attack surface for businesses, one that should be prioritized.\u00a0<\/p>

And that\u2019s not easy. Even with thorough cyber-awareness training, there is still a good chance that an employee will fall victim to a sophisticated attack and become the Achilles\u2019 heel in an otherwise first-rate defense of their respective business.<\/p>

Being aware of this, ESET has introduced a new Mobile Threat Defense module to its comprehensive business solution ESET PROTECT, with sweet pricing available for the Advanced tier and higher. Users of ESET PROTECT Advanced and higher can enjoy one free mobile device seat per one paid seat for other devices.\u00a0<\/p><\/div>

Growing numbers<\/h3><\/header>

To understand the scope of the problem, let\u2019s review some key data from ESET telemetry. From the beginning of 2020 until the end of 2023, detections of Android malware rose by 222%. ESET Threat Reports provide further insight as to why this number has more than tripled in just four years.<\/p>

In 2021, ESET telemetry detected a 428% annual increase in Android banking malware. The following year, the overall increase was driven by adware. And 2023 saw a significant increase in Android spyware cases.<\/p>

If you are asking what it means for your business, check out the results of the surveys discussed below.\u00a0<\/p>

A 2022 survey<\/a> of working adults and IT security professionals from across the world revealed that half of the respondents used their employer-issued devices to check personal emails and messages. A further 45% used their work devices for reading news stories, while 32% shopped online.<\/p>

Ironically, emails<\/a>, online shops<\/a>, and even news portals<\/a> were the precise attack vectors described in several pieces of ESET research in 2023.<\/p>

When it comes to employees using their own devices, 48% of organizations deploying a Bring Your Own Device (BYOD) policy witnessed malware being introduced through an employee\u2019s personal phone, according to a Samsung 2023 survey<\/a>.<\/p>

If you wonder what\u2019s behind these compromises, another 2022 survey<\/a> found that the most common mistake contributing to cyber incidents is employees\u2019 poor password hygiene and misuse of personal email.<\/p><\/div>

Real-life examples<\/h3><\/header>

Maybe those numbers are too general, so let\u2019s see some real examples of how a malicious app installed on an employee\u2019s smartphone can endanger the whole company.<\/p>

Last year, ESET researchers published a blog<\/a> about two campaigns targeting Android users that had been active since July 2020 and July 2022, respectively, and were distributed across several app stores and dedicated websites.\u00a0<\/p>

The threat actors in question patched open-source Signal <\/a>and Telegram <\/a>apps for Android OS with malicious code that ESET researchers later identified as BadBazaar. These malicious apps went by the name Signal Plus Messenger and FlyGram, and their purpose was to exfiltrate user data, such as contacts, call logs, and the users\u2019 list of Google accounts.<\/p>

The Signal Plus Messenger app proved even more dangerous than FlyGram with its unique capability to spy on the victim\u2019s communications in the legitimate Signal app, an app that is often praised for its reliability <\/a>and that is trusted by high-value targets, such as journalists<\/a>.<\/p>

However, after installing Signal Plus Messenger, threat actors were able to connect the compromised device to the attacker\u2019s (Signal equipped) device and read its messages. Such sensitive information could be used in further spear phishing attacks against business officials.<\/p>

A similar case was covered in June 2023, when ESET researchers published research on Android GravityRAT spyware<\/a>. This malware was distributed within the malicious but functional messaging apps BingeChat and Chatico \u2014 both based on the OMEMO Instant Messenger app. The spyware can exfiltrate call logs, contacts, SMS messages, the device location, basic device information, and files with specific extensions, such as jpg, PNG, txt, pdf, etc.<\/p>

If your company has a BYOD policy, taking an interest in Android malware, the threat behind the 89% increase in ESET telemetry <\/a>detections in the second half of 2023 is a must. This increase was primarily due to a mobile marketing software development kit (SDK) that ESET identifies as SpinOk Spyware<\/a>.<\/p>

This SDK was offered as a gaming platform and was incorporated into numerous legitimate Android applications, including many available on official app marketplaces. Once an app with the aforementioned SpinOK SDK is installed, it operates like spyware, connecting to a command-and-control server and extracting a range of data from the device, including potentially sensitive clipboard (short-term storage) contents.<\/p>

Again, this attack can impact employees who might “Game\u201d on their smartphones, gathering sensitive data that can later be used against their company.<\/p><\/div>

Other attacks<\/h3><\/header>

So far, we have been describing spyware detected by ESET researchers during past year, but there are also other threats to business coming from mobile devices.\u00a0<\/p>