Blind Spots of Cybersecurity

What’s the first thing you do in the morning?

The US edition of the 2017 Global Mobile Consumer Survey study by Deloitte¹ found 89% of respondents check their phone within an hour of waking up. 81% check their smartphones within one hour of going to sleep, while 48% check their phone during the night.² On average, respondents check their phones an average of 47 times per day.

These numbers may not surprise you – in an increasingly digital world, where we rely on technology to help us communicate, organize, and stay informed – it’s not difficult to fathom that these numbers have grown since previous iterations of the Deloitte study, and will likely continue to do so.

What may come as more of a revelation, however, are the inherent cybersecurity risks that go hand in hand with our dependence on mobile devices. While we might see our smartphones as constant companions, hackers see opportunity.

Harold Moss, Senior Director of Strategy and Business Development at Akamai, compares hackers to kidnappers. “Kidnappers watch where people go, and then they say ‘OK, I know this is a point where you’re going to be vulnerable, that’s where I’m going to get you. Hackers are no different.”³

With the correct equipment, a determined hacker can gain access to any nearby mobile device in less than 30 seconds.⁴

The Cyber Security Risk In Your Pocket

A team of researchers from the University of Washington set out to prove this in 2017, when they conducted a study to demonstrate someone can hack a phone through mobile advertising networks. Armed with little more than $1000 and the right strategy, a cyber spy can “track a target’s location with disturbing precision, learn details about them like their demographics and what apps they have installed on their phone, or correlate that information to make even more sensitive discoveries—say, that a certain twentysomething man has a gay dating app installed on his phone and lives at a certain address, that someone sitting next to the spy at a Starbucks took a certain route after leaving the coffee shop, or that a spy’s spouse has visited a particular friend’s home or business.”⁵

Over a period of 7 days, the study was able to discover each target’s home and work address, and their detailed route to work each day – including a daily stop at their favourite coffee shop. The tracking activity was never flagged as suspicious, because technically they weren’t misusing the system or exploiting a loophole – they implemented the system exactly as it was built. The difference between targeted mobile advertising and mobile tracking is merely the motivation of person tracking the data; it’s down to their intent.

That means an abusive spouse could track the movements of their partner. A stalker could connect to your phone while you’re waiting in the same line for coffee, and use that link to follow your movements. Someone could target minority groups by tracking users of gay dating apps and use that information to target individuals.

“This is so easy and it’s industrywide,” says Tadayoshi Kohno, a computer science professor at the University of Washington who worked on the study. “We want to enable a broader conversation about the risks of online advertising when anyone can become the adversary.”⁵

The Growing Threat of Mobile Cyber Security

Avast reported a 40% increase in mobile cyber attacks in 2017. “Mobile cyber security attacks are growing rapidly as hackers’ strategies become more agile and dangerous, and what’s at stake is mostly the user’s personal data and privacy,” said Gagan Singh, Avast SVP & GM of Mobile and IoT. ”Users carry their most valuable data around with their smartphones.”⁶

The security risks attached to personal data are only the tip of the iceberg. With more employers turning to cloud solutions, remote work and Bring Your Own Device strategies in an attempt to increase productivity, corporate data is also vulnerable to cyber attack.

Avast identified the top three mobile threats:⁶

1. Rooters request root access to a smartphone – either by user request or hidden exploit code – gaining control of the device to spy on the user and steal information.
2. Downloaders trick users into installing more malicious apps. They typically show full-screen ads – often linked to suspicious sites – even outside of the app itself.
3. Fake apps pose as real ones, driving downloads and exposing users to advertisements.

These threats aren’t niche; McAfee Labs logged 1.5 million new mobile malware breaches in the first quarter of 2017 alone – more than 16 million unique incidents.⁷ The risks are prolific, and it’s often a race to the finish line between hackers and cyber security analysts to find the crack in the wall of defense.

Blind Spots of Cybersecurity

Zero-day Threats

John Stewart, SVP and Trust Officer of Cisco, defines a zero-day threat as “one that no one has ever seen before, usually based on some sort of weakness in the software, computers or systems that nobody knew about including even the vendor who produced it. For all the software that’s been written, there aren’t even enough testing tools that can find every possible combination of things that could actually go wrong.”⁸

Hackers who expose a systems vulnerability can release malware and cause complex network issues before a developer is even aware a breach has occurred and developed a patch to fix it – hence the nickname, because developers have “zero days” to create a solution to a breach before it wreaks havoc. These attacks are so undercover they frequently take days, months, or even years to show up on a developer’s radar screen – and because hackers don’t know if they’ll have access for one day or five years, they design malware for maximum damage, even in the short-term.

Lateral movement

Most security monitoring solutions focus on authenticating trusted users who access a given network. If a hacker manages to compromise the login credentials of a trusted employee, they can infiltrate the network without sounding the alarm. A hacker can then move freely through company systems for months, gathering information and hiding malware code. From the inside, they can even create a backdoor vulnerability to re-enter the system if they are caught and locked out.

Shared accounts

Many organisations and private users make use of shared account access. Maybe your employees need access to the same set of documents to complete their work efficiently. Or perhaps you have a shared cloud account with family members, to share photos and other documents.

It seems like a good idea and a great way to improve efficiency and knowledge sharing between parties. However, what happens if the security of one member is compromised?

Let’s think of your shared account like a house. Each resident of the house has their own key. What happens if one of the housemates loses their key? In all likelihood, you get the locks changed, because if one key is missing, it’s only a matter of time until you all come home to find your television has disappeared.

Now let’s extrapolate that to your online shared account.  If one member has inadvertently installed malware on their device, and they use that device to access the shared account, a hacker has just become the new silent member of the shared account, and all the sensitive information it might hold.

Business applications

Business applications are a crucial part of any organisation’s day-to-day operations. They help employees keep in touch with each other and with clients; they track and store company financial data like payroll and payments; and they host a huge amount of sensitive proprietary information.

Due to spread of information across a complement of business applications, it is virtually impossible for traditional IT security solutions to monitor what comes in the company gates – and, more frightening, what kind of information leaks out.

Closing The Gaps In Cybersecurity

With all of these blind spots, creating hidden vulnerabilities that hackers can exploit, what is the solution for a truly robust cybersecurity system?

The simple answer is anything but simple: there is no solution.

No single solution, in any case. Truly robust cyber security requires a holistic approach, a dynamic network of solutions designed to cover a myriad of potential threats. Companies also need to consider in-hour cyber security analysts, whose intimate knowledge of the network gives them an advantage when sniffing out the whisper of a cyber intrusion. In a 2017 Cybersecurity Survey, more than a third of business and IT executive respondents identified a lack of in-house expertise as their organization’s top information-security challenge.⁹

Are you prepared for a cyber attack?

Reduce vulnerabilities, minimize damage.