Pierluigi Paganini March 14, 2015

Mobile devices are becoming an integral part of the enterprise architecture, security depends heavily on the use that is made with mobile devices and from the policies adopted to protect the company from cyber attacks and accidental data leakage.

Which is the impact of unsafe applications in large enterprises?

A recent study conducted by Veracode has revealed that the average global enterprise has approximately 2,400 unsafe applications installed in its mobile environment, that’s a given really worrying.

Veracode has analyzed hundreds of thousands of mobile applications running on the devices in corporate environments, the experts examined mobile apps across various industries discovering 14,000 unsafe applications.

Veracode has analyzed enterprises of different industries, including financial services, manufacturing, media and telecommunications. The principal problems discovered were the exposure of sensitive data, suspicious security actions and anomalous application management (installing/unistalling mobile apps), device monitoring.

Experts at Veracode discovered the following problems related to the 14,000 unsafe applications discovered:

• 85 percent expose sensitive device data, including SIM card information such as phone location, call history, phone contacts, SMS message logs, device IDs and carrier information.
• 37 percent perform suspicious security actions, such as checking to see if the device is rooted or jailbroken (which allows applications to perform superuser actions such as recording conversations, disabling anti-malware, replacing firmware or viewing cached credentials such as banking passwords); installing or uninstalling applications; recording phone calls; or running other programs.
• 35 percent retrieve or share personal information about the user such as browser history and calendars, often sending sensitive information to suspicious overseas locations and allowing attackers to develop a complete profile of users and their social connections. 

“The findings demonstrate that enterprises typically have lots of unsafe applications installed on their employees’ devices. For example, an application is deemed “unsafe” if it has access to SIM card data such as geo-location, call history, SMS message logs and device IDs, or if it sends sensitive information to suspicious overseas locations for no apparent reason.” said Phil Neray, VP of Enterprise Security Strategy at Veracode.

As correctly Neray highlight, the presence of unsafe applications on mobile devices exposes company data to serious risk of data breach. Attacker could take advantage of such applications to run targeted attacks against enterprises.

“There are many ways in which cyberattackers can leverage risky apps. For example, they can be used to spy on employees with access to confidential information — by tracking the employee’s location, recording their phone calls and developing a profile of their social connections — in order to steal corporate intellectual property or profit from trading on insider information. They can also be used to steal banking credentials or insert aggressive adware. And nation-states can use them to track high-profile individuals,” Neray added.

The problem of security for mobile devices is serious, the number of attacks targeting these infrastructures is constantly increasing, cyber criminals and state-sponsored hackers represents a serious menace for mobile users. Insecure applications represent an entry point for attackers and the presence of so large number of vulnerable apps in enterprises enlarges in significant way the surface of attack of the organizations.

“Through 2015, more than 75 percent of mobile applications will fail basic security tests.” reported Gartner.

The data collected by Veracode give a disconcerting picture of actual security mobile security landscape. The experts urge a dynamic approach to the management of mobile security, mobile users install an impressive number of apps on their devices, these applications evolve over the time and could potentially expose company data to risk of attacks.

The results of the study on the unsafe applications also demonstrate the failure of the modern approach of manually blacklisting problematic apps, especially in a corporate environment.

“Existing approaches for addressing unsafe mobile apps, such as manually-curated blacklists, are difficult to scale because of the sheer size and constantly-changing nature of the problem.  As a result, they either fail to keep up with mobile threats or frustrate employees by prohibiting apps for no reason.” concludes the report.

Pierluigi Paganini

(Security Affairs –  Unsafe applications, mobile)