By Gary McIlraith,
CEO, NetNames
Cool as they are, mobile apps represent the shakiest area of online security. Moving to mobile interface with customers spells extreme vulnerability for businesses across the board, from gaming to banking, entertainment to retail.
The ease with which mobile apps can be replicated or adulterated leaves users exposed to fraud, security breaches and other acts of piracy. And as people move in droves from PCs and laptops to smartphones, it was inevitable that malware would speed its way to the new device of choice — it’s happening almost faster than we can follow it in real time.
Incredibly, in 2009, less than 1 percent of Internet traffic originated from mobile devices. By 2017, Cisco estimates that mobile phones will take up more than half of total Internet bandwidth. And as mobile use increased, cyber piracy and fraud simply exploded.
Equal opportunity fraudsters
Consider that RSA detected 350,000 malicious Android app samples in 2012, up from just 1,000 in 2011. Popular game apps like Angry Birds and Temple Run are downloaded millions of times — and why not, as 40 percent of all time spent on mobile is spent playing games? Yet we’ve found well more than 20 million downloads of a single pirated version of Disney’s Where’s My Water? across various Chinese app stores.
Some game app developers have reported a piracy rate of up to 95 percent. In financial services, the situation is rife with danger. Banking Trojans found on desktop computers have morphed to mobile attack mode: the Citadel Trojan, one of the fiercest banking attacks online, was modified to become CitMO (Citadel-in-the-Mobile), a worm that can install itself on Android devices.
Tip of the iceberg
This is just the beginning. Fraud, IP infringement, brand misuse and copyright abuse are thriving in app marketplaces, which are less transparent than the Internet, challenging to comprehensively search and require special capabilities to do so. Mobile’s smaller screen size and slower download times add to the opacity. In short, it’s much easier to miss badly replicated details and brand markers that, on a larger screen, would send up a red flag.
And no sector is untouched. While industries such as entertainment and banking are more obvious targets for piracy and fraud with copyrighted or otherwise high-security content, retail is no more immune. Brands and proprietary design and manufacturing methods are constantly under attack in every channel. As consumers increasingly use their phones for commercial transactions, the certainty that you’re going to get what you thought you ordered goes down exponentially. In the entertainment world, the fact that 50 percent of tablet users regularly watch downloaded videos throws open the door to pirated video content and other infringing uses, both passive (by the consumer) and active (by the pirate).
Cautionary steps
So how do you combat this tsunami of cybercrime? What can you do, even on the most basic level, to ensure that the app you’ve downloaded is genuine? The first rule of thumb is that you get what you pay for. If you’ve paid half or less of what the app is commanding normally, it’s probably a fake.
As far as using your mobile device is concerned, be aware that mobile provides a more casual computing environment. Devices are often used on the go, encouraging a relaxed state of mind that may prevent users being properly alert to security concerns. The necessity of making mobile devices easy to use has produced the reaction of creating greater difficulty in performing basic tasks that may be commonplace on desktop computers, such as spotting fraudulent emails or phishing attempts – for example, it’s harder to view specific URLs in email applications and analyze web pages in mobile browsers. Additionally, consumers are usually less aware of mobile device security options and general best practice security hygiene.
Security vs. accessibility
You may have heard that there’s a security difference between Android and Apple apps. As we’ve canvassed the field, there seems to be general agreement about this. Why? There is an inverse relationship between security and accessibility. To make something ultra-secure, you have to make it pretty much inaccessible. This is why Apple’s mobile platform is widely considered more secure than Android’s.
Apple’s iOS opts for a closed operating system and a walled garden App Store, versus an open operating system and web-based app marketplace. Mobile devices have provided a high level of accessibility, giving users access to everything, all the time. This often means putting rapid access and slick delivery ahead of security, with app development often falling prey to this mindset.
It’s becoming more and more important for companies with any mobile presence to monitor all app marketplaces for those apps that open them up to fraud and security breaches — and remove them efficiently and quickly, once identified. Equally important, mobile consumers and app users have to become aware that their own security, identity and so forth may be at risk.
Protecting brands’ and customers’ security on mobile app stores requires vigilance, and the ability to delve into the darkest corners of this rapidly expanding world. To be able to respond in real time, the solution lies in monitoring, detecting, enforcing and being responsive to the rapid changes taking place in the mobile landscape.
Gary McIlraith is CEO of the corporate brand protection specialists NetNames, and a leading authority on mobile and online piracy issues. He can be reached at Gary.McIlraith@NetNames.com
Learn more about security.