GCHQ says BlackBerry is safest

BlackBerrys are the only recommended smartphones for handling highly sensitive Government data, according to a GCHQ division.

The UK's National Technical Authority for Information Assurance at GCHQ (CESG) has published smartphone security guidance for public sector workers.

The advice published today covers various phones, including the Apple iPhone, Windows Phone 7 devices, Nokia hardware and BlackBerrys.

Four security procedures documents have been produced, outlining how to best secure any mobile deployment for UK Government departments and organisations on those platforms.

“These security procedures cover architectural issues (such as recommended network layout, recommendations for operational monitoring), configuration advice, user education and training suggestions, and information on residual risks that senior risk owners will need to take into account,” a CESG spokesperson told IT PRO.

“The publication of this risk management advice and guidance is intended to ensure all UK Government organisations have access to the information they need to take educated risk management decisions when deploying remote working solutions using smartphones.”

CESG worked with the telecoms industry to produce the report on how to secure smartphones for remote working, covering lower risk situations.

The guidance document itself was not available to the press.

CESG claimed the document will help many parts of the public sector work more efficiently and effectively, in turn saving money for the taxpayer.

As for more handling serious data, however, the GCHQ body said the only way was BlackBerry.
“The BlackBerry Enterprise Solution from Research In Motion remains the only smartphone system to have been formally evaluated by CESG and is approved to protect material classified up to and including ‘restricted,’” CESG said.

RIM was unsurprisingly buoyant about that particular comment, as a host of supporters talked about BlackBerry security credentials.

“The BlackBerry platform remains, in my opinion, the leader in this respect, providing the highest levels of assurance without the added cost or complexity of needing to bring third-party software into the equation,” said Nick McQuire, director for enterprise mobility at analyst house IDC.

BlackBerry devices are not infallible of course, as the recent Pwn2Own contest highlighted when a Torch 9800 was successfully hacked.

“The reality is that BlackBerry does have more enterprise features and controls such as remote kill, email retention, guaranteed message deliver with application and encryption controls,” said Ron Gula, chief executive (CEO) of Tenable Network Security.

“However, while this is important, a lot of it is just details, and we'll probably see some leapfrogging between the various mobile vendors as they get bitten and react.”

[ITPro]

Lock Down Your Life: How to Secure Your Home, Auto and Smartphone

The more sophisticated technology gets, the more sophisticated the criminals get.
Because of that, protecting yourself and your family these days involves a lot more than just making sure the front door is locked and that you haven't left the keys in the car.

Smartphone owners, for example, are increasingly the target of the same sorts of attacks and scams — many of which can result in identity theft — that have been plaguing computer users for years.
Users of Android-based phones users recently learned that more than 50 malicious apps had been uploaded to the Android Market app store, and then installed on roughly 260,000 phones within a few days.

(Google yanked the apps from the Android Market, then used its “kill switch” to remotely remove the installed apps from users’ phones; Apple has a similar “kill switch” for iPhones and iPads.)

Landlines can also be hit by scams, such as the call-forwarding *72 attack in which a stranger tricks the victim into forwarding all incoming calls to another number — and then proceeds to rack up charges on the account.

Even cars, which have security systems built into nearly all new models, continue to be a major target. According to the National Insurance Crime Bureau, a vehicle is stolen every 33 seconds in the United States.

And, of course, home break-ins continue. The FBI reports that in 2009, the most recent year with confirmed data, there were 2.2 million burglaries in the U.S., costing victims an estimated $4.6 billion in lost property.

So how can you protect yourself from scams and break-ins?

In addition to writing down the vehicle-identification number of your car and serial numbers for expensive equipment, such as a flat-screen TV or computer, there are several ways to protect everything from your phone to your home using some relatively simple technology.

Smartphones: For your smartphone, first make sure you've enabled password protection. Then consider a "lost phone" tracking app, as well as anti-virus/malware software.

There are several on the market, including one from Lookout Mobile Security. A free version is available for Android and Blackberry phones, and it includes a lost/stolen-phone location service and virus scanning. If you can't get your phone back, it will also remotely wipe your personal info from the device.

Credit: Lookout, Inc.

A premium version, for $29.99 a year, includes privacy tracking and protection.

Vehicles: Car and truck owners can also take advantage of GPS tracking and warning devices. For GM owners, there's the OnStar service, but any car can be outfitted with similar security and tracking features.

LoJack has an Early Warning Package for $995 (installed). If your car is moved, the LoJack network can send a phone, email or text message alert.
Credit: Lojack


However, LoJack is available only in 29 states. For nationwide coverage, there's the Escort EntourageCIS, $400, plus $60 for installation and a $180-a-year subscription.
Credit: Escort, Inc.

Like LoJack, the EntourageCIS can warn a driver via email, text or phone message if a car is moved. More important, if your car is stolen and you don’t respond to alerts, a 24-hour monitoring station will contact local law enforcement and send them after the thieves.

Home: As the summer approaches and more home owners leave for long vacations, alarms and monitoring services can be useful. As an alternative to calling in a professional (and paying monthly fees), you now have the option of installing your own cameras and monitoring equipment.

Among the raft of do-it-yourself equipment now available is the $300 Logitech Alert 750i Master System. The video-based monitoring system can be installed in about 30 minutes and uses a home's electrical circuits to connect to a home network and the Internet.

Credit: Logitech

Using a Web browser, owners can log in any time for free to see and hear what's going on back home, or they can have email alerts sent to them whenever motion is detected.

Some people may find all this monitoring and scanning technology brings with it a touch of paranoia.

But, if you're ever the victim of a burglary or lose your phone, you won't seem so paranoid any more.

[SecurityNewsDaily]

Second hand phones contain extensive personal data

People are unsuspectingly selling their personal information to complete strangers as a new report from CPP finds half (54%) of second hand mobile phones contain extensive personal data.



Second hand mobile phones and SIM cards purchased on eBay and used electronics shops by CPP were examined in a live experiment to see what personal information was available on the handsets and whether it constituted a threat to their former owners' identities.

The experiment revealed 247 pieces of personal data that had been carelessly left on a range of mobile phones and SIM cards. The personal data included credit and debit card PIN numbers, bank account details, passwords, phone numbers, company information and log in details to social networking sites like Facebook and LinkedIn.

In research that supported the experiment, half of second hand mobile owners said they have found personal information from a previous owner on mobile phones and SIM cards they have purchased second hand.

Worryingly, the vast majority (81 per cent) of people claim to have wiped their mobiles before selling them, with six in ten confident they have removed all of their personal information from them. However, the experiment revealed that 54 per cent of mobile phones and SIM cards contained sensitive personal information putting people at unnecessary risk of identity and card fraud.

The variance could be explained by the fact that most people who claimed to have 'wiped' their handsets tried to erase the data manually – a process that security experts acknowledge leaves the data intact and retrievable.

And it seems personal information comes cheap with individuals selling their old handsets and SIMs for an average price of 47 pounds Sterling.

As people rely heavily on their mobile phones to store personal data such as e-mail addresses, social networking log in details, banks account details and even debit and credit card PIN numbers, CPP is calling on people to make sure they remove all of their personal and financial information from their mobile phones and undertake adequate security measures to protect themselves from identity theft.

Senior Vice President of CRYPTOCard Jason Hart said: "The safest way to remove all of your data from a mobile phone or SIM card is to totally destroy the SIM and double check to ensure that all content has been removed from your phone before disposal. With new technology does come new risks and our experiment found that newer smartphones have more capabilities to store information and that information is much easier to recover than on traditional mobiles due to the increase of applications."

[Net-Security]

Most users unaware of smartphone security risks

Consumers are indifferent to the many serious security risks associated with the storage and transmission of sensitive personal data on iPhone, Blackberry and Android devices, according to The Ponemon Institute.



Following are three of the most alarming results of the survey:

• 89 percent of respondents were unaware that smartphone applications can transmit confidential payment information such as credit card details without the user’s knowledge or consent.
• 91 percent of respondents were unaware that financial applications for smartphones can be infected with specialized malware designed to steal credit card numbers and online banking credentials, yet nearly a third (29 percent) report already storing credit and debit card information on their devices and 35 percent report storing “confidential” work related documents as well.
• 56 percent of respondents did not know that failing to properly log off from a social network app could allow an imposter to post malicious details or change personal settings without their knowledge. Of those aware, 37 percent were unsure whether or not their profiles had already been manipulated.

Other smartphone security dangers include geo-tracking based on location data embedded onto image files; the transmission of confidential payment information without the user’s knowledge or consent; and unauthorized (and often unnoticed) premium-service orders on the monthly bill.


"The findings of this study signal what could be an overlooked security risk for organizations created by employees' use of smartphones. Because consumers in our study report that they often use smartphones interchangeably for business and personal, organizations should make sure their security policies include guidelines for the appropriate use of smartphones that are used for company purposes," said Dr. Larry Ponemon, chairman and founder of Ponemon Institute.

According to the study, 28 percent of respondents were unaware that using their smartphone for business and personal reasons can put business information at risk.

[Net-Security]

How to Make Sure Your Online Banking Is Safe

When was the last time you went to your bank and withdrew cash from an honest-to-goodness bank teller?

For many of us, it was probably years ago, as most people now prefer the ease and 24/7 availability of online banking and automated teller machines.

Today's bank robbers prefer them, too. They’ve gone high-tech, using ATM skimmers to get hard cash out of our accounts, and computer malware to raid accounts the electronic way.

New “banking Trojans” such as Tatanga are so well-concealed that they escape antivirus detection, and so sneaky that just a visit to any of thousands of compromised websites will infect your PC.

In fact, depending on computers for bank transactions has gotten so risky that getting to know our bank tellers is starting to sound good again.

This raises the question: Should we quit banking online altogether?




Ways to beef up your security

Of course not, said Josh Shaul, chief technology officer with New York-based Application Security Inc.
Shaul does all his banking online or at ATMs and never worries about the risk. He leaves that worry to the banks. For that reason, Shaul recommended that consumers, instead of panicking, learn how their banks approach security.

“I think larger banks tend to have more-sophisticated security systems than smaller banks can offer,” although smaller banks may be catching up or devising cost-effective security methods, he said.

Shaul said consumers shouldn’t hesitate to ask their bank about how they handle online banking security. What kind of authentication system do they use? How do they notify the customer who has forgotten a password? What are the security policies in place in case there is a breach?

“If you feel you don’t know enough about security to judge the bank’s security application, talk to a friend who does,” Shaul said.

Harry Sverdlove, CTO for Bit9, based in Waltham, Mass., is another security expert who has no problem with banking online.


The bank's job

But Sverdlove would like to see banks step up with another layer of security, especially as the most dangerous malware focuses on keylogging (recording keystrokes to steal passwords, PINs and bank numbers) or man-in-the-middle attacks (where it appears that an online transaction is happening as normal, but the malware hijacks and controls the information).

“One of the banking sites I deal with gives you a random generic [on-screen] keypad and you use the mouse to click in your PIN,” Sverdlove said. “Keyloggers won’t be able to read it because I use my mouse, not my keyboard.”

He’d also like to see banks use a card swipe or biometrics — something that has to be physically done by the consumer, separate from typing in login authentication.

That way, Sverdlove said, even if a criminal has the financial login information, he can’t do anything without the second layer of authentication.

For the most part, Sverdlove and Shaul agree that the platform used for online banking doesn’t make much difference.

Macs may be a little safer than Windows right now, simply because the vast majority of malware is still written for Windows machines. (Shaul says the increased use of iPads and iPhones will spur the creation of malware written for those platforms.)

The type of browser used makes little difference as well. Most of the banking malware is written to cross browser platforms.


Wise up about smartphones

What about using mobile devices for online banking? This is where Sverdlove and Shaul part ways, at least slightly.

Sverdlove said he doesn’t use his smartphone for banking.

“Banks will use SMS or text messages to authenticate things with you, and that information can be intercepted,” he said. “But the real reason I don’t use mobile banking is because how easy the device can be lost. Once the attacker has physical access to your device, a wealth of opportunities opens up.”

While Shaul agrees that the biggest risk in mobile-device banking is loss, he believes mobile devices are actually safer because the banking malware technology hasn’t caught up yet with banking apps.

But again, this can change as more people use banking apps and hackers refocus their efforts.
Online banking can be done safely if consumers follow some basic best practices:

• Keep up to date with patches. Shaul said malware will sneak in through the vulnerabilities in operating systems, browsers and software, so if your computer is alerting you of an update, install it immediately.
• Check your online account once a week to make sure everything looks okay.
• Use the “smell test.” Sverdlove said that if you log into your account but the interface is different or the look of the site has changed, contact your bank as soon as possible using the number printed on your ATM card.
• Ask your bank about its security practices.
• Do all of your banking from one computer. If you have a desktop, use that for banking. If you have to use a laptop, make sure banking information is not stored in a browser’s “cookies” before traveling with it.
• Never use an unfamiliar computer, such as a library computer or a friend’s laptop, to conduct banking.

Finally, maybe it isn’t always safest to visit the teller.

Christen Gentile, corporate PR specialist with Kaspersky Lab Americas, related an alarming story.

“I saw a case in the Netherlands where the bad guys had gone as far as renting office space for their scam,” Gentile told SecurityNewsDaily. “Victims were sent emails with information on the 'new office' complete with a special phone number. The office was completely branded as the targeted bank, complete with desk clerks and fake customers.”

[SecurityNewsDaily]

ZeuS Targets Mobile Users

As early as 2006, Trend Micro already recognized the fact that the BlackBerry technology could be exploited by cybercriminals. The smartphone may have remained spared from malware attacks over the years although there have been recent news of a ZeuS variant specifically targeting BlackBerry users. As we have said in a recent post, banking Trojans are evolving and more sophisticated attacks involving smartphones are among the most recent developments.

The ZeuS malware specifically targeting the BlackBerry OS is currently detected by Trend Micro as BBOS_ZITMO.B. Just like its desktop counterpart, this ZeuS variant does not display any graphical user interface (GUI) that can prompt users about the infection. Instead, it removes itself from the list of applications, in order to effectively stay under the radar.
Upon successful installation, it sends a confirmation message to the administrator to signal that it is ready to receive commands. It specifically sends the message “App Installed OK” to the U.K. number +447{BLOCKED} as seen in the screenshot below.

BBOS_ZITMO.B also allows the attacker to remotely change the number to which it forwards SMS messages sent to the affected phone, also known as the administrator number. Thus, in the event that the original administrator number is tracked down and becomes unavailable, the attacker can just send a command to change the administrator number and continue receiving the forwarded messages.

Based on our analysis, BBOS_ZITMO.B is capable of carrying out the following commands:

• Display SMS: Unmonitored SMS will be treated as a normal SMS and will be displayed on the phone.
• Delete/Drop SMS: SMS from hacker will not be seen by the user.
• Forward SMS: Send SMS to hacker without the user’s knowledge.
• Block Calls
• Remove Block Calls
• Set Administrator: Register a new administrator.
• On/Off
• Add Sender
• Remove Sender
• Set Sender
• Block/Unblock Phone Numbers

Other smartphone OSs are not immune to this threat either. Variants targeting smartphones running Symbian (SYMBOS_ZBOT.B) and Windows Mobile (WINCE_ZBOT.B) have also been spotted with behaviors that are very similar to those exhibited by BBOS_ZITMO.B.

With the increased popularity of mobile banking goes the increase of mobile threats. Thus users are strongly advised to keep their mobile devices secure, and be cautious in installing applications and clicking links sent by unknown users, as they may lead to the download of malicious applications.

[TrendMicro]

Keep Your Mobile Devices Secure While Traveling

From coffee shops to planes, trains, and cruise ships, we've become accustomed to having ready access to the Internet just about anywhere. The problem is, it's easy to forget how vulnerable that makes us to security threats.

I learned this the hard way recently when traveling from San Jose to Tampa, passing through four cities along the way. Even though I'm well aware of the potential for others to hack into my devices, I'd never had any problems previously. Unfortunately, there's always a first time: When I got back home, Facebook alerted me to some suspicious activity. I had been "Firesheep'd"!

Apparently someone in Chicago (using Firefox and a Windows PC) had logged into my Facebook account via Firesheep, a Firefox extension that can intercept unencrypted cookies from certain Websites on any open Wi-Fi network, making it possible to steal login credentials for sites like Facebook and Twitter, or even access your e-mail.

Think it can't happen to you? Think again. Fortunately, a combination of plain old common sense and some technology can protect your devices--quickly and fairly easily.

How Your Gadgets May Be Vulnerable

Whether you're traveling with a laptop, netbook, smartphone, iPad, or all of the above, the risks and defenses against them are basically the same, according to Joe Nocera, an information security expert and a principal with PricewaterhouseCoopers. "Many of the security concerns that people think about when they think about their personal computers are applicable in the mobile world." As mobile devices become more sophisticated, they lend themselves to the same types of access to e-mail, passwords, and other secure information that PCs have done in the past.

Because today's devices are so much more powerful and can hold so much more information than ever before, the risks are increasing, says Martin Hack, information security expert and executive vice president of NCP Engineering, a software company that helps businesses with their secure remote access systems. Add to that our tendency to carry both personal and business information around with us on the same device, and our mobile devices have never looked so appealing to hackers, he says.

As specific mobile devices become more popular, they become more of a target for hackers. "Five years ago, the vulnerabilities were Microsoft-based and targeting PCs. Apple tended not to be targeted so often," says Nocera. 

"But, in the last year and a half or so, we're seeing a shift. More and more often we're seeing either Android- or iPhone-based vulnerabilities being targeted. We predict that by 2014 you'll see those types of vulnerabilities being the most targeted as more and more users go to those mobile devices."

The good news is it's not difficult or even expensive to protect your devices and the information on them. The fixes are simple. The problem, stated quite eloquently in an old Pogo comic strip, is: "We have met the enemy and he is us."

10 Tips for Keeping Your Mobile Devices Secure

1. Make sure your software is up-to-date. The first line of defense, says Nocera, is making sure that all your software is up-to-date. "Almost every release of software patches a number of security vulnerabilities that are out there," he says. Before every trip, or at least every few weeks, it's a good idea to check the manufacturer's Web site (or search Google) to see if a software or firmware update is available. If there's a new one, download it, unless there's a massive firestorm of negative reviews from early adopters.

2. Employ strong passwords. "Be sure to use some combination of letters, numbers and/or special characters of 8 characters or more," says Jeremy Miller, director of operations for Kroll Fraud Solutions. "Avoid using dictionary words. Instead, [use] acronyms for things like favorite songs, restaurants or other items known only to you. And change the password frequently--at least once every six months." If you're just not feeling clever enough to create your own passwords, programs like RoboForm will do it for you.

3. Don't mess with the security settings. Nocera notes that most of the default browser settings in Android, iPhone, and Blackberry phones are fairly secure out of the box. "I recommend not going in to change browser security settings--they're pretty good already," he says.

4. Avoid unencrypted public wireless networks. Such Wi-Fi networks require no authentication or password to log into, so anyone can access them--including the bad guys. In some cases, bad guys set up an open network to snare unsuspecting people. Encrypted networks, on the other hand, are those that require an ID or password for access--you'll find such networks at many hotels and coffee shops that offer Wi-Fi services. These networks have two different types of security--WEP (wired equivalent privacy) and WPA (Wi-Fi protected access); the second is most secure. Even encrypted networks, though, have risks--it's possible for bad guys to gain access to encrypted networks at a hotel or café, for instance, so be cautious about the sorts of things you do on such networks.

Besides avoiding connecting to unencrypted networks, turn off Wi-Fi when you're not using it. This will prevent you from automatically connecting to networks (and it will extend your device's battery life).

5. Paying to access a Wi-Fi network doesn't mean it's secure. Access fees do not equal security. Just because you pay a fee to access a Wi-Fi network doesn't mean that the network is secure.

6. URLs beginning with 'https:' are safer (but not foolproof). Whenever you're accessing a site where you'll be sharing personal or confidential information--your bank's site, for example--you want to make sure that you're doing so securely. The s in https means that you're connected to the site via the Secure Socket Layer (SSL). In layman's terms, this means that all data transmitted to that particular Website over the Internet is encrypted.

SSL is not foolproof though: If you're on an unencrypted network connection, you may still be subject to man-in-the-middle (MITM) attacks, a form of eavesdropping where the bad guy makes a connection independently with two parties and then "gets in the middle," making both believe that they are talking directly to each other.

These types of attacks are rare, but to guard against them, make sure you're both connected to a secured network and that Websites use https when you're entering sensitive information.

In addition, says Nocera, most e-mail service providers have both a clear text option (that sends unencrypted data) and an encryption (SSL) option. "Make sure you have the SSL option enabled," he says.

7. Use VPN. If you have access to a VPN (virtual private network), use it. A VPN provides secure access to an organization's network and allows you to get online behind a secure layer that protects your information.

8. Turn off cookies and autofill. If your mobile device automatically enters passwords and login information into Websites you visit frequently, turn that feature off. It's convenient, but it can also be a privacy threat. To get back some of the convenience that autofill offers, you can try third-party apps, available for most platforms, that can manage saved passwords with a higher level of security. Mac OS X, for instance, comes with a built-in password manager--Keychain. KeePass is a free, open-source password manager for some versions of Windows. For iOS and Android smartphones, there's LastPass, 1Password, and SplashID. Using them is not as secure as turning off autofill altogether, but it's one way to strike a good balance. In the end, a little inconvenience can go a long way toward added security.

9. Watch your apps! Apps are great, and many are free, so it can be tempting to download with abandon. But, Nocera cautions, you should be selective about the apps you download, particularly in the Android market, because "the Android app market is a little bit more open," without the strict developer guidelines found in Apple's App Store. Do some due diligence before downloading apps. Make sure that you trust the developer and have taken the time to review some of comments.

TaintDroid is an Android tool that can identify apps that transmit private data and notify users that a third-party application is requesting private information. However, it's not an app that's offered through the Android Market. Instead, users have to manually compile and build the app using the framework provided by an app analysis company.

If You Still Get Hacked...

If you do everything right and still have your information stolen, what should you do? The damage can often be repaired simply by changing your password (to one much stronger) and sending a message via the network that was affected, explaining what happened. What if one of your devices gets stolen? Be sure that all of your mobile devices have a remote wipe or autowipe feature. For Apple's iPhone and iPad, there's Apple's MobileMe service. 

GoogleApps offers a solution for Android as well. If your device is lost or you know there's been a breach, you can quickly and remotely perform a factory reset from any computer connected to the Internet, wiping out all of the device's data and even locking it indefinitely.

[ComputerWorld]

Private Smartphones, Tablets Threaten Office Networks

From the moment the first telecommuter logged into his work e-mail account from his personal computer, the line between work and home began to blur.

Today, thanks to mobile devices such as smartphones and tablets, we can surf the Web, send and receive e-mail and modify work documents from virtually anywhere.

Most smartphones and tablets are purchased by consumers for personal use. But many — even those on a family wireless plan — will also be used for work purposes both inside and outside the office.

This home/work overlap of mobile devices has created three major problems for the security industry as a whole.

Corporate IT teams can too easily lose control of the devices. Legal frameworks find it hard to demarcate between personal and corporate use. And security developers haven’t caught up with the new software.

Out of control


Smartphones and tablets streamline the way we communicate today. Forget about phone calls and e-mail -- these new devices make it easier to use social media, which is the way an increasing number of people, especially young adults, “talk” to each other.

However, the budgets of small or medium-size businesses often won’t cover networked mobile devices for anyone below top management levels.

So people bring their own devices to work and put them on the office network --- and, in many cases, don’t alert the IT or security departments about it.

Without knowing who’s accessing the network, or how often, it is difficult for a network administrator to make sure security policies are met.

The added risk of mobile devices is that they are easily lost or stolen. If the smartphone or tablet isn’t locked with password protection, outsiders will have access to potentially sensitive data and company e-mail messages.

IT departments do have options to protect corporate data on personal phones, said James Lyne, senior technologist at England-based security company Sophos.

“Platforms such as [Microsoft] Exchange can give administrators visibility of the types of devices users are using to access key services,” he said. “Acceptable use policies should also clearly outline users’ responsibilities: which devices are allowed, what security practices must be adhered to and how to notify IT if a device is lost or is otherwise compromised.”

If organizations don’t want employees using personal devices for business uses, devices can be restricted to services based on managed corporate assets, such as corporate-compliance software.

Many enterprises, however, will consciously allow users to mix personal and professional business on their smartphones or tablets. In these scenarios, it's critical that a security baseline is met and enforced.

No legal basis


Legal departments have their own challenges to face. Corporations have jurisdiction over company-owned devices, no matter how and where they are used. But privately owned devices aren’t as easily supervised.

In November, National Public Radio reported about a woman whose personal smartphone had been wiped clean by her employer. The remote wipe, which deleted everything on her phone, was a mistake, but the case raised the question of whether a company should have that much access to a personal device.

For corporate legal departments, it’s not clear which activities on a smartphone or tablet count as private use and which don’t.

What should legal departments be concerned about, and how should those concerns be passed along to the employee?

Lyne said mobile devices should be covered by the same compliance regulations as laptops or conventional computers. Loss of work-related data on a personal device is not acceptable.

“That said, the expectations of security controls on mobile devices are also less developed in many countries’ legal frameworks,” Lyne added. “Enterprises should make sure employees understand their obligations to manage and protect the device, but also should be conscious of the risk of data loss to their businesses. Where possible, minimize the flow of sensitive data to these device types to reduce the risk of loss.”

Hard to keep up

Mobile platforms present a new set of challenges to security, said Lyne. First of all, their presence greatly expands the number of operating systems – Android, BlackBerry, Apple’s iOS, HP’s WebOS -- that need to be protected.

“Microsoft operating systems have long been the primary focus area for security investment,” Lyne explained. “The broader set of platforms being used requires not only more coverage from solutions, but fundamentally protecting each of these devices is quite different in implementation and policy. These platforms, without standards, could increase the cost notably.”

Second, the mobility of these gadgets itself is a challenge. Each device constantly moves in and out of the network, and it almost certainly will be used for a blend of work and personal matters.

These changes in user behavior challenge conventional security policies, and will have a significant impact on the behavior of security technologies.

“The industry should not fall into the trap of trying to protect mobile devices with an identical model to the traditional computer,” Lyne said. “While security issues undoubtedly exist on these devices and we all need to recognize the likelihood of greater focus on these device by attackers, the threat vectors and protection model is different platform to platform.”

The immediate priority for businesses will be to manage the basic compliance of each mobile device.
Enterprises should know which devices are being used and ensure that password security, encryption and patching are all up to scratch.

Compliance is the key starting position for those looking to secure their mobile devices. However, as the threat evolves, so, too, will product requirements.

[SecurityNewsDaily]

Rootcager Trojan found on the official Android market

Free Android applications bundled up with malware have spilled over into the official Android marketplace.

According to Symantec, the malware in question can root the phone, harvest data and open backdoors - similar to the recent Geimini Trojan spotted lurking on third-party Chinese Android app markets.

"The applications in question are popular free apps, bundled with malware, that have then been republished in the official marketplace under different application and publisher names," says researcher Joji Hamada.

Google has jumped into the fray and removed the applications from the market, but according to Symantec's sources somewhere between 50,000 and 200,000 downloads took place during the four days that the apps were available for download.

This new Trojan has been dubbed Rootcager because of the rageagainstthecage file included in the Android Package containing the affected apps.

Rageagainstthecage is a file that can also be used to legitimately root a phone in order for the users to gain administrative rights, but in this case it's used to allow the Trojan to do things like taking screenshots, harvesting IMEI and IMSI numbers and send them to remote sites, and drop a DownloadProvidersManager Android Package that will further execute downloads in the background.

For the full list of the potentially affected apps, go here. In you think you may have installed one of them on your device, check the installed apps against it or check the “running services“ settings on your phone for the DownloadManageService started by an application.

[NetSecurity]

More Android mobile malware surfaces in third-party app repositories

Several security vendors on Monday reported new mobile malware variants surfaced, targeting users of Google's Android mobile platform.

In addition to other more sophisticated features, the Android malware uses an old-school technique by including a feature that prompts a victim's smartphone to send costly text messages. The malware was hidden in altered versions of legitimate applications hosted on unregulated third-party Android marketplaces, according to researchers at Symantec Corp.

Symantec said the Android malware, Android.Pjapps, masquerades as a legitimate "Steamy Window" app, but the cybercriminals altered the original app, adding functionality that allows an attacker to build a botnet. Symantec said a malicious service installed with the application that periodically checks a command-and-control server to check and pull down new commands.

Symantec said the hidden malware was also coded to allow an attacker to "install applications, navigate to websites, add bookmarks to the user's browser, send text messages and block text message responses. It also sends sensitive user information back to the attacker."

Android.Pjapps is not the first malware to have botnet-like capabilities. In January, security researchers at mobile security firm Lookout Inc. warned of new Geinimimobile malware, which surfaced in China and also masqueraded in applications on unregulated third-party application repositories.

In addition, China-based NetQin Mobile warned of two new mobile spyware programs, called SW.SecurePhone and SW.Quieting. NetQin said the spyware is mainly distributed in the U.S. Both pieces of malware are hidden in altered applications. SW.SecurePhone was designed to run in the background and can monitor the phone and collect data to save on the SD card. SW.Qieting automatically forwards messages received to a monitoring phone without the user's awareness.

"The data, including messages, call log, location of the phone, recorded sounds around the phone and pictures in the phone, will then be uploaded to a remote server every 20 minutes," NetQin warned.

Mobile malware is increasing in intensity, said Denis Maslennikov, senior malware analyst on Kaspersky Lab's global research and analysis team. In a recent interview with SearchSecurity.com, Maslennikov warned that Malware coders were focusing on the increasing use of smartphones and would likely set their targets on Apple's iOS and Google's Android platforms, because of their rising popularity. While Nokia's popular Symbian OS still has an estimated 40% marketshare globally, many mobile malware writers are writing malicious programs using Java Micro Edition, a popular coding platform that can be supported by multiple platforms including Android.

"The main goal of cybercriminals is to target as many devices as possible, so that's why they choose [Java Micro Edition] which is cross-platform supported," Maslennikov said.
There is plenty of money that cybercriminals can make in with mobile malware, Maslennikov said. In Russia one cybercriminal group recently caused victim's about $1.2 million in damages using mobile malware, he said.

Security experts on Monday warned users of the risk of using unregulated third-party application repositories. It is much safer for users of any smartphone operating system to download legitimate applications from regulated marketplaces.

"Looking at the threat capabilities, Symantec believes it has been designed and may be used to peddle ad campaigns and to obtain benefits from the use of third-party premium rate services at users' expense," Symantec said.

In addition, security experts said users need to pay closer attention to access permissions being requested during installation and deny any requests by the application that seem excessive.          

[SearchSecurity]