Mobile App Security Threats To Plan For

Posted by Andreas Christodoulou

Description :

Mobile apps continue to grow with technology. There are countless ways that apps make our lives easier—whether it be tracking our fitness progress, or improving our online shopping experience. The rapid growth in app usage around the world means that, a lot of people don’t have experience on how to protect themselves against a possible security attack. 

In 2018, 71% of fraud transactions came from mobile apps and mobile browsers. In comparison, 29% came from people using the web, which is a 16% increase year over year. Additionally, one out of every 36 mobile devices has high-risk apps installed. 

Savvy hackers don’t rely on one method to gain access to you and your users’ private data. That’s why, you must anticipate their attacks ahead of time, and design your app so that your users won’t have to worry about whether their data will be compromised. In return, this will signal to others that the business or service you provide through your app, is not only high-quality but also safe. 

Mobile App Security Threats

If a hacker can’t gain access to your precious passwords one way, don’t celebrate too early. They have an arsenal of other weapons they have at their disposal. And after they do exploit your personal information, a lot of the times you won’t even notice it until after the damage has been done. 

Here are a handful of ways that hackers will try to catch you off guard:

No Multifactor Authentication 

You’re especially vulnerable to this attack if you’re the kind of person that uses the same password across all your online accounts and apps. If a hacker is able to uncover it from one of your accounts, they will no doubt gain access to related apps you use. 

Adding an extra step to “authenticate” your account doesn’t always mean you must remember two passwords. It can also mean that you must answer a personal question, or access your account using an SMS confirmation code. 

No Proper Encryption 

Like changing the combination of a security lock, encryption puts data into an indecipherable code that can only be viewed after implementing a secure password. But everyone makes mistakes, and sometimes a developer can design an encryption code that is too easy to crack. After a hacker gains access, they can clear the encryption so that your private data is available in plain sight. 

Reverse Engineering

If your code is too easy to figure out, a hacker can take their hacking a step further and learn exactly how your app functions. They’ll know your code inside and out. And if they have a plethora of experience to draw from, they might even know more about your app than you do. 

This means a hacker can not only expose encryption, but they can modify the source code—using their knowledge to build a fake app designed to look like yours. A hacker can use this fake app to inject malware or worse to your misled users. 

Learn From Others

Mobile app hacks result in time-consuming (and expensive) data breaches. Plus, you lose the trust of your potential users as they don’t want to lose their personal data to hackers. 

Unfortunately, every day there are new cases of hackers taking advantage of a growing app or business. Learn from the mistakes of others so you can understand how to shield yourself against a potential attack. 

TimeHop

TimeHop was the victim of an unauthorized attack that led to a privacy breach of over 21 million users. The hack occurred in December of 2017, but it wasn’t uncovered until July 4, 2018. The attack not only led to the exploitation of TimeHop’s users, but it also led to an app crash.

And what was the main reasoning for the attack? TimeHop failed to use multifactor authentication. As a result, the hacker used the security information found from a TimeHop employee, to access the cloud of the company. 

Fortnite 

Fornite originally released its beta version of the game using an invitation-only environment. Hackers saw this as an opportunity to produce fraudulent links to fake clone versions of the game. 

These versions of the game misled fans, because the hackers cleverly used reverse engineering to include the same loading screens, music, and images the real version used. 

It doesn’t matter if the app you use provides a business, service, or is a video game. If the code is simple to break, hackers will take advantage. 

What Can You Do?

Prevent Reverse Engineering With Obfuscation

Reverse Engineering occurs (like the Fortnite example) because of faulty code. But obfuscation and minification make the code less readable—meaning hackers won’t be able to study how your app functions to build their own. 

Validate Inputs

Remember, it’s dangerous to rely on the same password for all the apps and online services you use. A stranger can access your accounts just by knowing a single password, but when you add more validation inputs to follow, you add an additional layer of app security. 

More Tips

Who’s most vulnerable to attack? In 2018, apps in the tools and lifestyle categories made up a combined 54% of malicious mobile apps. But regardless of which category your app resides in, you can’t take your app security lightly.

Remember, some of the top ways hackers gain access to your app is because of a lack of multifactor authentication or lack of encryption practices. But staying on top of these two aspects leads to a safe and trustworthy app for your users. 

Implementing the right security protocols for your app requires intensive collaboration between your design and development team. And it doesn’t stop there, you must envision yourself as if you were in your hacker’s shoes. What other ways would you try to hack your app? If you plan several steps ahead, you can safeguard your app and focus on the success of your business. 

Learn more about the cases you can learn from, as well as how to make sure you’re doing multi-factor authentication or encryption the right way, by reading this infographic from CleverTap.

Source: CleverTap

READ ALSO: How to Protect Your Company’s Email Against Cyberattack

Keep reading my friends! 💗

*by andreascy*

How to Protect Your Company’s Email Against Cyberattack

Posted by Andreas Christodoulou

Description :

Hello folks and hope you had a restful holiday. At the dawn of the New Year, we'd like to wish you all a prosperous 2019, with personal and family fulfillment! We look forward to being your companion all year round. 😎👍

While Hollywood may portray hacking as a complicated endeavor which requires sophisticated technical expertise and endless nights spent staring at a computer, the truth is that hackers rely on a variety of methods, some of which are as simple as sending company employees an email pretending to be a reputable source. In fact, taking advantage of security loopholes among your company’s employees is one of the most reliable and fastest ways for malicious parties to access your company’s sensitive data. 

Often times, hackers or other criminals can simply send fake emails – also called “spoofed” emails – purporting to be from a reputable source, which can gain the attention of company employees who then surrender data or even money. Other times, hackers can gain access to your corporate email lists and send out emails to your clients and vendors requesting money. 

Hackers can even pretend to be the CEO and contact employees of your organization with demands such as emergency payments. Read on to learn more about the many different forms of Business Email Compromise, its harmful effects, and how to prevent it from happening within your company.

What is Business Email Compromise?

Business email compromise, refers to a type of cybersecurity infiltration that can occur in a company or business. In a business email compromise, which is also called BEC, malicious parties such as hackers or criminal organizations typically target high-level employees of an organization, such as corporate executives. Hackers may send emails to the executives, in a practice known as phishing. 

Phishing is a fraudulent form of email activity, in which hackers send emails pretending to be reputable companies to obtain information such as passwords, credit card numbers, and even financial payments. In BEC, high-level corporate executives are strategically targeted so that hackers can obtain confidential information and payments from the executives. This can pose significant risks to a company’s operations, both in terms of data loss and financially.

How does a typical email cyberattack work? There are four types of BEC scams which we will discuss in the next section.

Four Types of Email-Based Cyberattacks

There are several types of BEC scams. Hackers can pretend to be an employee in your organization to obtain information from your real employees, or they may be able to access sensitive information, such as a list of email contacts, to request payments from people with whom your company may work. 

Two types of BEC which involve the hackers pretending to be a reputable source are CEO fraud and attorney impersonation. In CEO fraud, the malicious parties pretend to be an executive and contact finance or the human resources department of a company, demanding an emergency payment. Hackers can also pretend to be a lawyer or an employee from a law firm to obtain access to sensitive data – this is known as “attorney impersonation.” 

Other types of BEC scams take advantage of employees’ poor data security practices rather than purporting to be high-profile members of your company. In account compromise, a high-level exec’s email is hacked, and the email address is used by hackers to request payments from clients listed in the executive’s email contacts. Hackers can also steal other types of data, and even steal data from company employees. Data theft can occur in which hackers obtain personally identifiable information (also called PII) from the human resources department, which can be used to plot further cyberattacks.

While these attacks may seem different, the common thread that unites all of them is that they result from poor cybersecurity and safety practices among all levels of employees within an organization. High-level corporate executives are prime targets for hackers because of their stature in the organization and access to confidential data. However, entry-level employees who are poorly trained in email security best practices can also risk clicking on links in emails sent by hackers and unknowingly sending malicious parties your company’s sensitive data, or even their own personal information.

Companies who do not train their employees on cybersecurity best practices, therefore, risk exposing sensitive corporate data, which can not only hurt the business’ bottom line and potentially leak data to competitors, but can cost companies thousands, and even millions, of dollars as they seek to institute damage control. The best way to avoid dealing with the fallout of a BEC, is to be prepared and train employees across your organization – from entry-level employees, to human resources, to high-level executives -- in best practices for maximum email security.

How Can I Prevent Business Email Compromise in My Organization?

The best way to prevent BEC in your company is to utilize state-of-the-art security practices and train employees on email best practices. Make employees aware of the dangers of email phishing and impersonation scams. Remind your employees – whether they are entry-level or at the top of the corporate food chain – that they should never open emails from people that they do not recognize, and should certainly never click on links in emails from unknown senders, due to the fact that such emails can be phishing attempts.

Your information technology staff, can also institute several security practices which make it more difficult for hackers to gain access to your information in general, even in the event of a data breach. Emails should be sent over an encrypted server, so that anyone who can access your internet network cannot read the information being sent over the network. Another important cybersecurity practice, that is now utilized in most secure servers is two-factor authentication, which requires users to input a passcode sent to their email or mobile device to gain access to a website or online service. Two-factor authentication on company email accounts, can make it more difficult for hackers to gain access to company emails. 

Finally, minimize your electronic “paper trail” to make it more difficult for hackers to gain employees’ personal information. Financial information such as W-2 forms and tax forms should also be delivered to your human resources department in person to avoid having sensitive personal information being leaked to hackers. Finally, limit the number of employees who are authorized to disperse company funds, and make sure to set alerts and limit the number of withdrawals from this fund.

Source: Panda Security

Interested in learning more about how to protect your company against email compromise? Panda Security is a Spanish company that specializes in the development of high-tech products to help internet users navigate the web more safely and securely. Head over to WatchGuard’s blog for more information on business email compromise, including a helpful infographic and warning signs to look for in an email to determine whether or not it is compromised. By educating your company’s employees about the dangers of BEC, you can help stop these cyberattacks and improve corporate security.

If you found this article of interest, we'd love to hear what you think!

*by andreascy*

Three Ways to Protect Your Students From the Dangers of Technology

Posted by Andreas Christodoulou

Description :

Kids today live in a world where you cannot escape technology. The internet is all around you, from vehicles that use technology to park themselves to home thermostats that can be controlled half way around the world using a smartphone. 

Because the internet is such a beneficial part of our lives, kids have a hard time understanding the drawbacks behind it. It can be a challenge trying to get children to understand the concept of social media etiquette, online privacy, viruses, and phishing schemes. 

Unfortunately, these are real problems that surround the internet. You can’t rely on their parents to educate them about tech security because you have no idea how much experience and knowledge they have of it. 

As a teacher, it is important that you inform your students about the dangers of the internet and how to protect themselves from cyber criminals. This may include a combination protective measures, like using a flash key encryption device, speaking up when they see something strange, or understanding the long-term effects of posting online.

It Can Last Forever

It can be difficult for children to understand that whatever they put online could follow them for the rest of their lives. The last thing they are thinking about is how it can affect their future. It is important that you explain to them the repercussions of posting things on the internet that will haunt them later in life. If it is not something they want everyone to see, then they need to think twice about posting it online.

Express Openness

For many kids, the thought of having to tell an adult about something bad they’ve seen on the internet is scary. They may have fears that they will get in trouble if the tell the adult what they have witnessed. Ease the kids' concerns and explain how talking to an adult is acceptable. Whether they are contacted on their phone, tablet, or computer it is the same as being contacted out in public by a stranger. Encourage kids to speak with adults if they encounter anything odd while online.

Stay Protective

Many technological devices require a password just to sign on. While a password is important, children must understand the need to keep it secretive. Should the password get into the wrong hands, there is no telling what thieves can attain once they get access to a device. 

Additionally, flash drives can be a great way to transport programs and files to school and home. Unfortunately, kids sometimes struggle with keeping up with these types of things. An encrypted flash drive will help secure your information with an added wall of security in case it ever gets in the wrong hands.

Conclusion

These days you can never be too careful about protecting your information. With kids having so much access to the internet, it is a huge concern that their privacy may be compromised. The best way to combat this is by talking to kids about the dangers that lurk with technology. 

Because many parents may be ignorant about some of those dangers, it is crucial that teachers make it a point to educate students involving security issues surrounding technology. Using examples, offering additional firewalls like encrypted flash drives, and urging your students to discuss what they view is just a few of the ways you can help them understand how important security is when using any type of technology.

BE SURE TO READ: The Evolution of Social Platforms and Their Influence on Daily Life

Like the article? Share it around!

*by andreascy*

How to Spot a Phishing Email

Posted by Andreas Christodoulou

Description :

Contrary to popular belief, it’s not just Gen X’ers and Millennials who are plugged in to today’s Internet-driven technologies. Baby Boomers – born between the late 1940s and mid-1960s – represent more than a third of all Internet users, according to a Nielsen study. 

And although boomers have become pretty savvy when it comes to their Internet use, they risk falling victim to various identity theft scams. Below are a few fresh and informative tips that, as a savvy boomer, you can follow to keep your yourself and your identity safe. 

Spotting Red Flags 

According to the Bureau of Justice Statistics, more than 16.6 million people in the U.S. found themselves the victim of at least one identity theft incident. Many of these incidents come as the result of phishing, the act of sending fake emails or instant messages aimed at convincing users to submit private information, such as bank account and credit card numbers. With phishing on the rise, it’s more important than ever to protect yourself properly from emerging threats. Here are a few red flags that boomers should look out for as they check their emails: 

The email and its links feature a misleading domain name – Most boomers might not notice a slightly tweaked URL in the sender’s email address or in any of the links within the email. For instance, a phisher may try to make part of their domain name appear as close to the official version as possible (e.g. Microsoft.baddomain.com vs. microsoft.com). Some phishing attempts use a redirecting URL on top of a seemingly legit link as a cover. In most cases, simply hovering over the link can reveal the URL’s true destination. 

The message contains threats to your account status – Many phishing attempts feature urgent messages that not only tell you that your account is in jeopardy, but threaten suspension or deletion unless it’s confirmed or verified with your personal or account information. Another phishing tactic involves a fake email warning of a recent unauthorized access attempt, with a request to validate the account using your personal information. 

Legitimate banks, government agencies and other institutions won’t threaten account closure over ID verification, nor will they require you enter your name, account number, password and Social Security number via email. If an email requests two forms of ID or any other information that could possibly compromise your identity, chances are it’s a phishing attempt. 

The message comes from someone you haven’t done business with before – If you receive an official sounding e-mail about an account, but you’ve never done business with that company, chances are it's a phishing attempt. 

Trust Your Gut 

If something tells you that an e-mail is potentially suspicious, go with your gut feeling. It’s better to be on the safe side than fall victim to identity theft. When in doubt, simply delete the message. 

As On Guard Online’s phishing guide notes, there are several other steps you can take to protect yourself from identity theft. In addition to reviewing credit card statements for unauthorized charges, you can also forward phishing emails to several organizations dedicated fighting phishing. These organizations include the Anti-Phishing Working Group and the Federal Trade Commission.

STAY INFORMED: Hackers Can Wirelessly Read Your Credit Cards Through Clothes And Wallets

Hope you find this post helpful! Till next time my friends. 😉💪

*by andreascy*