Watch out for FLEECEWARE - Mobile apps that can still charge users even after users uninstall the app from their devices. Researchers have identified 32 iOS apps (see table at the end of this article) that charge up to $30/month or $9/week for simple features that are usually available for free. Some of these fees seem small, but they can add up to between $360 and $468 per year.

https://www.zdnet.com/article/fleeceware-apps-discovered-on-the-ios-app-store/

You might not be losing weight but, your wallet might become light weight - “Fitness Balance app” and “Calories Tracker app” appears to trick unsuspecting users into approving payments of over US $100.

Upon start-up of the apps, users are requested to scan their fingerprint in order to “view their personalized calorie tracker and diet recommendations.”

However, quick as a flash the app pops-up an in-app payment dialog asking for you to approve a payment of US $99, US $119.99, €139.99

https://www.grahamcluley.com/fitness-tracking-apps-caught-misusing-touch-id-to-steal-money-from-iphone-users/

Mobile Apps that control IoT - 80% of the tested apps contained vulnerabilities, with an average of 15 flaws discovered per application.

15% of the vulnerabilities discovered, said the researchers, could lead to a man-in-the-middle (MITM) attack, where a hacker could not only intercept communications sent between an IoT device and its smartphone app – but even potentially send it rogue commands allowing a criminal to hijack control.

https://www.bitdefender.com/box/blog/iot-news/many-iot-smartphone-apps-making-life-easy-online-criminals/

Android keyboard app - It it a Keyboard or a Keylogger?

First, it collected a user's Google email account as well as other important device information and uploaded all that data to its servers.

Second, it can download and execute code from a remote server in violation of its policy. Those snippets of code include plugins marked as adware or potentially unwanted programs (PUPs) by multiple anti-virus engines.

For More:
https://www.grahamcluley.com/go-keyboard-app-data-collection/

PayPal users should read this

The scary part is the vulnerability can allow even a 2-factor authentication bypass.

Moral of the story: If the building has problems in the foundation then, no matter what you add, you can still have issues.

From the article:

he researcher says the applications are plagued by a vulnerability that can be exploited to access such accounts through repeated login attempts that leverage valid session cookies

The bug bounty hunter says the method can be used to bypass not only the identity verification mechanism, but also the 2FA system

The issue was reported to PayPal in April, but it remains unfixed. According to Vulnerability Lab, the company confirmed the existence of the flaw, but downplayed its impact.

This is not the first time PayPal and Vulnerability Lab have argued over the impact of a mobile API flaw. In October 2014, the German security firm publicly disclosed a similar security bypass issue after PayPal refused to acknowledge its existence for more than a year. Ultimately, the payment processor confirmed the vulnerability, patched it, and promised to reward the researchers.

For more info:

http://www.securityweek.com/paypal-mobile-apps-plagued-authentication-flaw-researcher

At least half of the 50 most popular Android mobile apps have inherited security vulnerabilities

through the reckless re-use of software libraries.

As long as we have

• Compressed schedules
• Functionality trumping security
• Reckless programmers

The code will always be insecure

(From the article)

More concerning is when “developers act intentionally,” Jarva said.

“Some people might have been providing a vulnerability on purpose in order to do something nasty” once the code has been distributed.

Who are they working with? Do they have sideline jobs somewhere else? The developers might be getting their dollars from ad networks," Jarva said.

One in ten apps send either the user’s device ID (IMEI code) or location data to a third party, and one even sends the user’s mobile phone number. One in ten applications connected to more than two ad networks.

The study found that over 30 percent of the apps transmit private data in plain text and plenty more are not encrypting the transfer of this data to best practice.

“The issues are invisible to users,” Jarva said. “A lot of things are happening behind the scenes, it only afterwards they know what has been done.”

The link below has more information:-

http://www.itnews.com.au/News/390365,popular-android-apps-inherit-bugs-from-recycled-code.aspx

BYOD - You thought you knew it all, how about 7.1 Billion mobile subscription (did you expect this)

It is normal to expect a disconnect between what we know and what is real.

Sometimes , there is a big disconnect.



Follow this link for additional details and get ready to get surprised:

http://www.darkreading.com/cloud/infographic-with-byod-mobile-is-the-new-desktop/a/d-id/1297436?image_number=1

How many FAKE mobile apps are floating around - Almost a million (According to Trend)

Some are highly successful, here is a sample:
Scammers charged $3.99 for the fake app, which promised to prevent harmful apps from being installed. It was removed by Google after a few days, but not before it fooled thousands of users and even became a "top new paid app" in the Play Store. Trend said it was "perplexing" how the app achieved "top" status


The link below has more information:-
http://www.computerworld.com/s/article/9249779/Almost_a_million_fake_apps_are_targeting_your_phone

New kid in the block - SANDROID - Android Botnet

Targets Android smartphone users who bank at financial institutions in the Middle East.

Infected more than 2,700 phones, and has intercepted at least 28,000 text messages.


According to the article:- 

bundled with Android apps made to look like mobile two-factor authentication modules for various banks, including Riyad Bank, SAAB (formerly the Saudi British Bank), AlAhliOnline (National Commercial Bank), Al Rajhi Bank, and Arab National Bank.



The link below has more information:-
http://krebsonsecurity.com/2014/04/android-botnet-targets-middle-east-banks/

HP introduces "SmartShopper" - Should it be called "SmartStalker"

We are used to "Targeted Ads" in emails, now they can follow us and continue to nag us via iPhone.

According to the article:- 

Hewlett Packard has unveiled a new mobile app dubbed SmartShopper  has the ability to send location-based smartphone offers to customer’s iPhones in real time

Dominic Wilde, a VP within HP’s networking division, told Techworld in California last week: “It has very accurate location capabilities so that we can identify a device down to 2m, which is 60 percent better than anything else on the market today. In best case, even down to 1m.”

The link below has more information:-

http://news.techworld.com/security/3509135/hp-unveils-creepy-app-that-stalks-people-as-they-shop/

Mobile Apps - Why are they considered to be of high risk?

The first thing that pops to our head is that they are on mobile devices.

This article provides more insight and suggestions for developers.

According to the article:- 

On Android, mobile apps are generally coded using Java, and on iOS in Objective C. Both of these languages are capable of significant processing functionality. 

As a result, mobile apps often perform more functions than just presentation-layer aesthetics. That's where the risks can hide.

Attackers can and do examine apps by reverse-engineering them and looking for exploitable defects. 

Defects essentially fall into two categories: 

1. Implementation bugs 
2. Design flaws.

Bugs make up coding mistakes such as using mutable SQL queries in the form of dynamically built query strings that can be injected with poisonous data. They're also generally quite easy to remediate,

Design flaws can be far more heinous and are usually substantially more difficult to remediate. Flaws can be quite costly to fix.

Whenever we build a mobile app and place that app out in an app store or market, we're giving away some clues about our software

So what are security-minded software engineers to do?

1. Don't store things on the client. Unless absolutely essential. 
2. Don't store anything remotely sensitive on the client. 
3. If you must store something, use a container such as iOS's keychain. It's far from perfect, but it's still worlds better than storing in plain text.
4. Don't put security controls on the client. All security (and other operational) decisions must be made on the server

The link below has more information:-

http://www.computerworld.com/s/article/9247279/Kenneth_van_Wyk_Where_mobile_apps_go_wrong

Security,Smart-Devices and stretching Trust boundary - Are we losing control ?

We all know people are the weakest link and with smart devices it is easier to exploit.

This article discusses how Trust gets stretched and affects the security when it comes to Mobile Devices.

(Remember people  can also connect their mobile devices to  any WiFi networks increasing the risk.

Add IoT and it becomes a lot more fun)

Quote from the article:

“A process without input is a miracle, while one without output is a black hole. Either you’re missing something, or have mistaken a process for people, who are allowed to be black holes or miracles”

According to the article:- 

As a baseline, the company itself took the responsibility for trusting the OS to have provided a safe sandbox for all apps to play in, and the phone vendor to have only installed trustworthy apps as part of their customization. So our trust boundary is already extended beyond our company resources to the phone service provider, the phone manufacturer, the phone vendor, the phone OS developer and the security application company. All which we may have to just accept but should be aware of.

But our new employee has, unknown to the company, extended our trust boundary is several ways:

• Adding Gmail account 
• Adding games
• Adding calendar app
• Lastly the social media apps

I think that ultimately, none of this is all that egregious and should be a normal use case for IT distributing devices, but add this up over a 500 person company and your trust boundary grows far beyond your ability to manage it, making it effectively infinite. 

The links below has more information:-

http://www.tripwire.com/state-of-security/security-awareness/ever-expanding-trust-boundary-infinity-beyond/

Fake Tor Browser in AppStore - Apple does not remove it even after multiple requests from Tor team

Long live bureaucracy.

Brings back to my Mantra " All Policies and Procedures should have provisions for exception"

This is the 2nd incident. (The previous one was related to inheriting an Apple Device )

According to the Article:

A complaint was filed with Apple on Dec. 26 and the company reportedly responded on Jan. 3 saying it will give a chance to the app's developer to defend it

More than two months later, the Tor Browser app created by a developer named Ronen is available still in the App Store. It was last updated on Nov. 6 and only one of the three customer reviews so far includes a complaint about how ads are being displayed

The links below has additional information:

http://www.cio.com/article/750054/Fake_Tor_App_has_Been_Sitting_in_Apple_39_s_App_Store_for_Months_Tor_Project_Says

Layered Security - Solution that is better that static password or swiping.

Not a fool proof solution (what is ?) but,  adds a small layer of additional security


According to the article:- 

It’s a 6x6 grid of constantly changing numbers that you can load on your phone or desktop. The user only needs to remember their unique pattern of six boxes and enter the numbers that appear in their pattern. Meanwhile, the numerical password changes each time a user logs in.



The links below has additional information:

http://news.yahoo.com/blogs/this-could-be-big-abc-news/password-won-t-forget-always-changes-174223907.html

Those who prefer Mobile Banking might want to read this.

Mobile malware designed to steal bankcard information and funnel money from bank accounts increased by a factor of nearly 20 times in the past year

SNIPPETS from the Article:-

Because mobile banking provides the easiest way for criminals to steal money, it provides the largest target for criminals

According to Kaspersky Labs, the countries with the highest number of unique attacked users are Russia (40%), India (8%), Vietnam (4%), Ukraine (4%) and the UK (3%). However, mobile malware targeting banking specifically is expected to grow in other countries this year.

The links below has more information:

https://blog.cyveillance.com/malware/mobile-malware-banking-trojans-that-steal-your-money

A mobile app designed for RSA conference 2014 attendees has half a dozen security issues.

The RSA Conference 2014 application downloads a SQLite DB [database] file that is used to populate the visual portions of the app (such as schedules and speaker information) but, for some bizarre reason, it also contains information of every registered user of the application -- including their name, surname, title, employer, and nationality. 

The link below has more details:

http://www.cio.com/article/748962/RSA_Conference_Mobile_App_has_Vulnerabilities_Researchers_Say