Zimperium , a mobile security company , has published its annual report on mobile threats for 2021 and predictions for 2022
According to the report, in 2021, the focus of malicious actors on mobile platforms was increased compared to previous years. This is largely due to remote working and the subsequent wider use of mobile devices and platforms.
Last year, we saw higher rates of mobile malware distribution, phishing and smishing attacks, and more efforts to discover and exploit zero-day exploits.
See also: QNAP: Serious Linux bug affects most NAS devices
Zero-day vulnerabilities are those that are publicly disclosed or actively exploited without any security updates available from the vendor or application developers. Promptly fixing these bugs is crucial for the security of users and their systems, and companies are usually quick to issue security updates as soon as the bugs are discovered.
However, according to data from Zimperium and based on a survey conducted for the report, only about 42% of people working in BYOD (bring your own device) environments applied high-priority updates/fixes within two days of their release.
About a third took up to a week, while a significant 20% had not protected mobile devices for up to two weeks after updates were released.
Mobile threats by region
As mentioned above, in 2021, cybercriminals focused more on remote workforces or on-premise mobile devices, leading to increased network scans and man-in-the-middle (MiTM) attacks. These attacks aim to steal sensitive information that can be used in more significant future attacks against corporate networks.
The most prevalent threats for each region of the world in 2021 were the following:
- Asia/Pacific: malicious websites, malware, MiTM
- Africa: malware
- Europe: malware, malicious local scans, MiTM
- North America: malware, MiTM
- South America: malware, malicious local scans
Android vs iOS
The most popular mobile operating systems are Android and iOS.
When it comes to security in 2021, Android appears to have been generally more vulnerable than iOS. However, iOS appears to have faced more serious vulnerabilities.
See also: How are cyberattacks dealt with in data centers?
If we consider volume, 574 vulnerabilities were discovered on Android in 2021, a notable decrease from 859 in 2020. 79% of the vulnerabilities could be easily exploited by attackers.
Of the 574 Android flaws, 135 (23%) had a CVSS score higher than 7.2, while 18 were rated “critical.”.
In iOS, security researchers found 357 new vulnerabilities, but only 24% of them are considered low-complexity bugs (so most of the bugs were not easy for criminals to exploit). In addition, only 63 (17%) had a CVSS score higher than 7.2, but 45 of the bugs were considered critical. This means that their exploitation could lead to a serious breach and problems.
Therefore, exploiting iOS bugs was more difficult but if successful, the profit for criminals was greater (compared to an attack on Android).
Zimperium also analyzed the most popular apps in the finance, healthcare, retail, and lifestyle categories on the Google Play Store and Apple App Store . The conclusion was that apps can pose a significant risk to mobile devices.
More specifically, 80% of financial apps for Android use vulnerable encryption, while 82% of retail apps on iOS have no code protection at all.
Mobile security
According to researchers, mobile threats and attacks are expected to continue in 2022, as mobile devices continue to play an important role in daily life and work.
Even with chip shortages causing supply issues, smartphone shipments are expected to be up. Unfortunately, many of these devices will be the weakest link in the security chain of large organizations and will be targeted by hackers.
See also: Denso hacked: Toyota supplier falls victim to cyberattack
On the other hand, compared to previous years, Google (Android) and Apple (iOS) have improved security and their mobile systems are strong enough to block easy exploits of bugs.
Criminals are often forced to discover and patch multiple bugs, so these attacks become much more difficult to carry out.
It's too early to know what else 2022 will bring. The only thing certain is that attacks on mobile devices will continue.
Source: Bleeping Computer
