Photo: Plann

Which apps are not secure?

The 20 most-blocked mobile apps Poot-debug(W100). apk. AndroidSystemTheme. Where's My Droid. Weather. Wild Crocodile. Star War. ggzzversion. Boyfriend Tracker. More items...

techbeacon.com - 20 most dangerous mobile apps: How to best mitigate the risk | TechBeacon

Is it true it only takes 4 minutes to fall in love?

The study involved a combination of four minutes of staring into each other's eyes, and 90 minutes of intimate conversation using pre-determined...

Last updated Dec 8, 2020

How do you build emotional intimacy with a man?

4 immediate ways to improve emotional intimacy Be strategically vulnerable to earn their trust. ... Give your partner daily affirmations and...

Last updated Apr 2, 2019

Do you really know who the “One” is? Your true Soulmate?

Promotion

Mobile apps can be a nightmare for IT. There are millions of them, and most were developed without any concern for security. Some IT organizations have tried to counter potential threats from mobile apps by blacklisting programs they deem risky, but that's not always effective. Here are the top pitfalls of blacklisting, and alternative approaches to controlling the chaos that can result when a company's employees are working on mobile devices connected to the company network.

The 20 most-blocked mobile apps

An analysis by Appthority of the blacklists of its enterprise customers is revealing. For example, here are the top 10 Android apps blackballed by enterprises:

Poot-debug(W100).apk

AndroidSystemTheme

Where's My Droid

Weather

Wild Crocodile

Star War

ggzzversion

Boyfriend Tracker

Chicken Puzzle

Device Alive

In its analysis, Appthority ranks risk on a scale of 1 to 10, with 1 being the lowest risk. Eight of the apps in the Android top 10 had a risk score of 9, primarily because they contained malware. The other two apps—Boyfriend Tracker and Chicken Puzzle—scored a 6 because of data issues or privacy concerns.

On the iOS side of things, these apps were blacklisted the most:

WhatsApp Messenger

Pokémon GO

WinZip Utilities

CamScanner Productivity

Plex

WeChat

eBay Kleinanzeigen

Netease News

Device Alive

The seven riskiest apps scored a 7. Their sins included sending SMS messages or sensitive data without encryption. Three programs—Pokémon GO, Plex, and Device Alive—scored a 6 because they did things such as access address books and cameras without permission and tracked a phone user's location.

Blacklisting's deficiencies

While these 20 apps were the most commonly blacklisted, there were plenty more in Appthority's list of 100 enterprise apps that were as risky or riskier to use. Many of those apps ask for permissions that can be a prelude to risky behavior—the ability to read and send text messages, for example, or access a phone's camera, microphone, and address book. Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, said the proof was in the permissions. "Users should avoid installing apps that require too many dangerous permissions. The more permissions an application has, the more risk it presents in the case that it's hacked."

—Leigh-Anne Galloway

The sheer volume of apps available to users can make blacklisting problematic. "Blacklisting apps has never had much success in stopping breaches in the PC world, and I don't see it as working in mobile either," said Georgia Weidman, CEO of Shevirah, a provider of tools for assessing and managing mobile device risk. "If you blacklist an app, a million more with those same issues will take their place. Taking a set of apps and blacklisting them isn't going to solve any particular problem."

—Georgia Weidman

What's more, one enterprise's risky app is another's anointed app. "WhatsApp is on the list of bad apps," Weidman noted, "but a lot of organizations use WhatsApp or a similar secure, encrypted messenger for corporate communication." We can't look at every application deeply enough to say yes or no definitively about whether its risky behavior is due to a sloppy developer or someone with malicious intent, she added.

What Zodiacs fall in love fast?

Sagittarius is likely to fall in love quickly. They may fall in love at least 4 times in their life. They find everything to be alright at the...

Last updated Sep 24, 2019

Do friendships last 7 years?

What he discovered was that only about 30 percent of our closest friends remain tried and true after seven years, and 48 percent remain in our...

Last updated Jul 11, 2018

Promotion

Shadow IT complicates security

Making matters worse, employees often use productivity apps without IT's knowledge. Referred to as shadow IT, this practice has become prevalent within the bring-your-own-device (BYOD) culture, where people use their personal devices and download apps without informing IT, explained Michela Menting, digital security research director at ABI Research. This is not always done maliciously by the employee, she said. Often they do this in good faith, to increase their productivity or facilitate their work in some way, she said. "They forget that by not telling IT, they can put their organization at risk."

—Michela Menting

By keeping IT in the dark, mobile users broaden the attack surface available to an organization's adversaries. "BYOD extends your corporate environment to your employees' homes, vehicles, neighborhoods—and then enables them to bring whatever they picked up into your environment," said Devon Kerr, principal threat researcher at Endgame, a maker of cybersecurity solutions for enterprises. "It is an inheritance model that is being taken advantage of by threat actors to gain a foothold in otherwise resistant organizations."

—Devon Kerr

One of the riskiest apps for an enterprise may not appear on any top 10 list at all: email. Email is risky for two reasons. Corporate credentials are needed to access a mailbox, and email is used to share a lot of sensitive corporate information.

Whitelisting apps can help

If emails or credentials are stored somewhere other than on a device or are accessible to a third party, in any way, the business is at significant risk, said Matt Hathaway, Senior Director of Product Marketing at Uptycs. "The most important action for IT staff to take around email apps is to evaluate the most common, whitelist those that are secure, and configure their email servers to decline authentication attempts from any apps which aren't on this whitelist," Hathaway said. For external programs, whitelisting should extend beyond email apps to all external mobile apps, added Positive Technologies' Galloway. "IT must also create rules" for the use of personal devices that can be used for work, she said. Another approach is to host all applications accessible to a user's phone. Then when employees attempt to access corporate resources, they can do so only through the hosted apps. That essentially makes the phone act like a remote desktop client. Daniel Kennedy, research director for information security and networking at 451 Research., said that in a true BYOD environment, IT's ability to control risky apps is limited. Enterprise mobility management or mobile device management tools provide part of the answer by allowing for capabilities on employee-owned devices, such as access revocation, conditional access, data wipe, additional authentication, and data separation, he said. "Blocking access to company data or blacklisting certain apps based on risk are other options."

What Zodiacs dont go together?

Aries folks probably shouldn't get involved with a Pisces or a Cancer. ... Tauruses and Leos might have a hard time. ... Scorpio is probably one of...

Last updated Aug 11, 2022

What makes a house more attractive?

Home staging includes adding new cushions and vases filled with fresh flowers. Ensure all the windows have either curtains or blinds, as naked...

Last updated Jun 17, 2018

Promotion

—Daniel Kennedy

Gautam Aggarwal, CMO and head of products at NSS Labs, a security testing, enterprise research, and threat analysis company, agreed that keeping a tight rein on access is a key to reducing mobile app risk. "The best approach to mitigate potential risks is to establish access-control policies that govern the use of mobile applications and, specifically, access to high-value applications and data on the network," he said. "Regardless of your organization’s size, maintaining visibility into the types of devices accessing applications on the network is crucial to maintaining a proper security posture."

—Gautam Aggarwal

Thwarting threats with SIEMs

That kind of visibility can be obtained through the use of security information and event management (SIEM) software. SIEMs collect information from multiple network sources and analyze that data for potential or existing threats. The tools monitor network activity and can generate alerts when suspicious activity is encountered, said Avast researcher Martin Hron. "When used properly, a SIEM can notably reduce the risk of an enterprise network being infiltrated by malicious mobile applications installed on employees' phones."

—Martin Hron

To fully address mobile threats, though, a SIEM may need additional help. For example, some tools can track security issues on mobile devices and make that information available to a SIEM through APIs. This allows the SIEM to centralize both device monitoring and incident response. SIEMs can help detect malicious activity from mobile apps if the company also uses an enterprise mobility management solution, which accumulates mobile device data, Positive Technologies' Galloway explained. "In those cases, a SIEM helps detect incidents such as theft of a device or confidential information."

Nothing's perfect

A word of warning for SIEM shoppers was voiced by Endgame's Kerr: "A SIEM is only as good as the human beings who are monitoring it and the procedures those human beings developed. If your organization is already struggling to monitor social media, monitoring mobile devices is going to be exceptionally challenging." "Mobile device management, enterprise mobility management, mobile antivirus—pick your poison—they all provide value in controlling mobile apps," added Shevirah's Weidman. "But just as we still see PC malware, none of these products are going to 100% protect you. "You have to accept that potentially malicious apps are going to get in your enterprise environment, so your goal should be to make sure that they do as little as possible to harm you when they do."