Excerpted From Technews Daily
There’s no doubt that we users are our own worst enemies when it comes to security on smartphones and tablets. We often don’t password-protect our devices. We download apps without checking them for malware. We jailbreak our iPhones and root our Android phones. We don’t use anti-virus or anti-malware software. We don’t watch where we use our phones. We carelessly leave them lying around. And so on.
That said, every user can change his behavior and improve security up to a point. But there are a number of security threats to mobile devices that can’t be controlled or sometimes easily detected by the user.
"Some of the main concerns for smartphone and tablet users would be vulnerabilities that might exist in certain parts of the operating system, like browsers or Flash, that can be exploited by going to a certain URL or opening a certain file attachments," said Matthew Dieckman, product line manager for secure remote access at San Jose, Calif.-based SonicWALL.
"In this case, the user may be unaware if their tablet or smartphone has been compromised or not." Vulnerabilities in operating systems are some of the biggest hidden security threats to mobile devices.
"There have also been several vulnerabilities discovered in smartphone operating systems," said Jason Hong, chief technology officer and co-founder of Wombat Security Technologies in Pittsburgh. "For example, in late 2011, some researchers discovered some permission escalation bugs, which would let apps be able to circumvent Android’s protection mechanisms and essentially do anything."
"A more subtle vulnerability is with the accelerometer built into all modern smartphones," Hong continued. "Accelerometer data is generally not considered sensitive data. However, researchers have recently developed algorithms that can infer what you are typing on soft keyboards, making it easier to guess one’s passwords."
If someone knows your password, he can exploit another hidden threat and remotely install apps onto your phone. "Android smartphones come with remote install functionality," Hong said. "This functionality is useful if your smartphone is tolen, allowing you to add an app to locate your phone after the fact.
"However, remote install is also a potential vulnerability," he added. "If bad guys ever get access to your Google account, they can also access your smartphone meaning that they can install whatever apps they want on your phone, even if hey don’t have physical access to it."
Another security threat found on your smartphone, but not on your PC, is the user’s inability to check Web links before licking on them.
we’ve been advised for years to always double-check a link’s URL, or Web address, by placing the cursor over the hyperlink. If the actual URL doesn’t match the destination you think you are heading to, you shouldn’t click on anything.
With smartphones, you usually can’t read the URL until you click the link and go through to the destination page. That eaves you open to drive-by downloads and other browser-based threats.
While it certainly isn’t convenient to do so, it’s safer to type the actual URL into the browser address bar yourself, vent if you feel you can trust the link or the sender.
-Bryan
