Smart phones and smart devices feature application stores (‘app stores’), which allow users to download applications and content. Most users, particularly on mobile platforms, download apps via these app stores. The COVID-19 pandemic meant only more demand for apps, as more people work, shop, and stay in touch online.
Since there is a great variety of devices (and supporting app stores), there are disparate, complex security issues that that can expose consumers and enterprises to online threats. Hence a report by the UK official National Cyber Security Centre (NCSC), to inform the UK’s Department for Digital, Culture, Media & Sport’s (DCMS) review on current threats associated with app stores. The document summarises the risks associated with the use of official and third party app stores. It includes links to detailed guidance that describe how to mitigate the main threats.
You can freely read the report at the NCSC website: https://www.ncsc.gov.uk/report/threat-report-on-application-stores.
It says that app stores across all devices share the same threat profile, and cyber criminals (and other attackers) seek to take advantage of weaknesses within the vetting processes of these stores to infect users with malware for financial or privacy impacting outcomes. While all app stores share the same threat profile, mobile app stores are the most commonly targeted due to the sheer number of smartphone users, and the wealth of data stored on phones. Users of third party mobile app stores are particularly vulnerable, due to their lack of robust vetting processes. App store operators that adopt the Code of Practice outlined in the DCMS’s report ‘Call for Views on App Store Security and Privacy Interventions’ (including through further development of technical solutions) will reduce the likelihood of malicious apps getting through vetting processes.
Comments
John Davis, Director UK & Ireland, SANS Institute, EMEA says: “In the UK a staggering nine in ten (87pc) own a smartphone according to Ipsos MORI. The prevalence of smart technology has helped our lives in so many ways, but it also presents a fresh set of opportunities for cyber criminals to target phones and harvest rich resources of important data.
“To minimise risks of using infected systems, smartphone users should download mobile apps from the Apple App Store or Google Play. Cyber criminals have breached these app stores in the past, but they are generally significantly more secure than third-party vendors accessible via jailbreaks, where a distinct lack of robust vetting processes means that these platforms are especially vulnerable to threat actors.
“Dangers on mobiles include spyware, banking malware, and malware used for toll fraud, so users will also do well to remember that standard digital hygiene and wariness will go a long way in protecting their data. Configure your system to automatically update mobile apps and check privacy settings. By scrutinising enabled permissions and app reviews, users can be more discerning and secure online.”
And Dr Kiri Addison, Communications Counter Deception Technical Specialist at Mimecast, says: “Considering how many users are still unaware of the various risks involved in downloading apps, it is encouraging to see that the NCSC is now reporting on the potential threats posed by malicious apps. In the past, many large platforms have struggled with uncovering and removing malicious apps. When users trust their devices with sensitive information, it becomes vital for app stores to ensure that they adequately protect it, know exactly where it is stored, and who is able to access it.
“Since attacks like this are becoming more common now, it really highlights the need for organisations to take data protection seriously. This means ensuring that the app store is free from vulnerabilities and malicious apps. End users also need to consider whether or not they are comfortable with sharing personal data and the level of access they grant these apps before downloading them. If they do download them, they should make sure they use unique passwords where required.”
