Why Phishing is Different on Mobile Aaron Cockerill Gartner Security & Risk Management Summit 2018 � 1
The world has changed
The corporate data center is in the cloud
Starbucks is the new corporate Wi-Fi
Employees have all gone mobile
The IT perimeter has disappeared
2014 51% 39% Time on mobile, vs Mobile internet traffic Of devices connected to the surpassed desktop Internet use Android, vs 37% 42% on PC internet traffic use Windows
70% 61% 90% Experienced a security Time in apps, Enterprises software incident directly attributable not the browser interactions on mobile by to a mobile device in the past 2022 year
Hey Aaron, check out the new KTM 500 EXC. http://ktm500exc.iamges.com.au/link
3X 3X 91% 95% more susceptible to year-on-year increase of breaches involve of these phishing phishing attack on in social media and phishing or social attacks were followed mobile SaaS targeted engineering by the installation of phishing software
CORPORATE SECURE EMAIL ENDPOINT FIREWALL GATEWAY ANTI-VIRUS CORPORATE EMAIL
CORPORATE SECURE EMAIL ENDPOINT FIREWALL GATEWAY ANTI-VIRUS CORPORATE EMAIL
CORPORATE SECURE EMAIL ENDPOINT FIREWALL GATEWAY ANTI-VIRUS CORPORATE EMAIL
Pegasus for iOS Pegasus for Android August 2016 April 2017 Discovery: Citizen Lab & Lookout Discovery: Lookout & Google Exploited: three zero-day vulns (Trident) Exploited: known/patched vulns (Framaroot)
� 18
Encryption Kernel Exfiltrate data
Encryption Pegasus data Kernel Exfiltrate data
Dark Caracal THE FIRST GLOBALLY ACTIVE MOBILE APT (mAPT) • A long-term offensive cyber campaign(s) with global scope & scale • Over 100GB of stolen data from over 600 mobile devices in over 21 countries • Primarily Android, and also Windows, Linux, and OS X • 2FA codes, Business information, Personal information, Screenshots, Recordings, Financial transactions, Other sensitive data
Dark Caracal mobile kill chain Gain Access Perform Espionage Social Engineer Dark Caracal uses at least 9 unique The goal is to drive victims to a Dark Caracal relies on Android surveillanceware apps to ”watering hole” controlled by Dark social engineering via activate a mobile device’s camera, Caracal that provides trojanized posts on a Facebook microphone, GPS, or steal data from up to versions of popular messaging apps. groups and WhatsApp 15 different locations on the device. messages.
ViperRAT FrozenCell xRAT Sophisticated surveillanceware APT C-23 targeting Palestinian individuals Initially used against pro-democracy targeting the Israeli Defense Forces. and organizations with trojanized activists in Hong Kong in 2014, targets iOS and Android. education and social media apps including facebook, WhatsApp, Targets suggests state sponsored Messenger, and LoveChat.
BancaMarStealer BANKING TROJAN
Over 60 international financial institutions
Real Fake
Real Fake
Real Fake
Phishing is the #1 cybersecurity risk globally
Lookout Phishing Statistics PHISHING SITE ENCOUNTER RATE 1.00 0.9 0.75 0.5 0.50 0.4 0.25 0.2 0.1 0.1 0 2011 2012 2013 2014 2015 2016 | CONFIDENTIAL AND PROPRIETARY
Lookout Phishing Statistics PHISHING SITE ENCOUNTER RATE • The rate at which users are receiving and clicking on Phishing URLs has increased 85% YoY since 2011. • Even with existing phishing protection and user training 56% of Lookout users received and clicked on a phishing URL*. • Those 56% of users clicked on an average of 6 phishing URLs per year over that same time. * 2014-2016 | CONFIDENTIAL AND PROPRIETARY
mobile phishing protection requires a different approach
CORPORATE SECURE EMAIL ENDPOINT FIREWALL GATEWAY ANTI-VIRUS CORPORATE EMAIL
CORPORATE SECURE EMAIL ENDPOINT FIREWALL GATEWAY ANTI-VIRUS CORPORATE EMAIL Deb Hey Aaron, check out these pics from Phishing Attack Blocked the picnic! http://www.picserver.net/picnic OK. Thanks! More Info Proceed Anyway message
Mobile Endpoint Security Threat Detail Device remediation � 35
Lookout Mobile Endpoint Security MOBILE RISK MATRIX Apps Risks Device Risks Network Risks Web & Content Risks • Trojans, ransomware, • Advanced OS • Man-in-the-middle • Mobile phishing rootkits compromise attacks attacks (Pegasus) • App vulnerabilities • Host certificate • Malicious files (e.g. • Unpatched devices due to poor coding hijacking Stagefright) • Non-compliant apps • Known CVEs* • SSLstrip • Browser vulnerabilities that leak data (e.g. Trident) • Risky device • TLS protocol • Sideloaded apps that • Browsing to risky configurations downgrades bypass app stores websites • User-initiated • Rogue wifi detection jailbreak/root
COME AND TALK TO US AT BOOTH 250
Recommend
More recommend
