Multiple security flaws in mobile devices could compromise South African government and business' sensitive information.
South African businesses and government are leading the 4G revolution in the country, but have not fully grasped the security implications, according to IT security company, MWR InfoSecurity.
The company, which is a sponsor of the ITWeb Security Summit, being held at the Sandton Convention Centre, in Johannesburg, on 15 and 16 May, has issued a warning to delegates about how vulnerable mobile devices are based on months of research, which revealed some startling results, including how SMS messages, e-mails, and personal details can be stolen.
Harry Grobbelaar, MWR's Managing Director in South Africa, said: “The use of mobile devices for banking in southern Africa is among the highest in the world. However, most users have no idea that an installed application with no special permissions will often be able to give access to personal information, bank account details, compromise e-mails and even give full control of the mobile device. We have to make people aware of this so that they can take the necessary action.”
He added: “Our research has shown that the phone in your pocket could be recording all of your conversations and sending MP3 files to an unknown server, even while in standby mode - just because the owner has visited a malicious Web site or downloaded a seemingly harmless application, often disguised as a game.
“Secure development practices for mobile platforms are less mature than typical browser-based Web development, mostly due to the introduction of new mobile operating systems which are bringing in new challenges.”
Grobbelaar said: “There is an assumption by many users that equipment manufacturers and network suppliers are up to speed when it comes to security. This is not always true. Our research shows that minimum security measures are not being implemented at several levels. OEM - original equipment manufacturers - vendors often ship phones with insecure applications, failing to provide end-users with a secure platform. The same is true of network suppliers who do not push security updates to phones, and neither party appears to talk to each other about security.”
Grobbelaar remarked: “Current policies of BYOD - bring your own device - into work could seriously compromise a business or a government department because insufficient security is in place.
“Mobile devices like tablets and smartphones are making their way into boardrooms and are allowing attackers to gain access to sensitive information.”
MWR's research into the Android platform, which has become increasingly popular over the past few months, has revealed a growing number of vulnerabilities capable of compromising a person's most sensitive data. That is, your corporate and personal e-mail, current and deleted SMSes, chats, everything on your SD card and even full access to microphone. As a result of this, the firm recently created Mercury, a free assessment framework to find vulnerabilities in Android's OS and help battle against information pilfering.
“We developed Mercury to assist our clients and the community with identifying vulnerabilities in Android applications, which can be used as part of the development life cycle to provide additional assurance and test the security of controls,” said Tyrone Erasmus, Mercury's author and security consultant at MWR, who is presenting at the conference.
Grobbelaar said: “The mobile security situation in South Africa is much more serious than people think. We will not only highlight vulnerabilities at the conference, but also provide delegates with demonstrations of Mercury and discuss solutions.”
MWR InfoSecurity supplies services that support clients in identifying, managing and mitigating their information security risks.
Share
Editorial contacts