Organizations are overconfident about their mobile app security practices, according to new research, and it’s putting enterprises and consumers alike at risk.

While 93% of organizations told researchers they were confident in their capabilities, and 97% that they had up-to-date policies outlining mobile app security policies, 62% were breached in the past year, with an average of nine incidents each.

Just over half (52%) fell victim to a malware attack, 45% suffered data breaches or leaks, and 37% experienced unauthorized access to data. The same number suffered credential theft.

Much of the problem derives from pressure to accelerate release cycles, with 74% saying mobile app teams are increasingly pushed on time-to-market. Similarly, 71% of organizations admit this has compromised mobile app security.

“The data is clear, and the perceived trade-off between speed and security is a false choice that is costing organizations,” said Roel Caers, CEO of Guardsquare.

“When developers are under immense pressure to release new features, and security is seen as a roadblock, they are forced to sacrifice protection for time-to-market. This reactive, fire-fighting approach is unsustainable. What’s needed is a proactive, integrated strategy where security is an enabler, not a hindrance.”

Other security challenges included balancing security with app performance, cited by 47%, ensuring compliance (44%) and providing a seamless user experience (42%).

Mobile app security is improving

On the positive side, most respondents reported that they were currently using some core mobile app security capabilities such as data encryption (69%), mobile application security testing (63%) and threat monitoring (59%).

However, the report found low adoption of proactive defenses, with almost 70% of organizations failing to use obfuscation to protect their mobile apps, and 60% lacking Runtime Application Self-Protection (RASP).

This, the study warned, is leaving their apps vulnerable to both static and dynamic analysis. Nearly four-in-ten said they relied entirely on DIY security solutions or OS-level protections.

Meanwhile, the impacts of security incidents extend beyond the average reported cost. More than half of respondents (54%) reported application downtime, with 48% experiencing data leakage and 41% suffering a loss of consumer trust.

Worryingly, 85% of survey respondents agreed that a security incident is often the catalyst for a security purchase, with 58% of respondents citing security incidents, 47% partner or client requirements and 30% a failed penetration test or audit.

Researchers said means far too many organizations are taking action too late.

“As organizations face pressure to develop feature-rich applications that can be easily used from any device, attackers often target vulnerabilities in mobile applications,” said Melinda Marks, practice director, cybersecurity, for Enterprise Strategy Group.

“To stay ahead of threats and attacks, security teams need to take a proactive approach to mobile application security with the right tools."

MORE FROM ITPRO

• Salesloft Drift hackers had access to company GitHub account for months before attacks
• Jaguar Land Rover u-turns on cyber attack containment claims
• FBI warns 'indiscriminate' Salt Typhoon hacking campaign has hit organizations in more than 80 countries

Apple has released an update providing a number of patches for iOS and iPadOS, including one zero-day that “may have been actively exploited".

Tracked as CVE-2022-42827, the zero-day vulnerability was the result of an out-of-bounds write error in the kernel, which could be used by threat actors to execute malicious code on the kernel level.

This could allow for custom, potentially malicious programs to be run on the victim’s device, as well as putting all data on it at serious risk of exfiltration or destruction.

An out-of-bounds write error occurs when a program writes beyond the end of an intended buffer or specified array, and typically results in a crash or corruption of data. If exploited, they can be used to modify system data and execute code on impacted devices remotely.

In its post for the iOS 16.1 and iPadOS 16 security updates, Apple noted that through the flaw an “application may be able to execute arbitrary code with kernel privileges".

Beyond this, the firm offered little detail of the precise nature of the zero-day, in line with its policies on security issues and in accordance with its longstanding approach of providing little detail on security incidents.

“For the protection of our customers, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are generally available,” stated a notice in the update post.

Affected devices include all of its smartphones from iPhone 8 and above, all models of the iPad Pro, iPad Air 3rd generation and above, and iPad and iPad Mini - both 5th generation and above.

Beyond the zero-day, the latest security update also provides patches for 18 other vulnerabilities. Of these, two more were in the kernel, though these are not thought to be actively exploited, while three were in WebKit, Apple’s browser engine which powers Safari.

Other flaws were fixed in the point-to-point protocol (PPP), a TCP/IP protocol used to send data between devices, as well as in core Bluetooth and the GPU drivers.

The patch marks the ninth overall update addressing a zero-day flaw by Apple this year. In September, the tech giant patched a similar kernel vulnerability, which allowed for arbitrary code to be executed with kernel privileges. This vulnerability also affected macOS Monterey, and had been potentially exploited in the wild by the time it was patched.

In August, Apple patched a 'superpower' zero-day affecting WebKit, in which threat actors could use remote code execution (RCE) to alter web pages, which would then run malicious code on Apple devices that visited them.

More recently, earlier this month Apple was forced to release a fix for a denial of service vulnerability, tracked as CVE-2022-22658, affecting iPhones 8 and newer.

Apple said that processing a maliciously crafted message could lead to denial of service and was fixed in its iOS 16.0.3 by improving input validation.

Qualcomm and MediaTek, two of the biggest chipmakers in the world, have been found to have used vulnerable technology in smartphones that could have led to privacy violations of Android users.

Check Point Research (CPR) discovered a number of vulnerabilities in the Apple Lossless Audio Codec (ALAC), a component responsible for compressing audio data, that could have led to users’ calls and stored images being accessed by cyber attackers.

The researchers believe that more than two-thirds of the world’s Android smartphones were vulnerable to the attacks at some point.

The vulnerabilities were found in the ALAC code which Apple made open source in 2011; the ALAC has since been installed in a wide variety of non-Apple audio playback devices and programmes - not just Android smartphones, CPR said.

Apple has since updated the code since it went open source, but the code in question had not been updated since 2011 and both Qualcomm and MediaTek ported the vulnerable ALAC code into their audio decoders.

Attackers could have used the vulnerabilities to conduct a remote code execution (RCE) attack on smartphones by sending victims a malformed audio file, the researchers said, but will not unveil full details of how the vulnerabilities can be exploited until they are presented at the CanSecWest conference in May.

“We've discovered a set of vulnerabilities that could be used for remote execution and privilege escalation on two-thirds of the world's mobile devices,” said Slava Makkaveev, reverse engineering and security research, at CPR. “The vulnerabilities were easily exploitable. A threat actor could have sent a song (media file) and when played by a potential victim, it could have injected code in the privileged media service.

“The threat actor could have seen what the mobile phone user sees on their phone. In our proof of concept, we were able to steal the phone's camera stream. What is the most sensitive information on your phone? I think it's your media: audio and videos. An attacker could have stolen that through these vulnerabilities. The vulnerable decoder is based on the code shared by Apple 11 years ago.”

MediaTek tracks both vulnerabilities as CVE-2021-0674 and CVE-2021-0675, scoring 5.5 and 7.8 out of ten on the CVSSv3 threat severity scale, and were patched by the company in December 2021.

Qualcomm tracks the security vulnerability as CVE-2021-30351, scoring 9.8, a critical rating, and affected a score of Snapdragon products. Qualcomm patched the issue in December 2021 and CPR waited until this week to publish details to allow users time to patch.

CPR recommends all Android users regularly patch their phones to the latest version that Google issues on a monthly basis.

Android has announced a new Play store security policy that will force developers to update older apps to avoid their software being removed.

With each version of Android, new and more stringent security policies are introduced to improve the security of the Android ecosystem. Following this approach, Android will now require all apps to target an API level that’s within two years of the most recent version.

An API level is essentially tied to a version of Android, meaning the most recent version of the operating system, Android 12, is the most up-to-date API level.

An existing policy states that any new app being added to the Play store, or an existing app that is being updated, needs to target an API level that’s within one year of the current version. The latest policy is an expansion of this, targeting older apps that have not been updated in some time.

This means that any older app will need to be updated to target an API level within two years of Android 12 in order to remain discoverable on the Google Play store, and to be able to be installed by users.

The new requirements will take effect on 1 November 2022 and as new Android versions are released the requirement window will adjust accordingly, Android said.

“The rationale behind this is simple. Users with the latest devices or those who are fully caught up on Android updates expect to realise the full potential of all the privacy and security protections Android has to offer,” said Krish Vitaldevara, director of product management at Android, in a blog post.

“Expanding our target level API requirements will protect users from installing older apps that may not have these protections in place.”

The discovery of malware affecting Android devices is a relatively common occurrence in the cyber security industry, and the new security policy will aim to make this more of a rarity.

In the space of a week, numerous reports of new Android malware strains have hit various media outlets, including a Russian-linked Android malware called Process Manager. Discovered by Lab52, the malware is capable of sending and reading SMS messages, plus recording a device’s audio.

At the end of 2021, IT Pro reported that more than 300,000 Android users had downloaded a banking trojan from the Google Play store, with hackers managing to bypass the app store’s security detections.

Without giving specifics, Android said the “vast majority” of apps in the Google Play store are already compliant with the rules soon to be introduced.

Developers who are concerned about implementing the upcoming changes can consult Google’s technical guide, which details the steps that need to be taken for a successful migration.

A six-month optional extension can also be requested if developers can demonstrate they need more time in order to complete the migration to the target API level. The application form for this will be available in the Developer Play Console later this year, Android said.

Researchers have said they observed a 500% increase in mobile malware infections across Europe since the start of February 2022.

The majority of malware was observed on Android devices, with six of the most serious strains targeting Google's operating system compared to just one targeting iOS, according to Proofpoint researchers.

Following an uptick in mobile malware infections back in April 2021, researchers told IT Pro that detections had largely tapered off and remained low until February 2022, although they were unable to pinpoint a reason for the sudden surge.

Proofpoint said most mobile malware is still downloaded via app stores and is especially prevalent on Android devices given the platform’s openness to multiple different app stores.

Side-loading – the practice of allowing apps to be installed via third-party app stores or directly onto the device – is also prohibited on iOS, helping to limit the spread of infections.

However, Proofpoint said it has noticed a distinct rise in attacks using mobile messaging, including SMS-based phishing attacks known as smishing. Given Android’s support for side-loading, it means this technique is more effective on that platform compared to iOS.

The finding is especially important for businesses that distribute Android-based company devices to their workforce. Many businesses install security measures that prevent access to third-party app stores but smishing may bypass some of these provisions.

“Mobile messaging is a highly trusted communication channel and users are much more apt to read and access links/URLs contained in mobile messages than those in email,” said Jacinta Tobin, vice president of Cloudmark operations at Proofpoint to IT Pro.

“This level of trust combined with the reach of mobile devices in the general public, where nine in ten possess a mobile device, makes mobile messaging a very attractive platform for commercial and marketing activity. This makes the mobile channel ripe for fraud and identity theft both now and in the future through this expansion.”

The most common types of malware found were those that used malicious apps to record phone calls, or those that take audio from the device outside of phone calls.

Data wipers, which have been especially common in the recent cyber attacks on Ukraine emanating from Russia, were also increasing in popularity.

This differs from the traditional purpose of malware, Proofpoint said, which typically involves gaining access to a system and potentially stealing data or account credentials.

Of the most common malware types, all had a financial impersonation component and all had a credential-stealing function.

For example, the long-feared FluBot malware, which installs an invisible overlay on mobiles to steal login credentials, activated when banking apps are used, was found to be one of the most common types of malware affecting Android users in Europe.

TangleBot was first observed in North America but has recently been found in Turkey. It typically spreads via fraudulent package-delivery notifications and may have links to the FluBot campaign. Notably, it is one of the few malware strains that combine financial impersonation with the newer audio-recording thefts.

“In both cases, the malware uses similar distribution methodologies, landing pages, language and SMS lures,” Proofpoint said. “One enticing lure that TangleBot has been known to use is a software update notification.”

Proofpoint said “awareness is critical” when keeping safe online, and more needs to be known about the dangers of mobile malware.

Users have been advised to be extra vigilant when it comes to reviewing emails and texts, especially for Android users, and consider installing a mobile antivirus app from a trusted source.

“Consumers need to be very sceptical of mobile messages that come from unknown sources,” said Tobin. “And it’s important to never click on links in text messages, no matter how realistic they look.

“If you want to contact the purported vendor sending you a link, do so directly through their website and always manually enter the web address/URL. For offer codes, type them directly into the site as well. It’s also vital that you don’t respond to strange texts or texts from unknown sources. Doing so will often confirm you’re a real person to future scammers.”

Apple has patched an array of security issues affecting iOS, iPadOS, and macOS devices, including two zero-day vulnerabilities.

Among the other myriad fixes for iOS and iPadOS 15.3, and macOS Monterrey 12.2 released on Wednesday were code execution flaws and some that allowed arbitrary code to run on affected devices with kernel privileges.

The first of the two critical flaws, tracked as CVE-2022-22587, involves an issue with the IOMobileFrameBuffer, a kernel extension responsible for managing a device's framebuffer - a portion of RAM that drives the video display. It's believed to have affected the iPhone 6s and later, all iPad Pro models, iPad Air 2 and later, and other devices in the ecosystem too.

Apple said a malicious application could exploit a flaw in this extension to execute arbitrary code with kernel privileges. Apple also said it previously knew about the security issue and that it believes it may have already been actively exploited in the wild. It was a memory corruption issue Apple fixed with improved input validation.

The bug was discovered by Meysam Firouzi of MBition - Mercedes-Benz Innovation Lab, and independent researcher Siddharth Aeri. A third, anonymous researchers was also thought to be involved.

Aeri published a proof-of-concept (PoC) for the security issue on 31 December 2021 and noted on their Twitter page that the bug was demonstrated by Pangu Team at Tianfucup 2021, a hacking competition similar to Zero Day Initiative's Pwn2Own.

The second zero-day flaw was found in Apple's WebKit browser engine and affects Safari 15 on macOS, and all browsers on iOS and iPadOS 15, as IT Pro previously reported.

Martin Bajanik of FingerprintJS first discovered the bug on 28 November 2021 and made it publicly available on 14 January, before Apple assigned it CVE-2022-22594 and patched it in Wednesday's slew of updates.

Exploiting the bug would see websites able to track sensitive user information and stemmed from a cross-origin issue in the IndexDB API. Apple fixed it using the same method as the first zero-day, by improving the input validation.

When he made the public disclosure earlier this month, Bajanik labelled the flaw a privacy violation. "It lets arbitrary websites learn what websites the user visits in different tabs or windows," said Bajanik who authored FingerprintJS' analysis of the bug. "This is possible because database names are typically unique and website-specific."

A total of five arbitrary code execution issues were found to affect iOS 15.3 and iPadOS 15.3, and seven affected macOS Monterrey 12.2. Four of the vulnerabilities in macOS also affected iPhones and iPads, meaning there was a single vulnerability exclusive to iOS 15.3 and iPadOS 15.3, three exclusive to macOS, and four shared across the operating systems of Apple's popular iPhones, iPads, and Mac computers.

Apple's zero-day-ridden 2021

The latest wave of patches marks Apple's first release of fixes this year and the company was forced to patch a score of zero-day and other critical vulnerabilities throughout 2021, including the infamous ForcedEntry exploit used to enable NSO Group's Pegasus spyware.

Arbitrary code execution zero-days in WebKit were also found in May 2021 affecting Safari, all third-party iOS browsers, Apple Mail, and the App Store too. An additional emergency patch was also released a month later to fix more WebKit flaws in iOS 12 which could lead to remote code execution attacks.

May 2021 was a particularly troubled period for the company, the products from which were once said to not even need antivirus protection. Another significant number of vulnerabilities were fixed at the end of May across iOS, macOS, tvOS, watchOS and Safari, including a macOS Big Sur zero-day vulnerability under active attack at the time.

Google has confirmed an issue affecting some users running Android 10 and above whereby a user's phone would not allow them to dial the emergency services.

The small but significant bug affects some devices that have Microsoft Teams app installed, but without being logged in to the collaboration platform, Google said on Wednesday evening in response to a Reddit thread.

Google said it and Microsoft took the issue seriously and added that the pair "are heavily prioritising the issue". However, the company was somewhat vague when alluding to the time it will take to fix the flaw.

In the Reddit reply, Google said that a Microsoft Teams app update will be rolled out "soon". It also suggested Android users should always run the latest version of the mobile operating system and lookout for the next planned platform update due on 4 January 2022.

IT Pro contacted Google for clarity on whether it impacts users in the UK but it declined to comment further.

Google said the issue was caused by an "unintended interaction between the Microsoft Teams app and the underlying Android operating system", and that only one user report of the issue was confirmed - the user who made the initial Reddit thread on the Google Pixel subreddit.

On temporary fixes, Google suggested users check if they're running Android 10 or above, sign into Teams if they aren't already and remain signed in, reinstall Teams, and update the Teams app as soon as the update is available.

The user who originally raised the issue said they were trying to call an ambulance for their grandmother who appeared to be having a stroke at the time but was unable to and that dialling 911 simply rang once before their phone become "stuck".

"I was unable to do anything other than click through apps with an emergency phone call running in the background," said the user in the original report. "This is all while the phone informed me that it had sent my location to emergency services. Sadly I couldn't tell the person on the other end what apartment I was in, or what the actual emergency was as I was unable to speak to a human."

Fortunately, the grandmother hand a landline phone and was able to call from that but with so many households opting out of landlines in favour of mobile-only connectivity, it presents a very serious issue of personal safety.

The user said they were using a Google Pixel 3 running Android 11 and on the Verizon network and have filed an official complaint with the Federal Communications Commission (FCC).

Visitors to the post were shocked to read about the situation and offered an outpouring of support, labelling it a "horrifying situation".

Others suggested that Google should offer the user a prize akin to one that might be given to a security researcher since the report and resulting cooperation in reporting the bug to Google was much like the process traditionally followed by a security expert submitting for a bug bounty reward.

Trend Micro offers an endpoint protection choice for every business: firms that want to keep it all in house can install Worry-Free Business Security Standard on their own server, while those that prefer a hosted solution can use this fully cloud-based option.

It’s aimed at companies with up to 250 devices to protect, and the price is SMB-friendly. Yearly pricing starts at £58 for two devices, rising to £520 for 25, with each licence covering one Windows or Mac workstation, one Windows server or one mobile device.

All the key security features are present. Along with anti-malware scanning you get protection against web threats, web content filtering, a client firewall, removable device controls and mobile device security. A standout feature of both the standard and cloud-hosted versions is an advanced data-loss prevention module, which comes preconfigured to recognise (and optionally block) 244 different types of sensitive data, including British financial and healthcare information.

Ransomware is very much on Trend Micro’s radar, too. The software subjects suspicious processes to a range of tests including predictive machine learning, behaviour monitoring and new program detection – and if the malware isn’t immediately stopped, the program can also directly detect malicious encryption attempts and undo any suspicious changes made by untrusted programs.

As the name implies, another focus of the Worry-Free suite is keeping deployment and administration simple. The cloud portal is easy to use, with a dashboard that keeps you posted on all client activity, detected security risks and policy violations. Clicking on any of the threat categories takes you straight to the portal’s log page, where you can quickly identify the threat type and which clients are affected.

The one place you might hit a hiccup is with initial client setup, as the email invitation process requires a standalone mail client running on your local system. This isn’t a huge obstacle, though: after logging on from a computer with Outlook installed, we were easily able to email invitations to our Windows 10 users. The messages pointed them to a tiny 7MB executable, and after launching the installer, they had the agent running and connected to the portal in less than five minutes, with settings applied from the portal’s default groups for instant protection.

Agents can then be manually moved into specific groups in the portal, each with custom policies. These define real-time and manual scan behaviour, apply predictive machine learning and use one of three web reputation levels to classify and block suspect web pages. Optional global settings can be applied for malware scanning, approved and blocked websites (which override URL-filtering policies) and password protection to stop users disabling the agent.

Data-loss prevention can be set up here too. We created a policy to block all sensitive data, then tried to use Gmail on a client PC to send an email containing a credit card number. The attempt was instantly blocked and logged, leaving Gmail complaining about a lack of network access.

Mobile protection is a mixed bag. Android devices get malware scanning, plus access to the web reputation service and password controls; if you’re using a Chromebook, you get web threat prevention too. As usual, however, iOS options are far more limited. All you can do is enforce complex unlock passcodes, set expiration limits and apply device lock timeouts.

Even so, Trend Micro’s Worry-Free Business Security Services provides great desktop security, plus exceptional DLP and ransomware protection. For small numbers of users it’s good value, and SMBs will find the cloud portal very easy to work with.

Hackers have managed to bypass Google Play app restrictions to chalk up over 300,000 banking trojan infections in just four months.

According to a blog post by security researchers at Threat Fabric, hackers have avoided being detected by Google Play by using smaller droppers in apps, reducing the number of permissions being asked of users and improving code as well as creating more convincing fake websites.

This has also made them difficult to detect from an automation (sandbox) and machine learning perspective, according to Threat Fabric.

“This small footprint is a (direct) consequence of the permission restrictions enforced by Google Play,” they said.

Hackers have also started carefully planned small malicious code updates over a longer period in Google Play, as well as sporting a dropper C2 backend to fully match the theme of the dropper app. The researchers cited an example here of a working fitness website for a workout-focused app.

“To make themselves even more difficult to detect, the actors behind these dropper apps only manually activate the installation of the banking trojan on an infected device in case they desire more victims in a specific region of the world. This makes automated detection a much harder strategy to adopt by any organization,” they said.

The 300,000 dropper installations came from just four types of malware. Anatsa (200,000+ installations); Alien (95,000+ installations) and Hydra/Ermac (15,000+ installations).

The largest, Anatsa, is an advanced Android banking trojan with RAT and semi-ATS capabilities. It carries out classic overlay attacks to steal credentials, accessibility logging (capturing everything shown on the user’s screen), and keylogging.

Researchers discovered the first dropper in June 2021 masquerading as an app for scanning documents. In total, researchers found six Anatsa droppers published in Google Play since June 2021.

A hacking group called Brunhilda dropped malware from established families, like Hydra, as well as novel ones, like Ermac. This posed as a QR code creator app. Both families have been very active in the last months according to researchers and have recently started appearing in the US.

The Alien campaign was also run by the Brunhilda group. This used a fake fitness app to spread.

“This dropper, that we dubbed “Gymdrop”, is another example of how cybercriminals try to convince victims and detection systems that their app is legitimate. The app website is designed to look legitimate at first glance. However, it is only a template for a gym website with no useful information on it, even still containing ‘Lorem Ipsum’ placeholder text in its pages,” said researchers.

Researchers said the attention dedicated by these hackers to evading unwanted attention renders automated malware detection less reliable.

Security researchers have discovered a flaw in smartphone chips made by Taiwanese semiconductor manufacturer MediaTek that could enable hackers to listen in on phone conversations.

The research, carried out by Check Point Research, has highlighted a bug in an audio processor made by MediaTek and used in 37% of the world’s smartphones, including Android devices made by Xiaomi, Oppo, Realme, and Vivo. The flaw is also said to affect some IoT devices.

A malicious instruction sent from one processor to another could potentially be used by an attacker to execute and hide malicious code inside the DSP firmware, the researchers warned in a blog post.

“Since the DSP firmware has access to the audio data flow, an attack on the DSP could potentially be used to eavesdrop on the user,” said researchers.

The chip contains a special AI processing unit (APU) and audio Digital signal processor (DSP) to improve media performance and reduce CPU usage. Both the APU and the audio DSP have custom Tensilica Xtensa microprocessor architecture. This made it a unique and challenging target for security research, according to Check Point Research.

To exploit the flaw, hackers would have to get a user to install a malicious app on their device. That app would then use MediaTek’s AudioManager API to connect to the audio driver. An application with system privileges then tells the audio driver to run code on the audio processor’s firmware. This then can hijack the audio stream.

Slava Makkaveev, a security researcher at Check Point Software, said that left unpatched, a hacker potentially could have exploited the vulnerabilities to listen in on conversations of Android users.

“Furthermore, the security flaws could have been misused by the device manufacturers themselves to create a massive eavesdrop campaign,” he said. “ Although we do not see any specific evidence of such misuse, we moved quickly to disclose our findings to MediaTek and Xiaomi.”

In a statement to press, Tiger Hsu, product security officer at MediaTek, said that device security is a critical component and priority of all MediaTek platforms.

“Regarding the Audio DSP vulnerability disclosed by Check Point, we worked diligently to validate the issue and make appropriate mitigations available to all OEMs,” he added.

The discovered vulnerabilities in the DSP firmware (CVE-2021-0661, CVE-2021-0662, CVE-2021-0663) have already been fixed and published in the October 2021 MediaTek Security Bulletin. The security issue in the MediaTek audio HAL (CVE-2021-0673) was fixed in October and will be published in the December 2021 MediaTek Security Bulletin.

We’re all too familiar with phishing. Fraudulent emails purporting to be from a trusted source, and tricking the victim into revealing sensitive information, are rampant.

Banks and financial services, third-party vendors, and streaming services are among the popular targets for impersonation. By and large, phishing scams rely on social engineering and clever personalization to lure victims into transferring money to a fraudulent account or providing personally identifiable information (PII).

The year 2020 saw 6.95 million new phishing attempts. Not surprisingly, COVID-19 scams were common, as were gift cards and gaming hacks. There’s a lesser know variant of phishing, however, that’s equally perilous. SMS phishing, or smishing, employs text messages sent over mobile phones as bait. There’s often an air of urgency in these messages, which entices recipients to click on malicious links.

How common are smishing attacks?

Reports of smishing in the UK rose nearly 700% in the first half of 2021, according to a study by enterprise security provider Proofpoint. Additionally, parcel and package delivery scams made up 67.4% of all smishing attempts.

Other prevalent smishing scams include:

1. Urgent notifications regarding credit card payment
2. Act-now coupons with special discounts
3. Request for survey/feedback from customer support
4. Unusual account activity alerts
5. Unknown service charges
6. Flash sales and giveaways
7. Instant student loans

Over 9,000 reports have been filed to Which?’s Scam Sharer tool since it launched in March 2021. Most reports (65%) involved phone calls or text messages, with 31% of these scams originating as text messages.

Why are smishing rates so high?

The average SMS open rate is 98% compared to just 20% for emails, according to Gartner. Additionally, SMS marketing helps businesses offer 24/7 support to customers, boosting engagement. Given the high response rate, it’s less of a surprise why cyber criminals emulate brands.

That said, smishing attacks are particularly hard to tame for one particular reason: lack of authentication. Unlike emails, SMS messages cannot be blocked or flagged without third-party software. Unhindered by the law, perpetrators can automate SMS messages to millions of ten-digit phone number combinations.

For instance, Edward Smith, a UK customer of Santander bank, was conned out of £22,700 after providing a spoofed bank phone number with his one-time password in 2016.

Santander released a statement stating, “Whilst we are very sympathetic to Mr Smith's situation and the distress caused by being the victim of a scam, Mr Smith disclosed a OTP to validate and authorise the transfer, a security measure we put in place to protect customers against fraud. He also confirmed the payment as genuine when we called to check. Therefore we cannot accept any responsibility for the losses on this account.”

A subsequent investigation revealed there were at least ten other Santander SMS fraud cases under investigation, with one victim reportedly losing £40,000.

How to spot and stop smishing scams?

Social engineering and trickery make smishing scams extremely potent and persuasive. Listed below are a few tips to prevent smishing:

1. Do not click on links sent via text message

Expect the unexpected. Malware can also spread through secure messaging apps like WhatsApp and Signal. Hacking groups, including Dark Caracal, have successfully employed WhatsApp, Signal, and Messenger to distribute phishing links that trick users into installing phoney updates to their encrypted messaging applications. Updates typically include malware files that allow hackers to view user screens, record keystrokes, and even take control of devices remotely.

2. Look for misspelled words

Smishing attacks are often characterized by poorly crafted sentences, improper grammar, and misspelled words. Be sure to check for these tell-tale signs when you suspect smishing. Spam messages may also contain links that differ ever so slightly from the site's original URL. Navigate to the website manually instead of clicking on the link to avoid being scammed.

3. Verify the number before initiating contact

Smishing messages typically come from random or strangely formatted numbers. For example, the number 5000 indicates the message was sent via email and may be malicious. Calling the concerned organization and asking for confirmation is the most reliable way to determine whether the number/message is legitimate. In the event that the number is fraudulent, delete the message to prevent any risks.

4. Limit the size of your digital footprint

Publicly available information can help criminals improve the credibility of their phishing messages. A good case in point is social media accounts. Review your privacy settings to ensure hackers cannot retrieve personally identifiable information, including your mobile number.

Already responded? Here are your options

Timely action can prevent harm. Here are some steps to take if you've already replied to a suspicious message:

1. Contact your bank if you have been tricked into disclosing your financial information. Block or freeze your account to prevent further transactions.
2. Notify your IT department if you used your work phone to respond. Log out of all other connected devices and reset your password.
3. Run a full scan with antivirus software if you clicked on a suspicious link to install or update an application.

Report to curb the spread

It's still worthwhile to report your suspicion, even if it's only a hunch. Luckily, it only takes a few steps to report spam.

Do not open or reply to suspicious emails. Instead, forward them to phishing-repot@us-cert.gov, an inbox established by the US Cybersecurity & Infrastructure Security Agency (US-CERT) in collaboration with the Anti-Phishing Working Group (APWG). You can also forward report cases of identity theft through identitytheft.gov. UK readers can forward possible phishing attempts through the Suspicious Email Reporting Service (SERS) at report@phishing.gov.uk.

Additionally, you can report suspicious text messages to universal short-code 7726 at no charge. The service will help your phone provider track down the source of the text and take appropriate measures.

“Smishing attempts have risen dramatically – with fraudsters taking advantage of the pandemic to trick consumers into giving away personal details and transferring their hard-earned cash,” says Rocio Concha, director of policy and advocacy at Which?.

The firm also released a ten-point SMS guide, encouraging businesses “to do their part to protect consumers from scams”. The guide offers advice on how businesses can differentiate their texts from those sent by scammers impersonating them, to protect consumers from fraud.

Multi-factor authentication (MFA) has been increasingly adopted in recent years, in line with the threats to password security.

Web and mobile products primarily use this, but approaches can differ.

Download this guide to learn why MFA is an essential tool in online security as well as the best practices for deployment.

Provided by

Google has announced plans to automatically enrol an additional 150 million users in two-factor authentication (2FA) by the end of 2021.

Known as two-step verification (2SV), the security feature combines the use of a password with a mobile device or a security key in order to diminish the chances of unauthorised access to accounts and networks. For instance, users signing in to their Gmail account, particularly when using a new computer for the first time, are asked to tap a prompt on their smartphone to authorise the login.

In a blog post published on Tuesday, the tech giant stated that enabling security protections by default is “the best way to keep [their] users safe”, which is why it's moving to ensure that more accounts have the 2SV feature switched on:

“By the end of 2021, we plan to auto-enrol an additional 150 million Google users in 2SV,” it announced, adding that an additional two million YouTube creators will be required to turn the feature on by the end of the year.

The tech giant acknowledged that not everyone has access to a smartphone or a security key, noting that it is “working on technologies that provide a convenient, secure authentication experience and reduce the reliance on passwords in the long-term”.

“We know security keys provide the highest degree of sign-in security possible, that’s why we've partnered with organisations to provide free security keys to over 10,000 high-risk users this year,” it stated.

Google said that users will be able to benefit from built-in security key capabilities in Android phones as well as its Google Smart Lock app for iOS, adding that its 2SV technology is automatically supported by “two billion devices around the world”.

In a Twitter post, Google product manager Sriram Karra said that today’s announcement “is just the beginning”.

“The 150m 2SV user count is staggering already if you look at it in the broader industry context. For e.g. Twitter recently announced ~2.5% of its ~350m active users have 2SV - that's ~9m user accounts,” he stated.

Companies across the tech industry have been working to strengthen account security and minimise users' reliance on passwords. In June, Twitter announced that its users would be able to use a security key as their only 2FA method, while in September, Corporate VP of Microsoft Security, Compliance and Identity, Vasu Jakkal, stated that customers “can now completely remove the password from [the] Microsoft account”.

However, 2FA has also been the target of cyber criminals. Earlier this week, Coinbase sent out letters to 6,000 customers informing them that hackers managed to exploit “a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor (2FA) authentication token”.

For the past decade, we’ve been assured that biometric security is the future, and that soon we’ll be able to do away with traditional forms of identification and authentication in favour of using our faces, fingerprints and even voices.

However, while biometric technology is certainly more common than it was in 2010, the promised revolution hasn’t quite materialised. We still have to rely on PINs and passwords for many of our transactions (both financial and otherwise) and biometric authentication is still largely limited to mobile devices. So what’s next for the technology? In this episode, we talk to Steven Furnell, senior IEEE member and professor of cyber security at the University of Nottingham, about where biometric security is going.

Footnotes

• What are biometrics?
• Only skin deep: The state of biometric security
• Petition urges EU regulators to ban biometric mass surveillance
• Hacked for life: Why you should be terrified by biometric technology
• TikTok settles for $92m after being accused of harvesting biometric data
• Dreaming of a world without passwords
• GitHub now supports security keys in a move away from passwords
• Google’s about to push everyone into two-factor authentication
• The IT Pro Podcast: How hackers steal your password
• If not passwords then what?
• The pros and cons of facial recognition technology
• How can facial recognition be made safer?
• Facial recognition tech used by UK police "breaches privacy"
• The IT Pro Podcast: The psychology of security

Subscribe

• Subscribe to The IT Pro Podcast on Apple Podcasts
• Subscribe to The IT Pro Podcast on Google Podcasts
• Subscribe to The IT Pro Podcast on Spotify
• Subscribe to the IT Pro newsletter
• Subscribe to IT Pro 20/20

Eight Brits have been arrested as part of an investigation into a series of 'SIM swapping' attacks across the US.

The men, aged between 18 and 26, are from England and Scotland and their arrests were part of an international effort with the National Crime Agency (NCA), the US Secret Service, Homeland Security, the FBI and the Santa Clara California District Attorney's Office.

The perpetrators are said to have illegally gained access to mobile phones belonging to US celebrities in order to steal large sums of money, either from their bank accounts or Bitcoin wallets, according to the NCA.

"This network targeted a large number of victims in the US and regularly attacked those they believed would be lucrative targets, such as famous sports stars and musicians," said NCA's head of operations Paul Creffield. "In this case, those arrested face prosecution for offences under the Computer Misuse Act, as well as fraud and money laundering as well as extradition to the USA for prosecution."

The criminals are accused of using a hack called 'SIM swapping' whereby they take over a victims phone number by deactivating the SIM and porting the allocated number over to a new one. This is often achieved by tricking mobile providers to swap the SIMs themselves, either using an insider or social engineering techniques.

Once they have control of the phone number, they use it to change the passwords on various apps and access contacts, emails and even bank details.

In the summer, a number of celebrities, such as Elon Musk and Barack Obama, had their Twitter accounts hacked via the same methods. Instagram, Twitter and a number of other social media platforms recently announced that they had disabled hundreds of accounts that were stolen through SIM swapping, citing the 'OGUsers' forum as the culprit for harvesting the usernames.

Android users are being warned against a wormable strain of malware that spreads itself by automatically replying to victims' WhatsApp messages with a malicious link.

The link this Android malware spreads through WhatsApp connects its victims with a convincing web page resembling Google’s Play Store, and a request to install a fake ‘Huawei Mobile’ app onto a user’s device.

This is according to ESET security researcher Lukas Stefanko, who published a short analysis of the malware’s mechanisms.

Should users install and activate the malicious app, it’ll immediately ask for various permissions to perform its key functions, including access to contacts and permission to draw over other apps. This latter feature means it can run in the background while other apps are in use on the victim’s device.

Users are also presented with a request to ignore battery optimisation, which if activated, means the app cannot be killed by the system if spare resources are needed.

Finally, the malicious app demands access to notifications, specifically WhatsApp notifications, so it can scan for incoming messages and distribute further among contacts.

Once all the permissions are guaranteed and the malicious app is set up, it runs in the background and waits for instructions from the command and control server, as well as incoming WhatsApp messages so it can spread.

When messages are received through WhatsApp, the malware scans for these and automatically sends a reply on the user’s behalf which includes the malicious link. This is accompanied with a message asking the contact to visit the fabricated Play Store page and download the fake Huawei app.

Stefano also examined the malware to show that it surreptitiously only messages the malicious link to one contact once per hour. This is in order for the app not to arouse suspicions and remain in operation for as long as possible before detection and removal.

Security researchers have discovered a major mobile banking fraud operation that stole millions of dollars from financial institutions in Europe and the US before being intercepted and halted.

According to a report by IBM Trusteer, cyber criminals used an infrastructure of mobile device emulators to set up thousands of spoofed devices and access thousands of compromised bank accounts.

“In each instance, a set of mobile device identifiers was used to spoof an actual account holder’s device, likely ones that were previously infected by malware or collected via phishing pages,” said researchers.

Shachar Gritzman, mobile malware researcher at IBM said the gang used automation, scripting, and potentially access to a mobile malware botnet or phishing logs to initiate and finalize fraudulent transactions at scale.

“In this automatic process, they are likely able to script the assessment of account balances of the compromised users and automate large numbers of fraudulent money transfers being careful to keep them under amounts that trigger further review by the bank,” Gritzman said.

In some cases, hackers used over 20 emulators in the spoofing of well over 16,000 compromised devices.

“The attackers use these emulators to repeatedly access thousands of customer accounts and end up stealing millions of dollars in a matter of just a few days in each case. After one spree, the attackers shut down the operation, wipe traces, and prepare for the next attack,” said Gritzman.

Gritzman said to defend against future attacks on mobile devices, users should avoid jailbreaking or rooting any devices, ensure all system updates and app updates take place on time, and obtain apps directly from official app stores.

Tom Davison, technical director – international at Lookout, told ITPro that this attack demonstrates the extraordinary lengths that today's well-funded and professional cyber criminal groups will go to when the end justifies the means.

“Mobile devices present a multiplier effect as they become the mainstream platform for online banking. Consumer users need to protect themselves by understanding that mobile devices are not immune. It really is important to keep them updated, but also to verify the safety of installed apps and the validity of links being clicked,” Davison said.

“For the banks, the challenge comes from the huge range of devices being used to access their services which are not under their control. These may be insecure or already compromised. Customer education helps, but it is also critical to employ run-time application security to spot infected customer devices and block the opportunity for fraud."

A newly discovered malware strain has been identified in the wild that unwittingly registers victims for premium services provided by legitimate telecoms firms.

Named WAPDropper, the malware downloads and executes a payload, dropping a wireless application protocol (WAP) premium dialer which subscribes its victims to premium services in Thailand and Malaysia without their knowledge or consent.

The malware strain comprises two separate modules, according to Check Point Research, including a dropper module responsible for downloading the second-stage malware, and a premium dialer module that is responsible for the subscription element.

This campaign identified by the researchers subscribes users to premium services offered by legitimate telecoms providers in Thailand and Malaysia.

The scheme is centred on making calls to premium-rate numbers, which will, in turn, generate profit for the cyber criminals who collaborate with the owners of these particular phone numbers.

After the application is first installed on a device using third-party app stores, WAPDropper contacts the command and control server and receives the payloads to execute. This first payload is the premium dialer module, which opens a tiny web window and contacts premium services.

Once WAPDropper opens the landing pages, it’ll attempt to subscribe the victim to these services. Alarmingly, the process includes a mechanism that can bypass the CAPTCHA security requirement, which must be overcome to complete a transaction.

It’s at this stage that the operators deploy the services of Super Eagle, a Chinese firm that offers a machine learning tool for image recognition. When the malware submits the verification code image to the service, the platform returns the coordinate position of the recognition result in the image, then parses the coordinate simulation landing.

The malware also attempts to avoid detection by hiding its icon to prevent users from spotting it on their device and uninstalling the app. The malware also performs checks to determine whether the victim is using a proxy or virtual private network (VPN).

Microsoft is warning businesses against using multi-factor authentication (MFA) systems that rely on voice and SMS due to security concerns.

In a blog post, Microsoft director of identity security Alex Weinert provides a range of reasons why businesses should avoid SMS and voice MFA.

“These mechanisms are based on publicly switched telephone networks (PSTN), and I believe they’re the least secure of the MFA methods available today,” Weinert writes. “That gap will only widen as MFA adoption increases attackers’ interest in breaking these methods and purpose-built authenticators extend their security and usability advantages.”

Lack of encryption

What’s particularly problematic with SMS and voice-based MFA is they use no encryption, making it easy for hackers to intercept them, according to Weinert.

“From a practical usability perspective, we can’t overlay encryption onto these protocols because users would be unable to read them (there are other reasons too, like message bloat, which have prevented these from taking hold over the existing protocols)”

“What this means is that signals can be intercepted by anyone who can get access to the switching network or within the radio range of a device.”

Social engineering

Weinert also believes SMS and voice-based MFA are more susceptible to social engineering techniques. In particular, he says customer support agents are “vulnerable to charm, coercion, bribery, or extortion.” With those tactics, perpetrators could trick customer support representatives into providing “access to the SMS or voice channel.”

Weinert adds, “While social engineering attacks impact email systems as well, the major email systems (e.g. Outlook, Gmail) have a more developed “muscle” for preventing account compromise via their support ecosystems. This leads to everything from message intercept, to call forwarding attacks, to SIM jacking.”

Performance issues

Another issue is that these systems can be affected by mobile operator performance, with Weinert explaining they “are not 100% reliable, and reporting is not 100% consistent.”

He also pointed out that evolving regulations make these techniques challenging. “Due to the increase in spam in SMS formats, regulators have required regulations on identifying codes, transmit rates, message content, permission to send, and response to messages like ‘STOP.’”

“Unfortunately, however, these regulations change rapidly and are inconsistent from region to region and can (and have) resulted in major delivery outages. More outages, more user frustration.”

Phishing threats

Furthermore, the lack of context in SMS and GSM communications makes phishing an even bigger threat to people who use these types of MFA.

Weinert says, “In practical terms, the text or voice mediums limit how much information can be communicated to a user – SMS carries 160 characters, 70 if not using GSM, and once we get into languages which require encoding, the practical limit without message splitting is only around half that.“

“Phishing is a serious threat vector, and we want to empower the user with as much context as possible (or, using Windows Hello or FIDO, make phishing impossible) – SMS and voice formats restrict our ability to deliver the context under which authentication is being requested.”

Jake Moore, a security specialist at ESET, believes SMS-based MFA isn’t as safe as physical security keys or app-based tokens.

He told ITPro, “SMS messages are easily hacked as they are not encrypted and are at risk of SIM swapping attacks. However, if this is the only option, then it is still better than not having any extra verification.”

“Authenticator apps should be one of the first apps you install on your device and be used with every account you own. To go one step further, hardware security tokens are even more secure as they cannot be used in sophisticated social engineering techniques.“

Hackers could exploit an address bar spoofing vulnerability found in a handful of widely-used mobile web browsers to deploy malware or conduct spear-phishing attacks.

Several mobile web browsers, including Safari and Opera Touch, were afflicted with a flaw that could allow an attacker to set up a malicious website and tempt a victim into opening a link from a spoofed email or text message.

This would then lead to the user downloading a malicious file or could put the victim at risk data therft, according to Rafay Baloch, an independent security researcher. Baloch worked in collaboration with Rapid7 to report the vulnerabilities to each browser developer.

The affected browsers, which also include UCWeb, Yandex Browser, Bolt Browser and RITS Browser, pose a risk in the way that an attacker can manipulate JavaScript to cause a pop-up to appear on a user’s device. This would be sourced from an arbitrary website, and the attacker could even render content in the browser to falsely appear as if it was sourced from an arbitrary website.

The site would need to be established by the attacker, and could be sent to victims through a phishing text or email with a spoofed contact number or identity, for example, a message that claims to be from PayPal.

The origin lies in the way a hacker could execute malicious JavaScript code in the arbitrary website to force the browser to update the address bar to another address of the attacker’s preference as the page loads.

“This seems like a pretty effective attack, given that the address bar is really the only signal you have to tell 'where' your browser 'is.' As it turns out, there are quite a few ways to get JavaScript to monkey with timing,” said director of research at Rapid7 Tom Beardsley.

All vulnerabilities were disclosed to the respective developers in August following their discovery - and publicly revealed after sufficient time had elapsed. Both Apple and Opera immediately assigned tickets to fix the bugs affecting their browsers, with a Safari patch out now and an Opera Touch fix set for November.

Two vendors replied only days before public disclosure, one didn’t reply at all, while attempts to contact the last vendor bounced entirely.

Microsoft has lifted the lid on a sophisticated ransomware family that has been spotted using a machine learning component embedded in its code and has so far managed to evade most security tools.

Like most Android ransomware strains, this particular threat, called AndroidOS/MalLocker.B, doesn’t encrypt users files. Instead, it blocks users’ access to their devices by displaying a full-screen notification that spoofs a message from authorities and demands payment in exchange for its removal.

Researchers say they are especially alarmed by the sophisticated techniques the malware uses to avoid detection, as well as the Android features it abuses to show a ransomware note that cannot be dismissed. This is something many Android ransomware strains have struggled to accomplish recently.

“The mobile ransomware is the latest variant of a ransomware family that’s been in the wild for a while but has been evolving non-stop,” the Microsoft Defender Research Team said.

“The new variant caught our attention because it’s an advanced malware with unmistakable malicious characteristic and behavior and yet manages to evade many available protections, registering a low detection rate against security solutions.”

Android ransomware in the past often targeted the ‘SYSTEM_ALERT_WINDOW’ permission to show ransom notes, which couldn’t be dismissed by the user as this permission was normally reserved for things like system alerts or error messages. The mechanism was exploited to make the message fully occupy the screen, blocking access to the device, although this attack surface was practically eliminated following system tweaks by Google.

Android malware has since attempted to adapt by misusing other features, but these have been largely ineffective. Attempts to exploit accessibility features often alerted users to the presence of malware as it requires navigating through several menu screens in order to use these services. Other families used infinite loops of drawing non-system windows, but it’s possible for users to go to settings and uninstall the app in between drawing and redrawing.

However, this new malware family has overcome these barriers by abusing the “call” notification – which fills the screen with a notice that you’re receiving an incoming call – to show a full-screen message that cannot be dismissed.

This particular strain has been through several stages of evolution to get to this current form, and Microsoft’s research team has previously seen stains that abuse accessibility settings, as well as general notification services. The expectation is that this family will churn out new variants with even more sophisticated techniques in future.

Alarmingly, its code is embedded with a TinyML machine learning module that’s designed to make sure images fit the screen without distortion. This would ensure that a ransom note would appear more believable, and less contrived.

As of now, the library using TinyML hasn’t yet been wired to the malware’s functionalities, but Microsoft claims its presence implies the intention to do so in future versions.

BlackBerry has announced a new solution for protecting mobile users against phishing attacks and mobile malware.

The new BlackBerry Protect Mobile is an artificial intelligence-based mobile threat defense (MTD) designed to detect attacks before they execute.

As the COVID-19 pandemic forces millions of workers to shift to remote work, mobile malware and phishing attacks are increasing. Frequently, when users' devices are compromised, they can infect their company's system quickly, but the company may not discover the issue for months.

BlackBerry Protect Mobile, which is based on the BlackBerry Spark platform, uses AI to detect attacks before they execute. It monitors attacks at the device and application level, allowing it to alert users before they open URLs leading to spoofed websites designed to collect data. It does all this without human intervention.

Protect Mobile also identifies security vulnerabilities and malicious activities by monitoring system parameters, device configurations and system libraries at the application level. Plus, it can identify malware from sideloaded apps and ensures applications come from secure repositories only.

"The number of phishing attacks that target mobile users will continue to rise because business is being conducted on mobile devices and users are more susceptible to attacks when viewing and accessing content on the go," said Billy Ho, executive vice president of BlackBerry Spark.

"BlackBerry Protect Mobile provides mobile device security integrated into our unified endpoint security (UES) solutions for a simplified approach to identifying and alerting users and administrators to phishing attempts and mobile malware across the enterprise."

BlackBerry is making a strong push to be a factor in the new work-from-home era. The launch of BlackBerry Protect Mobile comes alongside the release of BlackBerry Persona Desktop, an AI-powered security solution for desktops and laptops. BlackBerry Persona Desktop and Protect Mobile are part of the company's larger Cyber Suite.

With all the images and documents we save to our smartphones, they’ve become portable security risks. To help keep these sensitive files safe, Google has launched Safe Folder.

Safe Folder, which is a part of the Files by Google app, is an encrypted folder protected by a four-digit PIN. Once you save files in this folder, they are inaccessible without entering your PIN.

You can save virtually any file type in your Safe Folder, so everything from Word or PDF documents to videos to audio files are secure.

Once you set up your Safe Folder, create a PIN and move files to it, the system automatically locks the folder when you navigate away from it. Even if it remains open in the background, you still must enter your PIN to view the files.

So, if you have your Safe Folder open and hand your phone to someone to make a call, you know the folder is secure once you close Safe Folder or the borrower opens the phone app.

While Safe Folder is new, the Files by Google system launched in 2017. With Files by Google, Android users can quickly delete unwanted and duplicate files, transfer files to other Android users, back up files to the cloud and more. It also helps clean up temporary files that gobble up precious memory.

Safe Folder is still in beta, so its availability is limited. Google expects a broader rollout in the coming weeks.

Once it’s available, you can activate Safe Folder by installing and opening the Files by Google app, tapping “Browse” at the bottom of the screen, scrolling to “Collections” and tapping “Safe Folder.” From there, simply follow the prompts to create a PIN and activate the folder.

Facebook Messenger has become a communication tool for the masses. From personal chats to business communications, seemingly everyone uses it daily. This results in a lot of sensitive and personal information getting shared on it, and with Messenger now on our phones, this makes letting someone borrow your phone a risky proposition, until today.

Today, Facebook has added an extra layer of protection by adding a lock specifically for the Messenger app. Dubbed App Lock, this new feature locks your Messenger and allows noone to access it until you use either your touch or face ID to unlock it separately from your phone. What’s more, this system uses the IDs already stored in your phone and doesn’t transmit them to Facebook.

App Lock is currently available on iPhone and iPad devices only, but Facebook expects to roll it out to Android devices in a few months.

Before App Lock, once you unlocked your phone to let someone else use it, they had full access to your private messages. If that person took to snooping through your messages, it could expose you or your business to a number of risks. With App Lock, this is no longer an issue.

Sure, it’s an extra step each time you unlock your phone to check your messages, but it’s well worth the security.

You can activate App Lock by opening your Messenger app, clicking on your avatar on the top-left corner, clicking “Privacy” under the “Preferences” section and toggling App Lock to the “On” position.

With App Lock activated, you can feel confident your messages are secure when letting a friend, family member, coworker or stranger borrow your phone.

Apple has been tracking iPhones that have been stolen during the ongoing protests across the US.

The company hasn't officially confirmed this, but social media posts, including an image that’s being widely shared on Twitter and Reddit, confirms that Apple has been tracking the location of the pilfered devices.

The photo shows an iPhone with a message on its display that reads, “This device has been disabled and is being tracked. Local authorities will be alerted.”

The warning asks for the phone to be returned to an Apple Store on Walnut Street in downtown Philadelphia.

That’s one of the Apple Stores that was looted over the past week. During recent protests following the death of George Floyd while in police custody in Minneapolis, looters have taken advantage of the civil unrest to break into Apple Stores in Los Angeles, New York, Philadelphia, Portland, Salt Lake City and Washington, D.C.

With no official word from Apple on the matter, it’s not clear if authorities are actually being alerted to the phones’ whereabouts.

However, we do know that Apple has the technology to remotely track a phone’s location. The company's "Find My app", for example helps users to locate lost or stolen devices.

The recent looting of a number of Apple Stores comes as the company was preparing to reopen more than 100 retail stores across the US.

The stores had been closed for an extended period of time due to the coronavirus pandemic.

Parachute has announced its new Superlock feature that prevents unauthorized users from stopping and ending video recordings.

In situations where there’s a risk of a device being taken by an attacker, police officer or another unauthorized person, the Superlock feature locks down the Parachute app so it continues recording and livestreaming a user’s video, audio and location.

It remains unlocked and livestreaming, even if an unauthorized user tries to shut the phone off. The update to Parachute arrives amid nationwide protests related to the death of George Floyd

Keep in mind, Parachute already wipes devices during livestreaming. Should an attacker get control over a Parachute user’s phone, they won’t find much, even if the phone is unlocked or broken. Superlock takes things a step further by also preventing unauthorized users from stopping Parachute and ending video recordings.

The new feature works with Apple’s Guided Access to lock down a user’s phone and requires the user to turn this feature on via Settings > Accessibility > Guided Access. Once the user has activated Guided Access, they must return to the Parachute app, triple-click the power button and tap “Start” to select a six-digit passcode.

Users then must triple-click the iPhone power button again, enter their passcode and tap the end button. Once completing setup, users can activate Superlock by triple-clicking the power button.

Superlock also cuts off access to the “X” button that stops a recording, making it impossible to stop a Parachute recoding without entering the user’s six-digit passcode. An increasing time-delay mechanism prevents unauthorized users from quickly trying different combinations to try to crack a user’s passcode too.

“As the most powerful safety app in the world, Parachute has become an indispensable tool for those whose life’s mission puts them face to face with danger every day. Today’s Superlock launch takes Parachute’s one-of-a-kind protection even further,” said Marinos Bern, CEO at Parachute.

Superlock is accessible on iPhones starting today. Users can download Parachute by visiting the company’s website.

US law enforcement officials have accused Apple of stalling an investigation into a Saudi aviation student who killed three people at a Florida Naval base last year.

Second Lt. Mohammed Alshamrani, a member of the Saudi air force, had been communicating with al Qaeda operatives for years. The discovery was made using information recovered from his two iPhone devices.

Officials have since accused Apple of stalling the probe by refusing to unlock the shooter’s devices.

Ultimately, the FBI had to bypass Apple’s security features to access the information on the gunman’s phones. The information uncovered on the devices led to a counterterrorism operation against Abdullah al-Maliki, an associate of Alshamrani, Attorney General William Barr said. Unfortunately, Apple was of little help during the FBI’s investigations.

“We received effectively no help from Apple," FBI director Christopher Wray stated during a news conference, adding that the struggle to unlock the encrypted devices caused months-long delays and jeopardized public safety.

Apple, on the other hand, disagrees with Barr and the FBI’s assessment.

“The false claims made about our company are an excuse to weaken encryption and other security measures that protect millions of users and our national security,” Apple shared in a statement provided to The Wall Street Journal.

“It is because we take our responsibility to national security so seriously that we do not believe in the creation of a backdoor—one which will make every device vulnerable to bad actors who threaten our national security and the data security of our customers.”

Despite its condemnations of the company, the Justice Department is no closer to convincing Apple to provide backdoor access to its tech. At this time, Barr and Wray have also declined to comment on how they unlocked the devices.

Google has released an update for its Pixel 4 smartphones that addresses a security issue that has plagued users since its release in October 2019.

At the time of the Pixel 4's release, the smartphone was lauded for its affordable price, great camera, and smart software features. However, an issue with its face unlock feature meant that the Pixel 4 could be unlocked even when its owner’s eyes were closed.

This sounded alarm bells amongst security experts, who warned that the flaw could allow anyone to unlock the device without its users' permission by putting it in front of their face while they're asleep.

Google has finally decided to address the problem with a new update released this week which solves the security concern with a single option, reducing the probability of unauthorised or accidental activations.

Pixel 4 users are now able to eliminate this issue if they mark the “need to have eyes open for recognition” setting after turning on face recognition on their devices. However, the company advised those who are still wary to enable the “lockdown” option from the power menu, which will ensure that the phone is only unlocked with a passcode.

The update also fixes dropped Bluetooth audio input during calls as well as the lagging keyboard when opened in certain apps.

In late November 2019, Google expanded its Android bug bounty program by offering $1.5m to anyone who could break the Pixel 4, in a bid to make its Titan technology more secure.

The eventual release of a Pixel 4 fix follows the news that Google will halt a controversial Chrome update in light of the COVID-19 pandemic. The company had decided to roll back the SameSite cookie changes, which were claimed to provide increased security and privacy by phasing out support for third-party cookie tracking.

US officials are reportedly set for a meeting with Dominic Cummings on Wednesday, to demand that the UK rethinks its decision to allow Huawei a role in its 5G infrastructure.

The US is seeking a possible compromise that will allow the two countries to work together on developing an alternative, according to The Guardian.

Donald Trump's acting chief of staff, Mick Mulvaney, will meet with Boris Johnson's chief aide at Downing Street with reports that the US wants the UK to commit to removing Huawei equipment from its mobile networks in three to five years time.

Since the UK's government granted Huawei "limited" access to its networks, a number of US officials have warned about the risks the Chinese company poses, even claiming it embeds backdoors in its telecoms networks.

Trump himself has remained relatively quiet on the subject. The US ambassador to Germany tweeted that the president called him from Air Force One with instructions to make clear that: "any nation who chooses to use an untrustworthy 5G vendor will jeopardise our ability to share intelligence and information at the highest level."

Huawei has hit back at the US with counter-accusations that cite the Edward Snowden leaks detailing American surveillance on other countries.

"US allegations of Huawei using lawful interception are nothing but a smokescreen - they don't adhere to any form of accepted logic in the cyber security domain," Huawei said in a statement. "Huawei has never and will never covertly access telecom networks, nor do we have the capability to do so."

Mulvany is also scheduled to meet Sir Edward Lister for his two-day visit, which will also see him address the Oxford Union debating society. But it's thought that the US is particularly keen on meeting with Cummings, who is seen as the prime ministers most influential aide.

Members of Johnson's own party and the opposition have expressed similar views on Cummings. Labour Leadership candidate Keir Starmer quipped that Prime Minister's Question time may be renamed "DCQs" after Cummings as he "actually holds all the power", according to The New European.

US officials have made new accusations about Huawei's alleged spying activities, claiming the company is maintaining backdoors into its telecoms networks that can be accessed remotely.

The allegations centre on the use of backdoors in networking equipment like base stations and antennas, which are installed for legitimate use by law enforcement by virtually all manufacturers, not just Huawei.

However, US National Security Advisor Robert O'Brien has claimed the Chinese firm has retained access to these backdoors without notifying the carriers that use its equipment, according to The Wall Street Journal .

It's also reported that these details were disclosed to both UK and German officials at the end of 2019 after the US had allegedly noticed access to 4G equipment going back to 2009.

"We have evidence that Huawei has the capability secretly to access sensitive and personal information in systems it maintains and sells around the world," national security adviser Robert O'Brien told the WSJ.

Although these allegations are still quite vague, they are the most detailed information yet as to what led the US to block companies from supplying equipment and services to Huawei at the start of 2019. Throughout last year, a number of US-based software and hardware suppliers had to cut ties with the Chinese company to comply with the government's legislation.

Before the ban came into force, companies such as Vodafone and Microsoft called on the US to release its evidence, but it's taken a year for any further details of the alleged evidence to be made public.

In January, it was reported that the US shared intelligence on security concerns regarding Chinese manufacturers with the Dutch government and the same officials also disclosed the information to their British counterparts in the run-up to its long-awaited decision on whether Huawei could continue to play a role in its 5G deployment.

IT Pro has approached Huawei for comment but hadn't received a response at the time of publication. However, Huawei's chief security officer, Andy Purdy, told The Verge: "We vigorously deny the allegation that we retain any such capability. We also deny that we have ever improperly accessed customer information or customer data.

"The US is committed to this, and I think it's really prompted by the geopolitical situation between China and the US. The US is unwilling to consider the facts and the evidence, and they're going to do whatever they can to block our ability to provide products to communication networks around the world."

Google has removed 24 apps (totaling 382 million active installations) suspected of unethical data practices from the Google Play Store.

“If we find behavior that violates our policies, we take action,” said Google in response to a report published by VPNpro earlier this week.

The tarnished apps stem from five different developers, all offshoots of Shenzhen HAWK - a Chinese tech company with a history of releasing apps infected with malware and rogueware.

Shenzhen HAWK’s mega parent company the TLC Corporation has since responded to Google’s action, claiming to be “actively working” with developers “to better understand their concerns”.

The TLC Corporation - which is partially owned by the Chinese state - also referenced plans to hire an outside security consultant to protect its consumers from insecure data practices.

Despite the TLC Corporation’s promise thousands, potentially millions of Android users remain at risk for having their data tampered with.

Last year, UK mobile research firm Upstream reported the danger lurking behind the Shenzhen HAWK’s seemingly innocent Weather Forecast app: “It collects and transmits geographic locations, email addresses, IMEIs to a server in China and has a number of privacy invasive permissions on the device. Had it not been blocked it would have succeeded to subscribe users on Alcatel phones in countries like Brazil, Malaysia and Nigeria to paid services for which users would have been billed more than $1.5 million.”

These apps have been accused by VPNpro of “seeking dangerous permissions”, which include giving unsolicited Chinese servers access to users’ locations, cameras, and mobile accounts, among a number of other concerning factors.

“There are quite a lot of financially lucrative things, legal or illegal, that app developers can do with user data,” added Upstream’s initial report.

The 24 Shenzhen HAWK apps removed from the Google Play Store range from offering storage cleaning services and file management, to a selfie camera and games.

The US is reportedly making a last-ditch effort to convince the UK to ban Huawei equipment from its 5G infrastructure plans.

Secretary of State Mike Pompeo is expected to press the UK's Foreign Secretary, Dominic Raab, during a meeting in Washington on Thursday, according to Reuters.

A government spokesperson said that it continues to consider its position on "high-risk vendors" and that a decision will be made "in due course".

According to Reuters, the UK has been weighing up US allegations that Huawei's tech will be used by the Chinese government for espionage against industry warnings that banning it could cost billions of pounds. Sources suggests a final decision will be made later this month.

The Chinese firm is a leader in telecommunications technology, including 5G equipment, but has fallen foul of the US government. It's been on a trade blacklist since the start of 2019, cutting off trade deals with US-based suppliers.

Washington had planned to send a delegation, including deputy national security advisor Matt Pottinger, to meet with UK officials this week, according to Reuter's sources. However, that was cancelled at the last minute due to bad weather.

The US has reportedly been pressing allies to consider its security concerns over both Huawei and China for a number of years. On Monday, reports suggested that Pompeo used the state visit of the Dutch Prime Minister Mark Rutte to share US intelligence reports on Chinese security concerns.

Netherlands government had granted a trading license to ASML and it had set up a deal with an unnamed Chinese company. ASML specialises in chip manufacturing using a process called lithography. Following the meeting with the US, however, the government decided not to renew the company's license.

If you use Twitter for Android, pick up your phone and update the app – the company has just issued a patch for a particularly dangerous flaw.

Twitter admitted in a blog post that it had spotted a nasty vulnerability that could let hackers see private account information or take over your feed to send Tweets or Direct messages. A patch is already being pushed out, and there's no evidence the flaw had been spotted or used in the wild.

Twitter said that making use of the flaw would have involved a "complicated process" that required inserting malicious code into restricted storage areas of the app, but admitted it may have been possible.

"We don’t have evidence that malicious code was inserted into the app or that this vulnerability was exploited, but we can’t be completely sure so we are taking extra caution," the company said.

Alongside patching the flaw, the company said it would directly contact anyone exposed to the flaw, either via the app or by email, with instructions on how to keep their accounts safe. "We recommend that people follow these instructions as soon as possible," the company said. "If you are unsure about what to do, update to the latest version of Twitter for Android."

The app can be updated via the Play Store on Android. Twitter said the iOS version of the app was not affected by the flaw.

For anyone wanting more information, Twitter has a form to request information about your account and security. "We’re sorry this happened and will keep working to keep your information secure on Twitter," the post added.

The security flaw comes as the company purged 88,000 accounts that were used as part of a "significant state-backed information operation on Twitter originating in Saudi Arabia". The spam accounts were spreading pro-Saudi propaganda via a variety of platform manipulation techniques, such as aggressive liking, Twitter said. The campaign was coordinated by a Saudi marketing company, Smaat, which has been banned permanently from Twitter.

Police officers across the UK have had 2,600 devices lost or stolen over the past three years, according to a Freedom of Information (FOI) request.

Since 2016 there has been a 150% increase in reports of missing mobile phones, laptops, police radios and even encrypted USB pens. 1,360 gadgets were reported lost over the last year alone – some 4 devices every day.

The FOI request, issued by the Parliament Street Think Tank, also revealed that West Midlands Police reported the highest number of device losses, with 1,012 since 2016.

A breakdown of their loses showed 16 laptops, 112 mobile phones and 884 police radios in three years.

The Staffordshire Police force came second by quite a margin, with only 277 lost over the three year period – just over a quarter of the devices lost by the West Midlands force. The Greater Manchester Police reported the third-highest numbers with 225 gadgets going missing, including 200 mobile devices and eight encrypted USB pens. However, 209 of those devices went missing over the past year.

"The reality is that the majority of these devices will contain sensitive data on police investigations as well as confidential information about criminals, suspects and victims," said Andy Harcup, VP EMEA for Absolute Software.

"Everyone recognises the loss of laptops and mobiles in the line of duty is inevitable, so it's vital that forces have the necessary systems in place to track and freeze equipment when it falls into the wrong hands. This approach can help improve cyber security standards, protect the privacy of individuals and prevent criminals and opportunistic thieves from misusing police devices and stealing data."

Google Chrome is the latest browser to drop AVG and Avast extensions after reports of excessive data snooping.

Back in October, a blog post from Wladimir Palant, founder and CTO at AdBlock Plus, highlighted that browser extensions created by the two security firms were hoovering up more data than necessary to function, especially versus rivals such as Google Safe Browsing. That data, according to the post, included user ID, where you're located, and how you got to a specific page.

After that report, Mozilla and Opera both pulled the AVG and Avast extensions, though the former reinstated one set of add-ons after changes to data collection were made. Google has now reportedly also followed that lead, removing the questionable extensions.

"I didn't expect to publish this update any more, but Avast extensions are now gone from Chrome Web Store as well," Palant tweeted. "Only AVG Online Security remains for some reason. Way to go Google!" The latter has 3,582 users, according to the Google Web Store.

Avast, which bought AVG in 2016, had not replied to a request for comment at the time of publishing.

Palant highlighted in his blog post four extensions: Avast Online Security, AVG Online Security, as well as the SafePrice shopping addon from both companies. Mozilla has since reinstated the Online Security addons, but not SafePrice.

"The data collected here goes far beyond merely exposing the sites that you visit and your search history," he explained. "Tracking tab and window identifiers as well as your actions allows Avast to create a nearly precise reconstruction of your browsing behaviour: how many tabs do you have open, what websites do you visit and when, how much time do you spend reading/watching the contents, what do you click there and when do you switch to another tab."

This isn't the first time that Avast has been in trouble for data collection. Back in 2015, it was accused of using its extension to spy on users in a similar way, an accusation Avast denied in a forum statement saying all data collected was "essential" to provide the service. In 2018, the company pulled an update to CCleaner after backlash sparked by privacy settings, while in 2015 AVG was criticised for auto-installing a plugin into the Chrome browser.

Germany's Social Democrats (SPD) will decide on Tuesday whether to adopt a proposal that could ban Huawei from taking part in the rollout of its 5G infrastructure.

The outcome could place further pressure on the country's chancellor Angela Merkle who is caught between appeasing China and the US government.

Merkel's government is aiming to shore up the technical certification and scrutiny of telecoms equipment suppliers but has insisted that no country or vendor be excluded.

Critics of Merkle have suggested that her careful approach is due to a fear of Chinese retaliation against German companies that have heavily invested in its markets, according to Reuters. The Chancellor has been challenged by lawmakers in her own party as well as her SPD junior partners.

Last week SPD and conservative lawmakers agreed on a blueprint that would make it difficult for Huawei to take part in building Germany's 5G mobile infrastructure. The proposal states that suppliers from countries where "state influence without constitutional supervision, manipulation or espionage cannot be ruled out are categorically excluded from the network, both the core and peripheral", according to Reuters.

Accusations that Huawei is heavily linked to the Chinese government are well documented and are also believed to be the main reason why the company was blacklisted by the US government.

Speaking at an event hosted by business daily Handelsblatt, the Chinese ambassador to Germany, Ken Wu, said: "If Germany were to take a decision in the end that would exclude Huawei from the German market, then it should expect consequences."

"The Chinese government will not just stand by and watch. Look, 28 million cars were sold on the Chinese market last year, including seven million German cars. Could we say to one day that German cars are not safe - because we are capable of producing our own cars? No, this is pure protectionism."

IT Pro has approached Huawei for comment.

Security researchers from Purdue University and the University of Iowa have discovered nearly a dozen flaws in 5G network technology, which they say can track a victim's real-time location, create false emergency alerts, and discreetly disconnect phones from a 5G network altogether.

The researchers, using their tool called the "5GReasoner", found that 5G is still subject to some of the same exploits as 4G, despite touting a more "robust security posture" than previous cellular network generations.

The 5GReasoner discovered 11 new surveillance and disruption threats to the network by conducting a series of attacks against 5G-connected phones from a radio base station.

In one of these attacks, researchers obtained old and new temporary network identifiers of a victim's phone, which allowed them to track its location through its paging occasion. They could also broadcast fake emergency alerts by hijacking the paging channel, which could lead to "artificial chaos." Both real-time location tracking and false emergency alerts are vulnerabilities shared by 4G and 5G networks.

Another attack discovered a means to create a prolonged denial-of-service condition, which could completely disconnect a target's phone from the network for an extended period of time. It could also downgrade the phone to a less secure connection, leaving it open for law enforcement and other hackers to launch surveillance attacks.

According to one of the co-authors of the new research paper, Syed Rafiul Hussain, anyone with a working knowledge of 4G and 5G networks and a cheap software-defined radio can conduct these attacks.

Warnings over flaws in the Authentication Key Agreement in 5G first arose back in February, with the GSM Association (GSMA), which represents the global mobile communications industry, promising remedial action. The research, however, suggests they have yet to deliver.

The GSMA inducted the researchers into their mobile security hall of fame, but spokesperson Claire Cranton said the vulnerabilities uncovered were "judged as nil or low-impact in practice." The association gave no timeline or certain intention for rectifying the network's flaws.

Hussain told TechCrunch that while some of the fixes can be made in the existing network design, others will likely call for "a reasonable amount of change in the protocol."

Facebook's iOS app has been the subject of users' anger following reports of it enabling their phone's camera without permission.

According to Guy Rosen, VP of integrity at Facebook, the camera activation is the result of a bug that seems to be affecting iPhone users running the most recent iOS 13.2.2 version. Not everyone perceives it as an accident, though, with one user alleging the findings were evidence of Facebook wanting to "look into people's private lives".

The issue seems to be triggered when users expand multimedia in the app, be it an image or video, and then swipe down to return to the news feed or whatever page they were originally on.

Videos capturing the issue have been tweeted multiple times by different users. One person claimed to have tested the issue on multiple phones running iOS 13.2.2 and received the same results.

In a separate but related issue raised by a software tester on 2 November, a bug in Facebook's iOS app pushed the user automatically into a Facebook/Instagram story UI after returning the phone into portrait orientation from viewing a video in landscape.

The same individual also reported unauthorised audio being played out of Instagram even when the phone was locked.

Rosen replied to one of the numerous tweets saying "thanks for flagging this. This sounds like a bug, we are looking into it".

"We recently discovered our iOS app incorrectly launched in landscape," he added in a follow-up tweet. "In fixing that last week in v246 we inadvertently introduced a bug where the app partially navigates to the camera screen when a photo is tapped. We have no evidence of photos/videos uploaded due to this."

Facebook also said it planned to push a complete fix for the issue on Tuesday, with v247 now being the most up-to-date version.

Despite the quick patch, the news will be unwelcome for the company that has been criticised so heavily for its privacy violations in recent years.

Unconfirmed speculation from users of the Facebook platforms has alleged the apps to be 'listening' to people's conversations and using the data to target them with adverts in social feeds.

"A while ago, me and a couple of mates were talking about Formula 1 because one of them is a huge fan but the other friend and I don't really know much about it. When they got up to grab a drink, I was flicking through Instagram and a sponsored advert came up advertising the upcoming race and Sky Sports deal," one afflicted user told IT Pro. "I found it pretty strange considering I have very little interest in F1 and the advert popped up while I've been talking about it."

It has never been proven, the allegations have lingered for years and have consistently been downplayed by the company. Instagram CEO Adam Mosseri has previously denied these claims, citing "dumb luck" as an explanation.

Panda Security addressed the issue in July, saying the "more likely reason" for these user reports is down to the extensive data mining algorithms used by the company to profile its users. The company added that the only way to avoid these "spooky, invasive ads is to avoid social media altogether".

Mobile device management (MDM) is one of the most important business tools used by UK organisations. This is a system that helps IT administrators to secure and control tablets, smartphones, and computers used by employees in an organisation.

Thanks to new and modern initiatives like hot-desking and bring your own device (BYOD), and obviously the recent surge in remote working, MDM has become more and more popular in recent years. In particular, COVID-19 has led to a surge in the demand of this tool among businesses looking to take on MDM solutions. As the world of work is currently transforming into a hybrid model, it is probable this demand will continue or even grow, with UK businesses aiming to ensure endpoints distributed across their networks stay secure.

It is crucial for GDPR compliance to ensure your employees can only access the data they need, and that they are restricted from accessing other information. After all, organisations will be aiming to remain as compliant as possible to reduce the chance of getting a fine. Two ways that MDM systems can help businesses on their compliance journeys is by locking data if a device goes missing, or restricting data access for employees.

In addition to smartphones, MDM systems can manage laptops, tablets, and desktop PCs. This makes them extremely useful as they can manage cyber security risks across all workplace devices. For example, malware can be downloaded inadvertently in various ways, like through phishing attacks, and infects a number of devices regardless of their form. The best MDM systems out there will manage various devices at once, wiping or treating those infected with malware before the infection has time to spread.

Whatever your needs are from an MDM solution, there are many options available from a variety of providers. Here's a round-up of some of the best options, including offerings from IBM, Citrix and more.

Cisco Meraki

Perhaps one of the most well-known MDM platforms, Cisco Meraki allows you to manage every type of device in your business from one dashboard. No matter what you need to monitor - be it Android and iOS smartphones, or Linux, macOS and Windows PCs - you can do so. There's also an app for managing devices while not at your computer, monitoring usage and making sure all data is safe and sound.

Cisco Meraki offers a bumper feature set, enabling you to enforce device security policies, deploy software and apps, and perform remote troubleshooting if any problems arise, monitoring calls and more on the devices across your network. Every device managed and monitored is regarded as a separate device, even if they're linked. This means you can, for example, allow certain apps to run on an employee's iPad but not on their linked smartphone.

Cisco Meraki enables all of this to happen over the network, so even if you're trying to manage remote employee devices, it's a breeze. You can keep tabs on everything without anyone needing to be on the same network. It’s also easy to test-drive the platform with a browser-based demo with slated network devices and users. Plus, you can request trial hardware and get technical support to help with setup.

Pricing: Available upon request

IBM MaaS360

IBM entered the MDM market following its acquisition of Fiberlink Communications back in 2013. Since then, Big Blue has been making some big improvements to its flagship MDM product. The service, which is powered by Watson AI, will easily integrate with existing IT infrastructure, enabling you to manage a diverse, complex endpoint and mobile environment.

IBM Maas360 also puts security at the forefront, securing and containing data accessed by users and keeping corporate apps and content separated while allowing for easy removal and access revocation. Its integrated threat defence also proactively shields corporate data.

IBM might not be the cheapest out there - especially since some of the services that you'd find bundled with other providers come at an additional cost - but with IBM's lengthy experience in enterprise security, you know you're getting a good quality solution for your money.

Pricing: From $4.00 (£3.32) per client device per month

Hexnode MDM

Hexnode MDM lets you provision and manage devices, and prides itself on a user-friendly design. Users can add their own devices by connecting to the network or by using a portal installed on your company's website or intranet. Their device will then be added using their Active Directory credentials.

Once the devices are added, you can manage them whether they're connected to the corporate network or being used remotely. That means you can push configuration settings to the device, restrict functionality, manage mobile applications (including blocking App Store downloads and implementing a black/whitelist), check and enforce compliance and even remotely lock and wipe devices.

Hexnode MDM also offers a 30-day free trial if you want to get give it a test run.

Pricing: From $1.08 (90p) per device/month

Soti MobiControl

Soti allows you to manage Android, iOS, Linux, macOS, and Windows devices from one place, for the entire lifecycle of the device within the organisation. They can be provisioned when first added to the company's fleet of devices, managed throughout their service and then wiped when it comes to retirement.

The platform was designed for use with ruggedised devices often used by fieldworkers and the healthcare, logistics, retail, and transport sectors.

The MDM platform can be installed on-premise or deployed on Soti's cloud. You can add devices to the platform using its Express Enrollment feature, which automatically delivers the settings, apps, and files a user needs over the air to get them up and running.

Pricing: Available on request

Citrix Secure Private Access

Citrix Secure Private Access, formerly known as Citrix Endpoint Management, is a zero trust network access tool with MDM functions. It allows the containerisation of business apps and personal apps, making it best suited to BYOD workplaces. Every device, including desktop PCs, smartphones and tablets, can be managed from one centralised console and devices don't even need to be enrolled to benefit from MAM, too.

As well as allowing the device owner to use a device provisioned and managed by the organisation, Citrix Secure Private Access has also been designed to let multiple users have access to one mobile device. This is particularly useful for industries such as healthcare, where field workers and emergency service workers may need shared ownership of one device.

However, it's likely one device will need applications and service provisioned with different access rights and this can be set up simply with Secure Private Access's MAM capabilities. IT managers can also lock down the device depending on the network location, stopping staff from using certain features outside of the corporate network.

Pricing: From $3 (£2.52) per device/month

VMware Workspace ONE

VMware Workspace ONE (formerly called Airwatch prior to its VMware acquisition) offers endpoint protection for all devices, regardless of the operating system, with full device management, whether it's a BYOD or shared corporate device.

You are able to deploy and manage any app via the platform's app catalogue, whether employees are trying to access them natively, on-device, via the web or remotely. The layered security across the individual user, endpoint, data, and network can all be centrally managed using the same mobility platform too.

Workspace ONE uses automation to carry out many everyday MDM tasks, which reduces the strain on IT staff. You don't have to manually provision or enrol devices - this happens without the need for any manpower, making it a perfect option for resource-stretched businesses.

Pricing: From $1.66 (£1.39) per device/month

The future of mobile device management

With life now beginning to return to offices across the world, it’s never been more important to ensure your organisation’s workers have great security. It’s likely that this will keep being seen by IT departments as one of their biggest challenges too.

Part of this is because of how popular hybrid working has become in recent times. There have been a number of attempts to make this the mainstream, including by the likes of Salesforce, which decided in February 2021 to offer employees the choice of three models for working. These were office-based in San Francisco, flex, or fully remote. This is a big step considering that approximately 18% of employees at the company were fully remote before the pandemic, compared to 50% by June 2021.

Some companies have gone an extra step, such as Airbnb, which told employees in April 2022 they can work from “anywhere”, regardless of the country they live in. The company’s new remote work policies stated that employees could also enjoy up to 90 days of work abroad.

Despite these benefits, combining in-office working with remote might be problematic when it comes to security. This is because the lines between what constitutes a home or work device inevitably blur, even if the organisation provided the employee with dedicated hardware. Importantly, it also involves workers regularly accessing their private networks at home, with the risk of falling victim to a wider variety of threats, and even transferring malicious software over to an organisation’s network when they work from the office. Companies not only have to think about adopting a clear BYOD policy, but also be extra vigilant when it comes to the security of their network.

With more employees making their way back to company property, even in a hybrid work model, MDM solutions are going to have a big role to play not only when it comes to security, but in GDPR compliance too. Bear in mind, however, this can come at a high cost. Decide which MDM option would be best for your business before investing anything. It’s also best to think about the scalability and price of the software, how good its security is, and how many devices or employees it’s able to support. Obviously, there are other things you’ll need to bear in mind before buying your ideal MDM solution, but this is a good place to start.

Of course, it would also be helpful to devise the appropriate MDM business plan on whether you are likely to see an ROI. However, security should be of paramount importance to any business. Failing to protect data can be catastrophic for a business, so there's no excuse not to take every measure to make sure your business stays afloat.

The number of security bugs affecting Android devices has fallen sharply in the first half of this year, although the proportion of these which are deemed 'critical' has risen.

Up to June, there have been reports of 86 flaws affecting the Android operating system (OS), versus 611 flaws listed for the whole of 2018; suggesting this will decrease abruptly compared against previous years. The proportion of 'critical' flaws, on the other hand, rose from 49% in 2018 to 68% this year.

Meanwhile, Apple's iOS saw a 25% rise in vulnerabilities detected compared to 2018, 155 for the first six months of the year, and almost double those found in the Android OS. The proportion of these considered critical is approximately 20%, however.

Figures from ESET's We Live Security platform outline the state of mobile OS security for the first six months of the year; taking into account the number of vulnerabilities registered as well as incidents of malware detection.

As well as fewer bugs, Android has also experienced fewer malware detections in 2019. This figure declined 8% versus the first half of 2018 and 10% against the second half of last year, following a steady decline from a peak in 2016.

By contrast, iOS malware is on the rise, increasing a staggering 43% against the first half of 2018. The number of new malware variants remains low, however, which suggests that cyber criminals are more interested in developing ways to breach devices on Android, which has a larger number of users.

The research highlighted a number of prominent examples of malware incidents hitting devices in the first half of the year. Recent examples include one in which iPhone users were subject to a previously corrected bug being reopened by a faulty update that allowed cyber criminals to jailbreak iOS.

Another prominent incident, which affected both systems, was a vulnerability with WhatsApp that allowed hackers to covertly install spyware on users' phones and track their communications and location data.

"Although mobile systems have been designed with a security perspective and are sometimes safer than traditional technologies, we must not forget that the risks are still latent," said We Live Security researcher Denise Giusto Bili.

"Beyond favoritism, we must always keep in mind that no system is invulnerable and that education and prevention are inescapable to use mobile technologies safely."

Bili also warned that in addition to threats facing the two most widely-used mobile systems, there are multiplatform risks that are associated with third-party apps, for instance, another flaw in WhatsApp that allowed quoted messages to be altered.

Researchers have found a fundamental security flaw in modern Android phones that facilitates advanced SMS phishing attacks.

Phones made by Huawei, LG, Samsung and Sony were all vulnerable to the attack, which involves an attacker tricking a user into accepting new phone settings that can reroute phone data back to the criminal.

Check Point researchers showed how attackers could leverage over-the-air provisioning (OTA) used by the affected phones

Check Point researchers also discovered that OTA, which is usually used by network operators to deploy network-specific settings to a new phone joining their network, can be hijacked using a $10 dongle.

The authentication methods used by OTA are limited, according to Check Point, and this limitation can be exploited to send messages which appear to be from the network operator to the user, but actually redirect internet traffic back to the attacker.

All affected phones allow weakly authenticated messages to reach the user, while Samsung additionally allows completely unauthenticated messages to reach its users.

Armed with a cheap dongle or a phone running in a modem mode, attackers can either send messages tailored for specific targets or sent out in bulk in a 'spray and pray' style of attack.

These specially crafted messages can change the MMS message server, proxy address, mail server, directory servers relating to contacts and calendars and browser homepage and bookmarks.

A message to a Samsung user will typically ask them if it can change the client provisioning settings. If a user accepts this after being taken through to the phone's settings without passing any authentication checks, then the malicious settings will be applied.

The attacker has a slightly tougher time with Huawei, LG and Sony phones. Of the two methods available, the first involves obtaining a victim's International Mobile Subscriber Identity (IMSI) number using a reverse IMSI lookup checker and once the IMSI has been acquired, a phishing attack can then be authenticated and deployed as easily as done on Samsung phones.

When an IMSI cannot be found, the attacker can instead send two messages, one which appears to be from the victim's network operator containing a PIN and the second malicious message, authenticated with the aforementioned PIN, asking to change the phone's settings. All a user would have to do is enter the PIN and the attack would be mounted.

"This is a demonstration of how sophisticated the bad guys are getting. Five years ago, this type of attack could have been included in the plot of some high-tech spy movie, but now it is being used by regular, run of the mill bad guys," said Erich Kron, security awareness advocate at KnowBe4.

"People should be very suspicious any time they receive an unsolicited text message that is asking them to enter a PIN or any other authorisation, even if it appears to come from the carrier.

"If they receive something like this, they should immediately contact the carrier through their customer service number and ask if this is legitimate," he added.

Since the researchers disclosed the vulnerabilities to the manufacturers in March 2019, Samsung and LG have both issued fixes.

Huawei said it's future Mate and P-series phones will be sold with UI fixes to address the issue while Sony refused to acknowledge the vulnerability report at all.

Researchers have discovered a flaw in Bluetooth authentication protocols which allows hackers to listen in on conversations conducted via Bluetooth devices or to change the contents of file transfers.

The attack is codenamed KNOB, which stands for 'Key Negotiation Of Bluetooth', and was discovered by three international researchers: Kasper Rasmussen from Oxford University, Daniele Antonioli from the Singapore University of Technology and Design, and CISPA Helmholtz Center for Information Security's Nils Ole Tippenhauer.

The KNOB attack works by forcing the participants in Bluetooth handshake to use an encryption key with just one byte of entropy, allowing an attacker to brute-force the key. They are then able to insert valid, cryptographically-signed data into the transfer, or to eavesdrop on data (including the audio of phone calls) being passed between devices.

"As a result, the attacker completely breaks Bluetooth BR/EDR security without being detected," the researchers wrote in the technical paper explaining the flaw.

KNOB attacks are completely undetectable to the victims, as it attacks the key negotiation itself. It also doesn't violate the agreed Bluetooth industry standards, as one byte is the minimum level of entropy permitted by all BR/EDR standards, which also do not require that key negotiation protocols are secured. In short, this means that the firmware of any standard-compliant Bluetooth chip is vulnerable.

The researchers tested the exploit on 17 different Bluetooth chips across 24 different devices, including chips from Apple, Intel, Broadcom and Qualcomm. All the tested devices were found to be at the mercy of KNOB attacks. The vulnerability was disclosed to the Bluetooth industry - via the Bluetooth Special Interest Group (SIG), the CERT Coordination Centre and the International Consortium for Advancement of Cybersecurity on the Internet - in November last year.

"After we disclosed our attack to industry in late 2018, some vendors might have implemented workarounds for the vulnerability on their devices," the researchers said. "So the short answer is: if your device was not updated after late 2018, it is likely vulnerable. Devices updated afterwards might be fixed."

The vulnerability, which has been designated as CVE-2019-9506, has now been addressed by the Bluetooth SIG, which has updated the core Bluetooth specification to recommend a minimum of 7 bytes of entropy for encryption keys. While it is urging vendors to patch their products to prevent the attack, the SIG has also advised that the chances of hackers exploiting the vulnerability in the wild are slim.

"For an attack to be successful, an attacking device would need to be within wireless range of two vulnerable Bluetooth devices that were establishing a BR/EDR connection," an advisory note from the Bluetooth SIG read. "If one of the devices did not have the vulnerability, then the attack would not be successful. The attacking device would need to intercept, manipulate, and retransmit key length negotiation messages between the two devices while also blocking transmissions from both, all within a narrow time window."

"There is no evidence that the vulnerability has been exploited maliciously and the Bluetooth SIG is not aware of any devices implementing the attack having been developed, including by the researchers who identified the vulnerability."

Researchers have discovered more than 1,000 Android apps have the power to share and receive personal information even when the user explicitly forbids the collection of data.

The findings were presented to attendees at PrivacyCon 2019 in the US, and they don't just focus on obscure apps. Indeed, big name firms including Disney and Samsung were cited for releasing apps that flout the privacy conventions users have come to expect.

All of the affected apps share one commonality - they all run on the same software developer kit (SDK). The one in question here is made by Chinese tech giant Baidu with help from an analytics firm called Salmonads.

SDKs are sets of tools given to developers to make building applications easier - like a framework on which to base the project instead of having to code it all from scratch. It's like if all VW Polos, Audi S3s and Ford Focus' were built using the same axel - they're all different but share the same backbone.

Let's imagine there are two apps: App 1 and App 2. Both are built on the same Baidu SDK but the user has revoked permissions for App 1 to collect personal data. The user hasn't revoked App 2's data collection permissions, though. So, because of this, App 1 can still gather data from App 2's collection as they're both built on the same SDK.

In terms of what data has actually been collected, it's a bit of a mixed bag. Device MAC addresses were the most pervasively collected forms of data, but router MAC addresses and device IMEI numbers were also collected. In one particular case, GPS data was also gathered.

The app that collected GPS data is called Shutterfly and has been downloaded more than 138,000 times on the Google Play store at the time of publication. It collected GPS data using EXIF metadata from user images and sent it back to its own servers with no location permission.

"While this app may not be intending to circumvent the permission system, this technique can be exploited by a malicious actor to gain access to the user's location," read the study. "Whenever a new picture is taken by the user with geolocation enabled, any app with read access to the photo library can learn the user's precise location when said picture was taken.

"Furthermore, it also allows obtaining historical geolocation fixes with timestamps from the user, which could later be used to infer sensitive information about that user," it added.

In reference to the apps acquiring MAC address information, the researchers said Android natively protects access device and router MAC addresses with separate permissions. Regardless, they still observed apps accessing the addresses without having the permissions.

The apps gained access to the addresses with side-channels, using C++ native code to invoke a number of unguarded UNIX system calls. These methods were referred to as "deceptive" which could mislead even the most diligent user.

The US' Federal Trade Commission (FTC) has fined mobile operators and third-party libraries for exploiting side-channels and using MAC addresses to infer a user's location.

The researchers said that with the next version of the mobile operating system Android Q which is currently in beta, some of the issues outlined by their findings will be fixed, but that might not be good enough.

Android OS updates are not mandatory and many users, according to statistics, aren't very diligent when it comes to upgrading to the latest version - just 10.4% of Android users are on the latest Android 9 Pie installation, for example.

Loyalty to an operating system can sometimes be compared to that of a football team or a political party. And this is certainly the case when it comes to Android vs iOS. Most iPhone users are Apple-til-they-die and can be keen on pointing this out at any given moment. These are the 'brand lovers' that wittingly chose vendor lock-in and have MacBook's and iPads to go with their iOS-based smartphones.

While there are many solid reasons to be an Apple-ite, the world's most popular mobile operating system is actually Android. With Google's OS, user can choose pretty much any other smartphone manufacturer (except Huawei) and arguably enjoy more interoperability with different laptop, tablet and smartphone ranges.

You may have one or the other as a consumer, but what should you do as a business? Do you kit your employees out with the best of Apple or do you sign them up to Google's Android and let them have a bit more device choice?

Unfortunately, there's a lot more to it than that. Security is arguably the most pressing concern for businesses – particularly as most will have been working remotely and look set to continue doing so. Then there are key details such as cost, compatibility, how easy it is to instal, use and learn. You may be an Apple aficionado, but does Jeff in accounting know his way around an iPad?

These are the consideration you need to make when choosing a business-wide operating system. Just like being Liverpool or Everton, Labour or Tory, you can be Apple or Android (or neither if you find a niche OS).

Android vs iOS: Hardware choice

Although we are mainly focusing on the operating systems, your choice will almost certainly be led by the hardware they support. It is very unlikely that a consumer will choose an iPhone because they prefer iOS as it is usually a case of having iOS because it is on the iPhone they want.

So, the choice of hardware is a little more limited on Apple's iOS as it only offers iPhones. However, now is a pretty good time to go for one as they've had a strong couple of years. The current crop includes the iPhone 14 Pro –with iOS 16 – which has some of the best camera and video technology around. The design is also pretty much the same as the iPhone 13 and iPhone 12, both of which are very high-quality devices – with these, you can also get an iPhone mini. There is also the more budget-friendly iPhone SE, which has an older design and none of the fancy features.

With more than 1 billion of them in circulation, the iPhone is the world's most popular smartphone, however, this doesn't automatically mean iOS is the most popular mobile OS. That title is taken by Android and the main reason for this is because it works with more manufacturers. So while iOS only works on Apple iPhones, Android is used by Samsung, Sony, Google (of course), OnePlus... practically every other brand.

Overall levels of choice is the biggest bonus of being on Android and not just choice of brand - there are more different types of handsets available here, from standard 6.1in screens to massive phablets, such as the Samsung Galaxy S22 Ultra. Plus, it gets bigger still as you have a number of foldable devices on offer, such as the Z Fold 4 and the Huawei Mate Xs2.

Android vs iOS: Design

The latest version of Google's OS is a far cry from the days of clunky Android KitKat. Android 12 is a more slick and gorgeous experience with a plethora of features that help it to adapt to users' preferences. The Material You interface allows users to change themes and colours to their own preferences, even adapting from their own wallpaper uploads – a feature that isn't available on iOS.

However, Apple's OS has an established reputation for its simplicity and ease of use. The learning curve for new users is astonishingly low, and its commands and functions are simple to pick up. The design is based heavily on the idea that most users don't really need all the adjustable bells and whistles that platforms have normally offered. Google's Android system, meanwhile, suffers from its reputation as being a little confusing to navigate. By contrast, this offers an insurmountable depth of customisation, but much of this is hidden deep inside menus and interfaces.

One of the main issues with designing your user interface to be overly simplified, however, is that it normally comes at the cost of functionality. By default, iOS just doesn't give you the kind of space to adjust your user interface, or its functionality, to make it stand out in the same way you can with Android devices. Google's OS is so much more feature-rich, offering greater customisation options and an array of settings to tweak your device to fit your precise needs.

While iOS on iPhones looks great, it has conventionally shone on tablets where the software can take advantage of powerful multitasking features supported by superb Apple processors. The laptop-style experience you can create on an iOS tablet is simply far superior to anything an Android unit can offer. Having said that, however, Apple will soon roll out a dedicated iPadOS, breaking free of the iOS mould with specially-tailored software.

Android vs iOS: Compatibility

The iPhone is the most popular device in the world, so it's absolutely no surprise that software makers and accessory manufacturers generally choose to prioritise it over Android. This means if you've got an Apple device, you can all but guarantee whatever app, platform, plugin or attachment you want to use will be supported – though there are some companies that take issue with its 30% app store tax, so not all are available.

Another potential issue for some users will be the fact that Apple has chosen to remove the headphone jack on later devices. This isn't a major problem, given that there's a Lightning to 3.5mm jack adapter supplied in the box and Bluetooth headphones are widely available. And although some devices, such as the Samsung Galaxy S20, have ditched the headphone jack too, an Android device may be a better option if you're dead set on the 3.5mm port – though it is very rare to see one at all.

Connectivity is a consideration if you want a USB Type-C connection as that is the default for seemingly all modern Android devices. Apple's handsets are all on its lightning cables, though EU court rulings may change that for future iPhones.

Android vs iOS: Security

Mobile security is too often overlooked by businesses, but if you're issuing devices to your employees, you should make certain that they're as secure as humanly possible. The list of vulnerabilities, exploits and other security flaws that have been discovered in the Android OS is long and extensive, as is the list of malware-riddled apps found on the Google Play Store.

iOS benefits from a better reputation, but it's far from unhackable. Recent notable flaws include the HomeKit bug and the Meltdown/Spectre debacle. Instances of major exploits in Apple's devices are much, much fewer than on Android, however, and it benefits from faster software rollouts, too. Apple can push updates to all of its handsets directly, whereas Android users must wait until their phone maker has implemented a version of Google's update that works with its own Android skin.

Android vs iOS: Verdict

Android has millions of fans around the world, and with good reason; it's matured into a powerful and versatile operating system, with heaps of functionality. With time, the OS has offered a smoother user experience and a more aesthetically-designed interface too. However, for business devices, the fact is that Apple's software remains king of the hill.

iOS is slick, easy to use, good-looking and boasts absolutely stellar security and privacy features. While it's not without its flaws, the benefits far outweigh the disadvantages, and for corporate devices, iOS should still be your first port of call.

A significant firmware update to Nokia's flagship handset has seemingly exacerbated widely-reported issues with the Nokia 9 PureView's fingerprint scanner.

With version 4.22 came a number of sweeping changes to the Nokia 9 PureView, including an improved user interface (UI) and better functionality. This aimed to address a number of problems reported at launch, including an in-screen fingerprint scanner that required a significant push of the finger to register.

But these issues have seemingly become much worse after the update rolled out last week. This has been illustrated by one Twitter user unlocking the device with somebody else's finger, and then just a packet of chewing gum. They also alleged the PureView can be unlocked using a coin, or leather gloves.

Among the Nokia 9 PureView's greatest strengths is a five-lens camera setup, and a unique Qualcomm Snapdragon 845 processor made especially to cope with this configuration. But its imperfect in-screen fingerprint scanner was among the most widely-cited gripes when IT Pro and other publications handled the device.

The Android Pie V4.22C update, released on Thursday, was also supposed to address slow UI issues when using the camera, as well as reported issues affecting the facial recognition unlock feature.

The user that reported the flaw, Decoded Pixel, said their device was on the latest April security update, using a UK SIM and on the Virgin Mobile network. They conceded this could also be a hardware defect with their specific device.

While many in the security industry have highlighted major weaknesses in password security, this represents how easily layers of biometric security can be bypassed if supported with faulty software.

The technology underlining biometric security in smartphones, meanwhile, is relatively new and by all means a work in progress. The Huawei Mate 20 Pro was similarly marred by a glitchy in-screen fingerprint scanner upon reviewed, albeit not on the same scale as the Nokia 9 PureView's issues.

IT Pro approached Nokia for a statement but did not hear back at the time of writing.

The Samsung Galaxy S10's 'ultrasonic' in-display fingerprint reader can be easily unlocked with a 3D-printed fingerprint, allowing hackers to break through the device's biometric security.

The exploit was discovered by a Reddit user going by the names of 'darkshark9', who cloned his own fingerprint from a photograph of the print left on a wine glass. Using common software tools Adobe Photoshop and Autodesk 3ds Max, he created an accurate replica of the print using a home 3D printer costing less than 400.

In a proof-of-concept uploaded to Imgur, darkshark9 showed the device being unlocked by the fake print, stating that "the 3D print will unlock my phone...in some cases just as well as my actual finger does".

"If I steal someone's phone, their fingerprints are already on it," he explained. "I can do this entire process in less than three minutes and remotely start the 3D print so that it's done by the time I get to it. Most banking apps only require fingerprint authentication so I could have all of your info and spend your money in less than 15 minutes if your phone is secured by fingerprint alone."

The photo used in the exploit was taken with the S10+ itself, but he also theorised that by using a higher-quality DSLR camera, you could steal someone's digit "from across a room... or further".

The S10's in-display fingerprint reader was one of the main selling points of the new device, with Samsung saying its biometric security "provides a high level of protection for sensitive data". However, most security experts agree that using biometric security as a primary unlock method is less secure than a password or PIN.

Multiple tests have shown that the facial recognition technology used to unlock many smartphones is not foolproof, and Samsung itself advises during the setup of facial recognition that it is "considered less secure than other lock types".

However, when we reached out to Samsung, the company dismissed concerns about the hack, calling the phone's security "vault-like".

"The Galaxy S10's in-display Ultrasonic Fingerprint Scanner offers vault-like security that has been developed through rigorous testing to provide the level of accuracy and prevent against attempts to compromise its security, such as images of a person's fingerprint."

Samsung argued that the hack wasn't a threat, as it required using professional software and a 3D-printer, and that the copy "could only have been made under a very rare combination of circumstances". Both pieces of software used in the hack offer free trials, while the 3D printer used is available for less than 400, making it comparatively easy for even an amateur hacker to assemble the necessary toolkit.

"If at any time there is a potential vulnerability identified, we will act promptly to investigate and resolve the issue," Samsung said.

Researchers have discovered a collection of flaws in the Long-Term Evolution (LTE) standard, which could allow an attacker to send spoof messages and intercept data traffic.

A team with the Korea Advanced Institute of Science and Technology Constitution (KAIST) have discovered 51 vulnerabilities with the 4G standard, including 15 known issues and 36 previously undiscovered flaws.

They discovered this set of flaws using a code-testing technique known as 'fuzzing'. The KAIST researchers used a tool dubbed 'LTEFuzz' to feed large amounts of random data into identified processes to test them for potential anomalies.

The vulnerabilities unearthed span a broad spectrum, varying in nature and severity. They range from a flaw that could allow an attacker to disconnect a victim from their mobile network, to one that permits the eavesdropping and manipulation of data communications.

Tests were conducted across several devices on two high-profile mobile network operators. The KAIST team was intrigued by the fact that on the same operator, two core networking components from different vendors could present different vulnerabilities. The same was also true for two components from a single vendor, but deployed across different operators.

The full list of vulnerabilities discovered can be found at the foot of the team's 16-page report, which they are planning to present publicly at the IEEE Symposium on Security and Privacy in May.

"LTEFuzz successfully identified 15 previously disclosed vulnerabilities and 36 newvulnerabilities in design and implementation among the different carriers and device vendors," the researchers noted.

"The findings were categorized into five vulnerability types. We also demonstrated several attacks that can be used for denying various LTE services, sending phishing messages, and eavesdropping/manipulating data traffic."

LTE is a networking standard that offers slightly slower speeds than 'true 4G', but is widely used by network operators and marketed as 4G. However, as the hype behind 5G continues to gain momentum in 2019, researchers have been discovering a series of flaws in the protocols that underpin the next-gen technology.

Academics in February, for example, discovered three flaws in 5G that exploit a handset's paging protocol, allowing an attacker to track somebody's location, spoof text messages and block messages altogether.

But as manufacturers gear up to launch a wave of 5G-ready handsets, 4G will continue to be used by a vast cross-section of the public and businesses in the UK.

The KAIST researchers said they have no plans to release their LTEFuzz tool in any public capacity because it can be used for malicious purposes. The team does, however, plan to share LTEFuzz with mobile network operators and device vendors.

Researchers have outlined two separate malicious campaigns that have collectively infected more than 200 Android apps that have surpassed the 250 million download milestone.

Both campaigns, which centre on adware and data-scraping respectively, are targeting Android users only, and have infected a host of applications by fooling developers into using malicious software development kits (SDKs).

The more prominent campaign of the two, dubbed 'SimBad' because it primarily affects simulation games, has infected 206 apps which have been downloaded a combined 150 million times, according to Check Point Research.

The malware itself lives in the ad-related 'RXDroider' SDK, provided by 'addroider.com' and adopted by a swathe of developers.

Once the user downloads and installs one of the infected apps, SimBad registers itself to the device and is allowed to perform actions autonomously. After installation, the malware then connects with the command and control server to receive orders. These may range from opening a browser with a given URL to removing the app icon from the launcher.

The app's three-pronged capabilities include showing ads, opening phishing pages, and exposing users to other applications. The attackers are also able to install a remote application from a designated server, allowing them to further infect users with malware at their discretion.

"With the capabilities of showing out-of-scope ads, exposing the user to other applications, and opening a URL in a browser," the researchers said, "'SimBad' acts now as an Adware, but already has the infrastructure to evolve into a much larger threat."

CheckPoint Research also outlined 'Operation Sheep' in a second report yesterday. This involves a group of Android apps harvesting contact information from users' phones on a mass scale without their consent.

This malware has similarly been loaded in an SDK built for data analytics, and has been seen in up to 12 different Android apps to date. These have been collectively downloaded over 111 million times.

The SWAnlaytics SDK has been integrated into a dozen seemingly innocuous Android apps published on third-party Chinese app stores such as the Huawei App Store, Xioami App Store and Tencent MyApp.

The researchers first encountered a sample of the infection in September 2018, and have traced a data-scraping path that leads to servers owned by Shun Wang Technologies. Once the malicious apps are installed, entire contact lists are uploaded to the firm's servers, according to Check Point Research.

They also noted in the Tencent MyApp store alone, eight of 12 infected apps collectively amassed 111 million downloads.

"In theory," the researchers speculated, "Shun Wang Technologies could have collected a third of China's population names and contact numbers if not more."

They added with no clear declaration of data usage form Shun Wang, nor regulatory supervision, data could easily be traded within underground markets and abused in a variety of ways. These may range from rogue marketing to friend referral program abuse.

"Compared to financial data and government-issued ID document information, personal contact information is often treated as less sensitive data," the researchers said.

"According to popular belief, it requires extra effort to exploit such data while potential profits do not match a hacker's effort. Hence it is unlikely to be targeted.

"However, the landscape is changing with deep specialization in underground markets and new "business models" available to profit from such personal contact data."

Facebook has added biometric authentication to WhatsApp, allowing users to better prevent unauthorised access to their conversations.

The new feature is currently only available to iOS users, and can be accessed by updating the app to version 2.19.20 from the Apple App Store and going into the settings menu and selecting 'account', 'privacy' and then 'screen lock'.

Android users, meanwhile, are still restricted to version 2.19.17, which does not include biometric support. According to info from WAbetainfo.com, however, the feature is set to be introduced to Android devices with version 2.19.3.

The app now supports both Touch ID and Face ID, meaning that even if your device is unlocked, snoopers won't be able to read your messages - although message previews and quick replies in notifications will still be accessible, assuming you've activated this feature. The feature uses an app-wide locking system, which means that you can't protect individual chats with fingerprint or face recognition - just the whole app.

The new security features follow CEO Mark Zuckerberg's announcement that Facebook was planning to merge the backends of WhatsApp, Instagram and Facebook Messenger into a single platform, raising the possibility that biometric security could soon be introduced to Facebook's other apps.

WhatsApp is currently the only major Facebook-owned app to support biometric authentication, although rumours indicated that it was being internally tested for Facebook back in 2017. WhatsApp also uses end-to-end encryption to secure chats, which Instagram and Messenger currently do not. Data protection authorities have already started expressing "urgent" interest in what the potential merger could mean for data privacy.

Researchers have discovered a critical security flaw in the upcoming 5G network protocol which could facilitate the eavesdropping of calls and man in the middle attacks.

Although we are yet to experience the blistering speeds 5G promises to provide in the UK, fears of its security have largely been theoretical and speculative as of late, until the research, conducted by research firm SINTEF and academics from ETH Zurich and Germany's Technische Universitt Berlin, made a more concrete claim.

The flaw, which also affects older 3G and 4G protocols, can be used to create new ISMI-catchers, which are devices that break encryptions of cellular communications, allowing attackers to monitor the communications passing through a virtual mobile tower under control of the attacker.

The research paper indicates that the vulnerability lies in the Authentication and Key Agreement (AKA) which is a "challenge-response protocol mainly based on symmetric cryptography and a sequence number (SQN)".

What is AKA?

AKA works by establishing and negotiating public keys which are used for encrypting two ends of a phone line.

3G and 4G network protocols were both subject to the vulnerabilities in the AKA so the security was enhanced in preparation for 5G by using randomised asymmetric encryption to protect identifiers prior to authentication.

Despite the increase in protection, researchers have found a vulnerability in the AKA that affects 5G as well as previous generations of cellular connectivity.

The potential damage

The new ISMI-catchers work differently to previous iterations which could intercept mobile traffic metadata. New versions can intercept details about a mobile user's activity such as the number of calls and texts sent, allowing the attacker to create individual profiles for each user.

These profiles, the researchers explained, can be tracked after the user leaves the vicinity or catchment area of the fake mobile tower. The profile made of a user can also alert the attacker when the user re-enters the coverage zone of the fake tower, which has more severe implications than it first appears.

Although privacy cannot be broken after the user leaves the range of the fake tower, the location of the user can. This means attackers can potentially track the location and activity of high ranking politicians, for example.

"Assuming an adversary having a fake base station nearby an embassy, he not only can learn the officials' activity when they are at the office during working hours but also when they are not, including during evening and nights (e.g., at home) or during business trips," say the researchers. "Therefore, such an attacker may learn if targets use different SIMs cards for private use (no activity at home). It may also infer if some specific time periods (e.g., one evening and night) were specifically busy (a lot of calls or SMSs were made yielding a big rise of SQN)."

When can we expect a fix?

The complete and dedicated fix which is required to mitigate the attack created by the researchers isn't likely to arrive until the end of 2019.

This means for users in the US and Australia, two countries in which consumer 5G networks are already active, the threat will be real for quite some time.

The earliest estimates for a 5G rollout in the UK are August 2019 with a more thorough rollout estimated to happen in 2020 which means the UK may not experience such vulnerabilities if the fix is made in time.

"We followed the responsible disclosure procedure and reported our findings to the 3GPP [the standards body behind 5G], GSM Association (GSMA), several manufacturers (Ericsson, Nokia, and Huawei), and carriers (Deutsche Telekom and Vodafone UK)," the research team said.

"Our findings were acknowledged by the 3GPP and GSMA, and remedial actions are underway to improve the protocol for next generation," they added. "While 5G AKA will suffer from our attack in the first deployment of 5G (Release 15, phase 1), we are still hopeful that 5G AKA could be fixed before the deployment of the second phase (Release 16, to be completed by the end of 2019)."

Fuel to the fire

This news certainly doesn't mark the first piece of concern surrounding the security of 5G networks.

The increased bandwidth that will facilitate lighting-quick download speeds will also provide a base for, what some theorise, more widespread and damaging DDoS attacks harnessed by insecure IoT devices being leveraged to create expansive botnets.

Devices such as printers, fridges, baby monitors and security cameras could all be used, just like they were in the Dyn cyber attack of 2016, to unleash attacks that could not just down websites, but also infrastructure controlling essential services like electricity providers and banks.

"The fact that 5G increases the speed means that it takes even fewer of them to overwhelm a given organization because now you can get an exponential rate of traffic directed to someone," said Stuart Madnick, professor of IT at MIT to Inverse. "The worst is yet to come."

"It's like going from fireworks to dynamite sticks," he says. "5G encourages further evolution and expansion of Internet of Things related networks. All of the good news and bad news that comes along with this technology gets magnified."

Concerns also surround 5G's application in the autonomous car sphere. With accidents already happening in self-driving cars, some think 5G will provide a platform on which the technology can thrive.

What's more concerning is the thought that researchers are still finding vulnerabilities which facilitate man in the middle attacks in AKA technology on which we have relied for years to protect our cellular privacy and security.

5G's security concerns will persist for some time and only time will tell how appropriate the technology is to underpin advancements such as autonomous cars and remote surgeries.