Cadastre-se agora para um orçamento mais personalizado!
Oscar Wong / Getty Our mobile devices are now the keys to our communication, finances, and social lives -- and because of this, they are lucrative targets for cybercriminals.
Whether or not you use a Google Android or Apple iOS smartphone, threat actors are constantly evolving their tactics to break into them.
This includes everything from basic spam and malicious links sent over social media to malware capable of spying on you, compromising your banking apps, or deploying ransomware on your device.
Phishing occurs when attackers send you fake and fraudulent messages. Cybercriminals attempt to lure you into sharing personal information, clicking malicious links, downloading and unwittingly executing malware on your device, or handing over your account details -- for a bank, PayPal, social network, email, and more.
Also:What is phishing? Everything you need to know
Mobile devices are subject to phishing through every avenue PCs are, including email and social network messages. However, mobile devices are also vulnerable to smishing, which are phishing attempts sent over SMS texts.
Regarding phishing, it doesn't matter if you are using an Android or an iOS device. To fraudsters and cybercriminals, all mobile devices are created equally.
Your best defense:Don't click on links in emails or text messages unless you can be 100% they're legit.
Many of us forget an essential security measure: physically securing our mobile devices. We may not use a PIN, pattern, or a biometric check such as a fingerprint or retina scan -- and if so, we are making our handset vulnerable to tampering. In addition, if you leave your phone unattended, it may be at risk of theft.
Your best defense:Lock down your phone with a strong password or PIN number, at a minimum, so that if it ends up in the wrong hands, your data and accounts can't be accessed.
SIM hijacking, also known as SIM swapping or SIM porting, is the abuse of a legitimate service offered by telecom firms when customers need to switch their SIM and telephone numbers between operators or handsets.
Also:Here's how I survived a SIM swap attack after T-Mobile failed me - twice
Usually, a customer would call their telecom provider and request a switch. An attacker, however, will use social engineering and the personal details they discover about you -- including your name, physical address, and contact details -- to assume your identity and to dupe customer service representatives into giving them control of your number.
In successful attacks, a cybercriminal will be able to redirect your phone calls and texts to a handset they own. Importantly, this also means any two-factor authentication (2FA) codes used to protect your email, social media, and banking accounts, among others, will also end up in their hands.
SIM hijacking usually is a targeted attack as it takes data collection and physical effort to pull off. However, when successful, they can be disastrous for your privacy and the security of your online accounts.
Your best defense:Protect your data through an array of cybersecurity best practices so that it can't be used against you via social engineering. Consider asking your telecom provider to add a "Do not port" note to your file (unless you visit in person).
Your mobile device is also at risk of nuisanceware and malicious software that will force the device to either make calls or send messages to premium numbers.
Nuisanceware is malware found in apps (more commonly in the Android ecosystem in comparison to iOS) which makes your handset act annoyingly. Usually not dangerous but still irritating and a drain on your power, nuisanceware may show you pop-up adverts, interrupt your tasks with promotions or survey requests, or open up pages in your mobile browser without permission.
While nuisanceware can generate ad impressions through users, premium service dialers are worse. Apps may contain hidden functions that will covertly sign you up to premium, paid services, send texts, or make calls -- and while you end up paying for these 'services,' the attacker gets paid.
Some apps may quietly steal your device's computing resources to mine for cryptocurrency.
Your best defense:Only download apps from legitimate app stores and carefully evaluate what permissions you're allowing them to have.
Open and unsecured Wi-Fi hotspots are everywhere, from hotel rooms to coffee shops. They are intended to be a customer service, but their open nature also opens them up to attack.
Here's how to find an effective Virtual Private Network service for both iOS-powered iPhones and Android smartphones.
Read nowSpecifically, your handset or PC could become susceptible to Man-in-The-Middle (MiTM) attacks through open Wi-Fi connections. An attacker will intercept the communication flow between your handset and browser, stealing your information, pushing malware payloads, and potentially allowing your device to be hijacked.
You also come across 'honeypot' Wi-Fi hotspots every so often. These are open Wi-Fi hotspots created by cybercriminals, disguised as legitimate and free spots, for the sole purpose of performing MiTM.
Your best defense:Avoid using public Wi-Fi altogether and use mobile networks instead. If you must connect to them, at least consider using a virtual private network (VPN).
Surveillanceware, spyware, and stalkerware come in various forms. Spyware is often generic and will be used by cyberattackers to steal information including PII and financial details. However, surveillanceware and stalkerware are normally more personal and targeted; for example, in the case of domestic abuse, a partner may install surveillance software on your phone to keep track of your contacts, phone calls, GPS location, and who you are communicating with, and when.
Your best defense: An antivirus scan should take care of generic spyware, and while there's no magic bullet for surveillanceware or stalkerware, you should watch out for any suspicious or unusual behavior on your device. If you think you are being monitored, put your physical safety above all else. See our guide for how to find and remove stalkerware from your phone.
Ransomware can impact mobile devices as well as PCs. Ransomware will attempt to encrypt files and directories, locking you out of your phone, and will demand payment -- commonly in cryptocurrency -- through a blackmail landing page. Cryptolocker and Koler are prime examples.
Also:What is ransomware? Everything you need to know
Ransomware is often found in third-party apps or deployed as a payload on malicious websites. For example, you may see a pop-up request to download an app -- disguised as everything from a software cracker to a pornography viewer -- and your handset can then be encrypted in mere minutes.
Your best defense: Keep your phone up-to-date with the latest firmware, your Android or iOS handset's fundamental security protections on, and don't download apps from sources outside official repositories.
There are countless mobile malware variants, but Google and Apple's fundamental protections stop many in their tracks. However, out of the malware families, you should be aware of, trojans top the list.
Trojans are forms of malware that are developed with data theft and financial gains in mind. Mobile variants include EventBot, MaliBot, and Drinik.
Most of the time, users download the malware themselves, which may be packaged up as an innocent and legitimate app or service. However, once they have landed on your handset, they overlay a banking app's window and steal the credentials you submit. This information is then sent to an attacker and can be used to pillage your bank account. Some variants may also intercept 2FA verification codes.
The majority of financial trojans target Android handsets. iOS variants are rarer, but strains including XCodeGhost still exist.
Your best defense: Keep your phone up-to-date with the latest firmware, your Android or iOS handset's fundamental security protections on, and don't download apps from sources outside official repositories. If you suspect your phone has been compromised, stop using financial apps, cut off your internet connection, and both run a personal check and antivirus scan.
Mobile Device Management (MDM) solutions are enterprise-grade tools suited for the workforce. MDM features can include secure channels for employees to access corporate resources and software, spreading a company's network security solutions and scans to each endpoint device, and blocking malicious links and websites.
However, if the central MDM solution is infiltrated or otherwise compromised, each mobile endpoint device is also at risk of data left, surveillance, or hijacking.
Your best defense:The nature of MDM solutions takes control out of the hands of end users. Therefore, you can't protect against MDM compromise. What you can do, however, is maintain basic security hygiene on your device, make sure it is up-to-date, and keep your personal apps and information off work devices.
Your lock screen is the gateway to your device, data, photos, private documents, and apps. As such, keeping it secure is paramount.
On Android, consider these settings:
On iOS devices, check out:
If you notice your Android or iOS device is not behaving normally, you may have been infected by malware or be otherwise compromised.
Things to watch out for are:
On occasion, enterprise and government-grade malware hit the headlines. Known variants include Pegasus and Hermit, used by law enforcement and governments to spy on everyone from journalists to lawyers and activists.
In June 2022, Google Threat Analysis Group (TAG) researchers warned that Hermit, a sophisticated form of iOS and Android spyware, is exploiting zero-day vulnerabilities and is now in active circulation.
The malware tries to root devices and capture every detail of a victim's digital life, including their calls, messages, logs, photos, and GPS location.
However, the likelihood of you being targeted by these expensive, paid-for malware packages is low unless you are a high-profile individual of interest to a government willing to go to these lengths. You are far more likely to be targeted by phishing, generic malware, or, unfortunately, friends and family members who are using stalkerware against you.
If you suspect your Android or IOS device has been infected with malware or otherwise compromised, you should take urgent action to protect your privacy and security. Consider these steps below:
In other words, legitimate apps don't always stay that way, and these changes can come out of the blue. For example, in 2021, a popular barcode scanner developer pushed out a malicious update and was able to hijack millions of devices in one stroke.
If you were alerted to the ransomware before your device is encrypted and a ransom note is displayed, cut off the internet and any other connections -- including any wired links to other devices -- and boot up your mobile in Safe Mode. You might be able to delete the offending app, run an antivirus scan, and clean up before any significant damage occurs.
However, if your handset is locked, your next steps are more limited, as removing the malware only deals with part of the problem.
If you know what ransomware variant is on your handset, you can try using a decryption tool such as those listed by the No More Ransom project. You can also provide information to Crypto Sheriff, and researchers will try and find out what type of malware you're dealing with for free.
In the worst-case scenario, you might need to perform a factory reset. Removing ransomware stops it from spreading further but will not restore files that have been encrypted. You can restore your device following a reset if you've consistently backed up your data.
Remember, paying a ransom does not guarantee that your files will be decrypted and returned to you.
However, suppose a partner or other close contact is monitoring you, and you try to remove a stalkerware app from your phone. In that case, they will be alerted directly, or they will become aware because they are no longer receiving your information.
You shouldn't try to remove these apps if this risks your physical safety. Indeed, some commercially-available forms of spyware damage a handset so severely that the operator can remotely reinstall them, anyway, and the only real option is to throw the device away (or keep it for law enforcement purposes).
Reach out to an organization that can help you, consider using a burner phone if you can, and keep yourself as physically safe as possible.
If you can, go and visit your carrier in person, in-store.
No one is exempt from the risk of SIM swaps, customer service representatives may not have been trained to recognize SIM hijacking, and cybercriminals may have enough of your personal information to pass as you without challenge.
To mitigate the risk in the first place, consider linking your crucial 'hub' accounts, financial services, and cryptocurrency wallets to a number that isn't publicly connected to you. A simple pay-as-you-go number will do, and so if your personal or work numbers are compromised, the potential opportunities for theft are limited.
See also
Tags quentes :
Segurança
Cadastre-se agora para Ações Semanais de Promoção
100% free, Unsubscribe any time!
Add 1: Room 605 6/F FA YUEN Commercial Building, 75-77 FA YUEN Street, Mongkok KL, HongKong Add 2: Room 405, Building E, MeiDu Building, Gong Shu District, Hangzhou City, Zhejiang Province, China
Whatsapp/Tel: +8618057156223 Tel: 0086 571 86729517 Tel em HK: 00852 66181601
Email: [email protected]
English
Pусский
Français
Español
Português
