June 21, 2017 By David Strom 2 min read

When you travel outside your corporate network with your mobile device, you are much more vulnerable to man-in-the-middle (MitM) attacks. This is how attackers intercept data as it’s being passed from a mobile device to a server.

Of course, this is problematic for a number of reasons. CSO Online demonstrated how easy it is to steal all sorts of information from this connection, including login credentials, private data and confidential documents.

More Devices, More Problems

There are several issues at play here that are worth considering for security professionals. First, mobile endpoints are more vulnerable to these kinds of attacks, because bring-your-own-device (BYOD) policies make it harder for IT to manage devices in the corporate network. As the number of mobile devices increases, so do the potential sources of infection.

Second, because users bring their own phones and tablets to work, they feel comfortable downloading whatever applications they wish to these devices. Sometimes those apps are infected with malware. Because so many apps have been compromised, millions of users are exposed to man-in-the-middle and other attacks.

Man-in-the-Middle Attack Targets iOS Apps

Many mobile apps are vulnerable to a newly discovered man-in-the-middle attack. Earlier this year, security researcher Will Strafach reported that more than 70 different iOS apps were vulnerable to a very sophisticated type of attack involving forged Transport Layer Security (TLS) certificates. If a user downloads such an app and is on the same wireless network as an attacker, his or her mobile device could be compromised.

Since Strafach published his analysis, a few companies, such as HipChat and Foxit PDF, fixed their apps. However, most of the programs he originally identified have yet to be patched.

Sloppy Security

Finally, app developers are sometimes sloppy. It isn’t just the app that contains potential exploits — if it connects to a database, that could be a source of compromise as well. Appthority recently discovered more than 1,000 apps that could potentially leak data from unsecured servers.

Clearly, we have a long way to go to improve the security of mobile devices and the apps that run on them. Hopefully, knowing about these issues will help increase your vigilance.

More from Endpoint

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Endpoint security in the cloud: What you need to know

9 min read - Cloud security is a buzzword in the world of technology these days — but not without good reason. Endpoint security is now one of the major concerns for businesses across the world. With ever-increasing incidents of data thefts and security breaches, it has become essential for companies to use efficient endpoint security for all their endpoints to prevent any loss of data. Security breaches can lead to billions of dollars worth of loss, not to mention the negative press in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today