Apr 21, 2015

There are a number of BYOD security issues that can impact an organization’s mobile initiative, including recent techniques being utilized by hackers to spread malware. The best way to prevent such BYOD security threats is to stay a step ahead of cybercriminals, and remain in-the-know about the latest malware and infection approaches that are emerging.

Rise in digital payments
A recent report from Juniper Research, “Digital Payment Strategies: Online, Mobile and Contactless,” found that users are increasingly turning to the digital realm to make purchases and transmit payments. According to the study, there will be a projected $2.5 trillion in digital payments taking place this year. This figure is expected to extrapolate, more than doubling to reach $4.7 trillion by 2019, Mobile Commerce Insider stated.

This research shows an increased use of the various digital payment portals today’s users have at their disposal, including those accessible on the mobile platform. However, as convenient and flexible these resources are, they could be putting the individual – as well as their personal information – at risk of cybercriminal activity.

As a higher number of people begin using their mobile devices for a wider range of purposes – including mobile banking – new cloned apps have appeared that leverage the trustworthiness of a legitimate app to trick users. Such was the case recently with an Israeli bank’s mobile application.

Cloned banking app steals: A front for phishing?
Many have already heard about the fake “Flappy Bird” apps floating around the mobile cybersphere. Recently, though another malicious program used a similar approach, cloning the popular mobile appof one of Israel’s top financial institutions.

According to Threatpost, a mobile security company recently discovered that Mizrahi Bank’s mobile app had been leveraged by hackers who created a malicious clone. While many infections of this kind look to steal any valuable personal information available, this app specifically targeted only the victim’s user ID, not their password or any other data. Especially with a cloned banking app where everything from an individual’s authentication credentials to the money in their account could potentially be stolen, this was a surprising approach.

“The authors put a wrapper around the bank’s legitimate app and redistributed it on the Google Play store, pretending to be the financial institution,” noted Meghan Kelly, a security expert at the firm that discovered the cloned app. “Indeed, those who built the malware inserted a comment into the code dictating that only the user ID be taken, not the passwords.”

Since the cloned imposter was discovered, the bank’s mobile app has been removed from app stores. However, this technique may not be as surprising as some think. Threatpost stated that the cybercriminals could be putting together information to utilize in a phishing scheme to take place later on. With the user ID on hand, attackers could bait victims into sharing a whol