Multiple potential mobile threats have emerged recently, with T-Mobile disclosing a data breach caused by SIM swapping attacks, and news surfacing of the Android “SHAREit” app allowing attackers to steal user information. These vulnerabilities could potentially allow for attackers to steal client information, bypass MFA by intercepting calls and messages, and discreetly install malware on devices. rocketwise recommends regularly updating all mobile applications, operating systems, and passwords to ensure the latest security patches are installed and passwords are not compromised. In addition, rocketwise recommends using an account PIN or key with your mobile carrier as an additional layer of security.
The vulnerabilities detailed above create threats which are relevant to almost everyone. Many employees use both company and personal smartphones to conduct business in the workplace. We leverage them for communication, storing information, and for authentication into accounts which can store sensitive information. These use cases have only become more frequent in today’s work from home environment. While not every device is an Android or running on T-Mobile per se, the possibility for similar threats arising on other brands and carriers is extremely possible.
If a device is exploited, the attacker will essentially have access to all data and communications associated with the compromised device. In terms of personal information, the vulnerabilities enable the possibility for attackers to access personal information which could have included customer names, home addresses, e-mail addresses, account numbers, Social Security numbers, PIN numbers, date of birth, and more. It also enabled the possibility of intercepting phone calls and SMS messages, which could lead to more data leaks, and would render certain multi-factor authentication methods useless. Access to this sort of information could lead to identity theft, and to attackers accessing other accounts with similar credentials, which could lead to even more information being leaked.
The recommendations are consistent for both of these issues, and many other issues of this nature.
For more in-depth information about the recommendations, please visit the following links:
If you have any questions, please contact us.