Beware the coming corporate smartphone threat warn experts

Lia Timson
Friday, 18 February 2011 15:45

Business IT - Security

Rogue smartphone applications coupled with social engineering will be the undoing of corporate IT infrastructures, network security experts have warned.

As more and more enterprises succumb to the temptation of allowing employee devices to be used for work purposes - either because of cost or pressure from senior management - the threat to their IT systems security is rising.

Speaking at the RSA Conference 2011 in San Francisco this week, Ed Amoroso, security supremo at AT&T also advised IT managers to skill-up and use 2011 to prepare themselves and their networks to deal with future threats.

While fake free versions of popular games such as Monkey Jump and Angry Bird are appearing outside the iTunes App Store tempting people to download suspect code onto their phones, unchecked Android apps were also making their way onto mobile handsets which workers carry onto corporate networks.

Some like a wallpaper app detected on the phone of a Citibank employee collected much more user information, including contact database, Wi-Fi addresses and IMEI number, than was required for its operation, and sent it onto servers in China, according to John Hering, CEO of Lookout, a smartphone security company. Such information could give hackers means to impersonate a trusted device and penetrate a network.

'They are silly, they're whimsical, they cost 99c and they are fun. Guess what, your software has to be resilient. It has to work and we have to rethink the infrastructure for that portion of the mobility side,' said Ed Amoroso, security supremo at AT&T in the US.

Amoroso also warned app and operating system developers to speed up their vulnerability patching leadtimes to help curb threats. He said patching had to be reduced from seven months to seven days to counter the explosion in smartphone app popularity and increasing number of proof-of-concept malware.

'It's a big problem but we shouldn't have to do it in the first place. We shouldn't have to put duct tape on software. It's kind of a mess, right?  You (IT manager) have to do it yourself or the IT guy has to through the app store at their leisure,' he said, rulling out over-the-air patching by the carriers as 'the nuke option'.

CONTINUED