threatpost.com
Open in
urlscan Pro
35.173.160.135
Public Scan
URL:
https://threatpost.com/top-mobile-security-stories-2019/151420/
Submission: On September 04 via api from JP
Submission: On September 04 via api from JP
Form analysis 3 forms found in the DOM
POST /top-mobile-security-stories-2019/151420/#gf_5
<form method="post" enctype="multipart/form-data" target="gform_ajax_frame_5" id="gform_5" action="/top-mobile-security-stories-2019/151420/#gf_5">
<div class="gform_body">
<ul id="gform_fields_5" class="gform_fields top_label form_sublabel_below description_below">
<li id="field_5_8" class="gfield field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label" for="input_5_8"></label>
<div class="ginput_container ginput_container_text"><input name="input_8" id="input_5_8" type="text" value="" class="medium" placeholder="Your name" aria-invalid="false"></div>
</li>
<li id="field_5_1" class="gfield gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label" for="input_5_1"><span class="gfield_required">*</span></label>
<div class="ginput_container ginput_container_email">
<input name="input_1" id="input_5_1" type="text" value="" class="medium" placeholder="Your e-mail address" aria-required="true" aria-invalid="false">
</div>
</li>
<li id="field_5_9" class="gfield js-kaspersky-gform-recaptcha-placeholder gform_hidden field_sublabel_below field_description_below gfield_visibility_hidden"><input name="input_9" id="input_5_9" type="hidden" class="gform_hidden"
aria-invalid="false" value=""></li>
<li id="field_5_2" class="gfield input-without-label label-gdpr gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label"><span class="gfield_required">*</span></label>
<div class="ginput_container ginput_container_checkbox">
<ul class="gfield_checkbox" id="input_5_2">
<li class="gchoice_5_2_1">
<input name="input_2.1" type="checkbox" value="I agree" id="choice_5_2_1">
<label for="choice_5_2_1" id="label_5_2_1">I agree to my personal data being stored and used to receive the newsletter</label>
</li>
</ul>
</div>
</li>
<li id="field_5_5" class="gfield input-without-label label-gdpr gfield_contains_required field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label"><span class="gfield_required">*</span></label>
<div class="ginput_container ginput_container_checkbox">
<ul class="gfield_checkbox" id="input_5_5">
<li class="gchoice_5_5_1">
<input name="input_5.1" type="checkbox" value="I agree" id="choice_5_5_1">
<label for="choice_5_5_1" id="label_5_5_1">I agree to accept information and occasional commercial offers from Threatpost partners</label>
</li>
</ul>
</div>
</li>
<li id="field_5_10" class="gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible"><label class="gfield_label" for="input_5_10">Name</label>
<div class="ginput_container"><input name="input_10" id="input_5_10" type="text" value=""></div>
<div class="gfield_description" id="gfield_description__10">This field is for validation purposes and should be left unchanged.</div>
</li>
</ul>
</div>
<div class="gform_footer top_label"> <input type="submit" id="gform_submit_button_5" class="gform_button button" value="Subscribe" onclick="if(window["gf_submitting_5"]){return false;} window["gf_submitting_5"]=true; "
onkeypress="if( event.keyCode == 13 ){ if(window["gf_submitting_5"]){return false;} window["gf_submitting_5"]=true; jQuery("#gform_5").trigger("submit",[true]); }" style="display: none;"> <input
type="hidden" name="gform_ajax" value="form_id=5&title=&description=&tabindex=0">
<input type="hidden" class="gform_hidden" name="is_submit_5" value="1">
<input type="hidden" class="gform_hidden" name="gform_submit" value="5">
<input type="hidden" class="gform_hidden" name="gform_unique_id" value="">
<input type="hidden" class="gform_hidden" name="state_5" value="WyJbXSIsImIwODQwZTA2ZGQ0NzYwODcyOTBkZjNmZDM1NDk2Y2ZkIl0=">
<input type="hidden" class="gform_hidden" name="gform_target_page_number_5" id="gform_target_page_number_5" value="0">
<input type="hidden" class="gform_hidden" name="gform_source_page_number_5" id="gform_source_page_number_5" value="1">
<input type="hidden" name="gform_field_values" value="">
</div>
</form>GET https://threatpost.com/
<form class="c-site-search__form" role="search" method="get" action="https://threatpost.com/">
<input type="text" class="c-site-search__field" name="s" placeholder="Search">
<button type="submit" class="c-button c-button--secondary c-button--smaller c-site-search__button" value="Search"><svg class="icon fill">
<use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg#icon-search"></use>
</svg> Search</button>
<div class="c-site-search__overlay"></div>
</form>GET https://threatpost.com/
<form class="c-site-search__form" role="search" method="get" action="https://threatpost.com/">
<input type="text" class="c-site-search__field" name="s" placeholder="Search">
<button type="submit" class="c-button c-button--secondary c-button--smaller c-site-search__button" value="Search"><svg class="icon fill">
<use xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="https://threatpost.com/wp-content/themes/threatpost-2018/assets/sprite/icons.svg#icon-search"></use>
</svg> Search</button>
<div class="c-site-search__overlay"></div>
</form>Text Content
Newsletter
SUBSCRIBE TO OUR THREATPOST TODAY NEWSLETTER
Join thousands of people who receive the latest breaking cybersecurity news
every day.
The administrator of your personal data will be Threatpost, Inc., 500 Unicorn
Park, Woburn, MA 01801. Detailed information on the processing of personal data
can be found in the privacy policy. In addition, you will find them in the
message confirming the subscription to the newsletter.
*
* *
*
* *
* I agree to my personal data being stored and used to receive the
newsletter
* *
* I agree to accept information and occasional commercial offers from
Threatpost partners
* Name
This field is for validation purposes and should be left unchanged.
This iframe contains the logic required to handle Ajax powered Gravity Forms.
The administrator of your personal data will be Threatpost, Inc., 500 Unicorn
Park, Woburn, MA 01801. Detailed information on the processing of personal data
can be found in the privacy policy. In addition, you will find them in the
message confirming the subscription to the newsletter.
Threatpost
* Cloud Security
* Malware
* Vulnerabilities
* InfoSec Insiders
* Podcasts
*
*
*
*
*
*
*
Search
* Google Chrome Affected By Magellan 2.0 FlawsPrevious article
* Mean Time to Hardening: The Next-Gen Security MetricNext article
TOP MOBILE SECURITY STORIES OF 2019
Author: Tara Seals
December 30, 2019 9:00 am
Cybercrime increasingly went mobile in 2019, with everything from Apple iPhone
jailbreaks and rogue Android apps to 5G and mobile-first phishing dominating the
news coverage. Here are Threatpost’s Top 10 mobile security stories of 2019.
* Top Mobile Security Stories of 2019
Cybercriminals are increasingly and successfully targeting mobile users, as
our look back on the Top 10 2019 mobile security stories show. For
enterprises that are embracing an ever-more-mobile workforce, escalating
mobile attack vectors significantly widen the threat landscape, and are
forcing companies to rethink what their security requirements need to be. For
consumers, greater awareness is their only hope to protect their personal
data.
* Apple Takes Bug Bounty Public
In December, Apple officially opened its historically private bug-bounty
program to the public, while boosting its top payout to $1 million (for a
zero-click remote chain with full kernel execution and persistence on Apple’s
latest shipping hardware). The payouts are a huge step up from the private
program’s paltry $200,000 top reward – but the tech giant is looking for full
working exploits with any vulnerability submission. Other payouts range from
$25,000 to $500,000 across a range of products, including Macs, iPhone and
iPad, and Apple TV.
* Apple Bugs Proliferate
Speaking of Apple bugs, iOS vulnerabilities turned up throughout 2019,
including the “AirDoS” bug that allows nearby hackers to render iPhones and
iPads inoperable, via the file-swapping feature AirDrop. In June, an iMessage
bug came to light that bricks iPhones running older versions of the company’s
iOS software; and five other iMessage bugs were found that required no user
interaction to exploit, including one that would allow remote attackers to
access content stored on iOS devices. Also, a total of 14 iPhone
vulnerabilities – including two that were zero-days when disclosed in
February – were found to be targeted by five exploit chains in a watering
hole attack that lasted years.
* WhatsApp Faces Down the NSO Group
In May, WhatsApp is warned users about a zero-day vulnerability found in its
messaging platform was exploited by attackers who were able to inject spyware
onto victims’ phones in targeted campaigns. Later in the year, WhatsApp owner
Facebook sued the Israeli company NSO Group, alleging that it developed the
surveillance code itself and used vulnerable WhatsApp servers to send malware
to approximately 1,400 mobile devices, targeting human rights defenders,
journalists and other members of civil society worldwide. NSO’s president
later took indirect aim at WhatsApp over the issue in a conference session.
* StrandHogg Impersonates Android Apps
This fall, researchers found a new Android vulnerability called StrandHogg
that could allow malware to pose as popular apps and ask for various
permissions – enabling hackers to listen in on users, take photos, read and
send SMS messages, and basically take over various functions as if they are
the device’s owner. The wrinkle is that the activity overlays and masquerades
as a mobile app, such as Facebook, that a person would use regularly. The
flaw affects all Android devices, including those running Android 10, and
puts the top 500 most popular apps at risk.
* The Checkra1n Jailbreak
A BootROM vulnerability for iPhone dubbed “checkm8” was disclosed this year –
an un-patchable bug affecting hundreds of millions of iPhones that gives
attackers system-level access to handsets via an unblockable jailbreak hack.
An exploit soon emerged, called checkra1n, which would allow users to bypass
DRM restrictions to run unauthorized and custom software. Checkra1n also
makes users susceptible to rogue or unstable apps downloaded from outside of
Apple’s curated App Store. Meanwhile, a fake website purporting to enable
iPhone users to download checkra1n (but ultimately downloading a gaming app
bent on click fraud) made the rounds.
* Mobile Phishing Kits Emerge
April saw a new wrinkle in the mobile landscape: Mobile-first phishing. A kit
that specifically targets Verizon Wireless customers in the U.S. pushes
phishing links to users via email, masquerading as messages from Verizon
Customer Support. These are tailored to mobile viewing: When the malicious
URL is opened on a desktop, it looks sloppy and obviously not legitimate –
however, when opened on a mobile device, it looks like what you would expect
from a Verizon customer support application.
* Spotlight on 5G
This year for the first time, security for 5G networks became a top
conversation topic. The next-gen mobile technology promises ultra-low-latency
and exponentially faster throughput to pave the way for new enterprise use
cases and applications, including remote telesurgery, self-driving cars,
electricity on-demand and more. However, in these scenarios, a cyberattack
can literally be a matter of life or death. With many of the security
protocols and algorithms for 5G are being ported from the previous 4G
standard, researchers have already found 5G flaws allowing device
fingerprinting and man-in-the-middle (MiTM) offensives.
* Data-Scraping Apps
Earlier this year, Twitter and Facebook warned of software development kits
(SDKs) that could be embedded within a mobile application and used to scrape
profile information, such as email addresses, usernames, gender, last tweets
and so on. The SDKs, which the tech giants said are maintained by oneAudience
and MobiBurn, violate both companies’ data privacy policies, which prohibit
allowing third parties to harvest profile information for data monetization
purposes. That was a change implemented in the wake of the Cambridge
Analytica scandal, and the issue continued the debate around social media
privacy.
* Retina X Stalkerware
In its first crackdown on “stalkerware,” the FTC has banned the sale of three
apps – marketed to monitor children and employees – that can be installed on
devices to track their owners’ location, activity and more. The apps come
from a company called Retina-X Studios, and the FTC said that since the apps
were designed to run surreptitiously in the background, they’re are uniquely
suited to illegal and dangerous uses, especially in domestic violence
situations. Meanwhile in November, the Coalition Against Stalkerware formed
to help victims of stalkerware, instances of which have increased more than
300 percent in 2019.
* Biometrics Bypasses
While fingerprint sensors and FaceID are touted as providing the best
available mobile security, 2019 saw a few bypasses of the technology. The
Samsung Galaxy S10 fingerprint sensor for instance was shown to be fooled in
a hack involving a 3D printed fingerprint cloned from a wineglass. And
Samsung admitted later in the year that anyone can bypass the Galaxy S10
fingerprint sensor if a third-party silicon case is enclosing the phone. In
October, Google came under fire for its Pixel 4 facial recognition unlock
feature, which users said would unlock for users even if their eyes were
closed. And in August, researchers revealed a bypass for Apple’s FaceID.
1
2
3
4
5
6
7
8
9
10
11
Write a comment
Share this article:
* Editor's Picks
* IoT
* Malware
* Mobile Security
* Privacy
* Slideshow
* Vulnerabilities
* Web Security
SUGGESTED ARTICLES
GOOGLE WARNS OF CRITICAL ANDROID REMOTE CODE EXECUTION BUG
Google’s Android security update addressed 43 bugs overall affecting Android
handsets, including Samsung phones.
January 5, 2021
2
2021 CYBERSECURITY TRENDS: BIGGER BUDGETS, ENDPOINT EMPHASIS AND CLOUD
Insider threats are redefined in 2021, the work-from-home trend will continue
define the threat landscape and mobile endpoints become the attack vector of
choice, according 2021 forecasts.
January 3, 2021
1
THE 5 MOST-WANTED THREATPOST STORIES OF 2020
A look back at what was hot with readers — offering a snapshot of the security
stories that were most top-of-mind for security professionals and consumers
throughout the year.
December 30, 2020
DISCUSSION
INFOSEC INSIDER
* THE STATE OF INCIDENT RESPONSE: MEASURING RISK AND EVALUATING YOUR
PREPAREDNESS
September 3, 2021
* 7 WAYS TO DEFEND MOBILE APPS, APIS FROM CYBERATTACKS
September 2, 2021
* TOP 3 API VULNERABILITIES: WHY APPS ARE PWNED BY CYBERATTACKERS
August 31, 2021
* THE UNDERGROUND ECONOMY: RECON, WEAPONIZATION & DELIVERY FOR ACCOUNT
TAKEOVERS
August 30, 2021
* WINNING THE CYBER-DEFENSE RACE: UNDERSTAND THE FINISH LINE
August 27, 2021
Newsletter
SUBSCRIBE TO THREATPOST TODAY
Join thousands of people who receive the latest breaking cybersecurity news
every day.
Subscribe now
Twitter
Two #bugs in #Gutenberg Template Library & Redux Framework plugin for
@WordPress, installed on more than 1M website… https://t.co/wAKu2PnTDP
2 days ago
Follow @threatpost
NEXT 00:02 01:08 360p 720p HD 1080p HD Auto (360p) About Connatix V128576 Closed
Caption About Connatix V128576 1/1 Skip Ad Continue watching after the ad Visit
Advertiser website GO TO PAGE
SUBSCRIBE TO OUR NEWSLETTER, THREATPOST TODAY!
Get the latest breaking news delivered daily to your inbox.
Subscribe now
Threatpost
The First Stop For Security News
* Home
* About Us
* Contact Us
* Advertise With Us
* RSS Feeds
* Copyright © 2021 Threatpost
* Privacy Policy
* Terms and Conditions
* Advertise
*
*
*
*
*
*
*
TOPICS
* Black Hat
* Breaking News
* Cloud Security
* Critical Infrastructure
* Cryptography
* Facebook
* Government
* Hacks
* IoT
* Malware
* Mobile Security
* Podcasts
* Privacy
* RSAC
* Security Analyst Summit
* Videos
* Vulnerabilities
* Web Security
Threatpost
*
*
*
*
*
*
*
TOPICS
* Cloud Security
* Malware
* Vulnerabilities
* Privacy
Show all
* Black Hat
* Critical Infrastructure
* Cryptography
* Facebook
* Featured
* Government
* Hacks
* IoT
* Mobile Security
* Podcasts
* RSAC
* Security Analyst Summit
* Slideshow
* Videos
* Web Security
AUTHORS
* Tara Seals
* Tom Spring
* Lisa Vaas
THREATPOST
* Home
* About Us
* Contact Us
* Advertise With Us
* RSS Feeds
Search
*
*
*
*
*
*
*
InfoSec Insider
INFOSEC INSIDER POST
Infosec Insider content is written by a trusted community of Threatpost
cybersecurity subject matter experts. Each contribution has a goal of bringing a
unique voice to important cybersecurity topics. Content strives to be of the
highest quality, objective and non-commercial.
Sponsored
SPONSORED CONTENT
Sponsored Content is paid for by an advertiser. Sponsored content is written and
edited by members of our sponsor community. This content creates an opportunity
for a sponsor to provide insight and commentary from their point-of-view
directly to the Threatpost audience. The Threatpost editorial team does not
participate in the writing or editing of Sponsored Content.
We use cookies to make your experience of our websites better. By using and
further navigating this website you accept this. Detailed information about the
use of cookies on this website is available by clicking on more information.
ACCEPT AND CLOSE