App threats

Well-known problems like malware and ransomware remain major threats, but emerging ones like cryptojacking can also put your organization at risk. Even apps downloaded from official stores can be compromised or introduce vulnerabilities due to poor coding practices.
 

Malware
 

This remains one of the favorite tools of attackers. It constantly tops our list of the threats that organizations are the most worried about. Why? Because it works.

This year, 86% of organizations said they were concerned about malware, and 20% of those don’t feel prepared for it.

According to MobileIron, 4.5% of Android devices had known malware.¹⁹  That might not sound like much, but it means that if your organization has just 15 devices, then there’s a 50% chance that at least one of them is infected. And if you have 100 devices, that chance goes up to 99%. And one device can be enough to compromise your entire organization.

As with other threats, criminals are not standing still. They’re constantly finding new ways to increase the destructiveness of malware and break through organizations’ defenses.
 

Malware within apps

One of the most effective ways to trick users into installing malware is to disguise it as a useful or entertaining app. Of organizations that were compromised, 21% said that a rogue or unapproved application had contributed to the incident.

Of course, sideloading apps from non-official stores or third- party websites increases the risk. Many organizations aren’t regulating where apps are downloaded from. Only 43% said that they limit their employees to using apps from an official app store or one owned by the company.

And hackers are getting smarter, using more sophisticated techniques to make malicious apps look legitimate. There have been numerous instances of malware-infected apps escaping detection and being spread through official stores like Google Play. Official app stores have thousands of apps to test and approve, and some malicious ones inevitably slip through the cracks. And because testing tends to be more rigorous on the first version, some attackers sneak malware into approved apps via updates.

"Elusive" malware

How effective a piece of malware is isn’t just dependent on how damaging it is. Whether they are stealing credentials or enlisting devices to their botnet, hackers want their malware to infect as many devices as possible.

And hackers are learning a lesson from biological diseases. Some deadly illnesses don’t tend to spread very far due to high mortality rates, limiting their overall impact on a population. By contrast, illnesses like the common cold or flu have a slower onset of symptoms. This longer incubation period gives infected people time to catch planes and trains and spread the disease.

Elusive malware operates in a similar way. It will stay completely dormant on a device for a period of time—weeks, or even months—until it’s triggered. Because the malicious part of the app hasn’t been activated, the app can gather good reviews (or have them paid for) and users may recommend it to friends and colleagues, helping it spread to many more devices.

The trigger for the malicious part to spring into action may be as simple as reaching a particular date—reminiscent of early "time bomb" viruses. But criminals are getting increasingly sneaky. There are examples of malware being programmed to trigger after a set number of steps are taken, identified by the onboard accelerometer. This makes it harder for security researchers to spot the malicious code, as tests are normally conducted on lab benches or even in PC-based emulators.