Photo: Brett Jordan

What apps should I avoid?

Mobile apps can be a nightmare for IT. There are millions of them, and most were developed without any concern for security. ... The 20 most-blocked mobile apps Poot-debug(W100). apk. AndroidSystemTheme. Where's My Droid. Weather. Wild Crocodile. Star War. ggzzversion. Boyfriend Tracker. More items...

techbeacon.com - 20 most dangerous mobile apps: How to best mitigate the risk | TechBeacon

What is the top 5 most used apps?

Q #1) What are the 5 most popular apps? Answer: TikTok, Instagram, Facebook, WhatsApp, Telegram are the 5 most downloaded apps of the current year....

Last updated Apr 12, 2022

What is K in first order?

'k' is the rate constant of the first-order reaction, whose units are s- 1.

Last updated Nov 13, 2018

Promotion

Mobile apps can be a nightmare for IT. There are millions of them, and most were developed without any concern for security. Some IT organizations have tried to counter potential threats from mobile apps by blacklisting programs they deem risky, but that's not always effective. Here are the top pitfalls of blacklisting, and alternative approaches to controlling the chaos that can result when a company's employees are working on mobile devices connected to the company network.

The 20 most-blocked mobile apps

An analysis by Appthority of the blacklists of its enterprise customers is revealing. For example, here are the top 10 Android apps blackballed by enterprises:

Poot-debug(W100).apk

AndroidSystemTheme

Where's My Droid

Weather

Wild Crocodile

Star War

ggzzversion

Boyfriend Tracker

Chicken Puzzle

Device Alive

In its analysis, Appthority ranks risk on a scale of 1 to 10, with 1 being the lowest risk. Eight of the apps in the Android top 10 had a risk score of 9, primarily because they contained malware. The other two apps—Boyfriend Tracker and Chicken Puzzle—scored a 6 because of data issues or privacy concerns.

On the iOS side of things, these apps were blacklisted the most:

WhatsApp Messenger

Pokémon GO

WinZip Utilities

CamScanner Productivity

Plex

WeChat

eBay Kleinanzeigen

Netease News

Device Alive

The seven riskiest apps scored a 7. Their sins included sending SMS messages or sensitive data without encryption. Three programs—Pokémon GO, Plex, and Device Alive—scored a 6 because they did things such as access address books and cameras without permission and tracked a phone user's location.

Blacklisting's deficiencies

While these 20 apps were the most commonly blacklisted, there were plenty more in Appthority's list of 100 enterprise apps that were as risky or riskier to use. Many of those apps ask for permissions that can be a prelude to risky behavior—the ability to read and send text messages, for example, or access a phone's camera, microphone, and address book. Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies, said the proof was in the permissions. "Users should avoid installing apps that require too many dangerous permissions. The more permissions an application has, the more risk it presents in the case that it's hacked."

—Leigh-Anne Galloway

The sheer volume of apps available to users can make blacklisting problematic. "Blacklisting apps has never had much success in stopping breaches in the PC world, and I don't see it as working in mobile either," said Georgia Weidman, CEO of Shevirah, a provider of tools for assessing and managing mobile device risk. "If you blacklist an app, a million more with those same issues will take their place. Taking a set of apps and blacklisting them isn't going to solve any particular problem."

—Georgia Weidman

What's more, one enterprise's risky app is another's anointed app. "WhatsApp is on the list of bad apps," Weidman noted, "but a lot of organizations use WhatsApp or a similar secure, encrypted messenger for corporate communication." We can't look at every application deeply enough to say yes or no definitively about whether its risky behavior is due to a sloppy developer or someone with malicious intent, she added.

Is Roblox OK for a 5 year old?

There is no official age that kids can play Roblox, but Common Sense Media rates the platform safe for users 13+ "based on continuing challenges...

Last updated May 1, 2019

Is it hard to work in digital marketing?

Most industry experts agree that foundational digital marketing skills are not hard to learn. However, it can be challenging to master those skills...

Last updated Apr 11, 2018

Promotion

Shadow IT complicates security

Making matters worse, employees often use productivity apps without IT's knowledge. Referred to as shadow IT, this practice has become prevalent within the bring-your-own-device (BYOD) culture, where people use their personal devices and download apps without informing IT, explained Michela Menting, digital security research director at ABI Research. This is not always done maliciously by the employee, she said. Often they do this in good faith, to increase their productivity or facilitate their work in some way, she said. "They forget that by not telling IT, they can put their organization at risk."

—Michela Menting

By keeping IT in the dark, mobile users broaden the attack surface available to an organization's adversaries. "BYOD extends your corporate environment to your employees' homes, vehicles, neighborhoods—and then enables them to bring whatever they picked up into your environment," said Devon Kerr, principal threat researcher at Endgame, a maker of cybersecurity solutions for enterprises. "It is an inheritance model that is being taken advantage of by threat actors to gain a foothold in otherwise resistant organizations."

—Devon Kerr

One of the riskiest apps for an enterprise may not appear on any top 10 list at all: email. Email is risky for two reasons. Corporate credentials are needed to access a mailbox, and email is used to share a lot of sensitive corporate information.

Whitelisting apps can help

If emails or credentials are stored somewhere other than on a device or are accessible to a third party, in any way, the business is at significant risk, said Matt Hathaway, Senior Director of Product Marketing at Uptycs. "The most important action for IT staff to take around email apps is to evaluate the most common, whitelist those that are secure, and configure their email servers to decline authentication attempts from any apps which aren't on this whitelist," Hathaway said. For external programs, whitelisting should extend beyond email apps to all external mobile apps, added Positive Technologies' Galloway. "IT must also create rules" for the use of personal devices that can be used for work, she said. Another approach is to host all applications accessible to a user's phone. Then when employees attempt to access corporate resources, they can do so only through the hosted apps. That essentially makes the phone act like a remote desktop client. Daniel Kennedy, research director for information security and networking at 451 Research., said that in a true BYOD environment, IT's ability to control risky apps is limited. Enterprise mobility management or mobile device management tools provide part of the answer by allowing for capabilities on employee-owned devices, such as access revocation, conditional access, data wipe, additional authentication, and data separation, he said. "Blocking access to company data or blacklisting certain apps based on risk are other options."

What does +1 snap score mean?

Snapchat says your score is the combined number of Snaps you've sent and received. You get one point for every Snap you send and a point for every...

Last updated Jan 13, 2019

What brands pay you on Instagram?

Promote Strength of Hope with your followers on Instagram, YouTube, Facebook, and TikTok. ... Influencer fam, we have 9 awesome pay-per-post...

Last updated Dec 24, 2020

Promotion

—Daniel Kennedy

Gautam Aggarwal, CMO and head of products at NSS Labs, a security testing, enterprise research, and threat analysis company, agreed that keeping a tight rein on access is a key to reducing mobile app risk. "The best approach to mitigate potential risks is to establish access-control policies that govern the use of mobile applications and, specifically, access to high-value applications and data on the network," he said. "Regardless of your organization’s size, maintaining visibility into the types of devices accessing applications on the network is crucial to maintaining a proper security posture."

—Gautam Aggarwal

Thwarting threats with SIEMs

That kind of visibility can be obtained through the use of security information and event management (SIEM) software. SIEMs collect information from multiple network sources and analyze that data for potential or existing threats. The tools monitor network activity and can generate alerts when suspicious activity is encountered, said Avast researcher Martin Hron. "When used properly, a SIEM can notably reduce the risk of an enterprise network being infiltrated by malicious mobile applications installed on employees' phones."

—Martin Hron

To fully address mobile threats, though, a SIEM may need additional help. For example, some tools can track security issues on mobile devices and make that information available to a SIEM through APIs. This allows the SIEM to centralize both device monitoring and incident response. SIEMs can help detect malicious activity from mobile apps if the company also uses an enterprise mobility management solution, which accumulates mobile device data, Positive Technologies' Galloway explained. "In those cases, a SIEM helps detect incidents such as theft of a device or confidential information."

Nothing's perfect

A word of warning for SIEM shoppers was voiced by Endgame's Kerr: "A SIEM is only as good as the human beings who are monitoring it and the procedures those human beings developed. If your organization is already struggling to monitor social media, monitoring mobile devices is going to be exceptionally challenging." "Mobile device management, enterprise mobility management, mobile antivirus—pick your poison—they all provide value in controlling mobile apps," added Shevirah's Weidman. "But just as we still see PC malware, none of these products are going to 100% protect you. "You have to accept that potentially malicious apps are going to get in your enterprise environment, so your goal should be to make sure that they do as little as possible to harm you when they do."