Another Massive Data Leakage Incident Reported

We shouldn't be surprised by this anymore, and regular readers know I've talked about the risks of data leakage on multiple occasions. This has the same characteristics as HospitalGown and Eavesdropper: the app itself is not necessarily insecure; instead, the cloud-based storage system hasn't been properly secured.

The app in this case is A.I.type Keyboard, available on both Google Play and the App Store. This threat was discovered by The Kromtech Security Center. What they learned was that the A.I.type Keyboard app leaked PII and other data from over 31 million users. The root cause appears to be that the app's backend, a 577 GB MongoDB database, was misconfigured so that all of it's data is available to anyone with an Internet connection.

What is included in the exposed 577 GB? Here's a partial rundown:

Phone number, full name of the owner, device name and model, mobile network name, SMS number, screen resolution, user languages enabled, Android version, IMSI number (international mobile subscriber identity used for interconnection), IMEI number (a unique number given to every single mobile phone), emails associated with the phone, country of residence, links and the information associated with the social media profiles (birthdate, title, emails etc.) and photo (links to Google+, Facebook etc.), IP (if available), location details (long/lat).

In addition, there were over 6 million records that contained "data collected from users’ contact books, including names (as entered originally) and phone numbers, in total more than 373 million records scraped from registered users’ phones, which include all their contacts saved/synced on linked Google account."

Ouch. One of the things that's a bit unusual--and pretty insidious-- is the information associated with social media profiles. This should enable a second level of privacy invasion and surveillance against the victims. Given how valuable data is to marketers as well as black hats, this data will no doubt find its way into various commercial and dark net datasets, so be used at some future date with almost zero chance of tracing it back to the offending app.

Well, at least it's not mobile malware, right? So we shouldn't worry, correct? We'll see what kind of media coverage this gets.

Why Mobile Security Is Hard for Enterprises

Most enterprises support the “mobile first” movement, whether enthusiastically or begrudgingly. Many enterprises have developed mobile apps for internal use, and almost all allow employees to use their personal mobile devices to access corporate email, calendars, and other resources. Few companies have strict policies preventing use of BYOD (bring your own devices) for productivity purposes, nor do they prohibit use of social network or messaging apps while at work. Mobile use in companies has become entrenched, and it’s here to stay.

Meanwhile, startups and other high-tech firms have jumped to fill the void in mobile security solutions. In the past few years, a variety of innovative approaches have been introduced to the enterprise market that address threats related to mobile malware and data leakage. This has led industry analysts and other thought leaders to coalesce around common solution definitions to help enterprises navigate their way through the highly diverse solution landscape. The consensus seems to be that a general solution definition, defined by Gartner as Mobile Threat Defense, or MTD, is the universal answer to enterprise mobile security.

But MTD is hardly in response to a large and growing adoption of mobile security solutions by enterprises. In fact, the real question is why are the aggregate MTD revenues so low? Why have so few enterprises adopted an MTD solution?

Having seen this apparent contradiction up close, I have a theory as to why the MTD adoption is so low. Because MTD introduces a new paradigm based strictly on mobility threats, and because MTD does not leverage current enterprise security infrastructure, it represents a big challenge to enterprise security teams. MTD is another expense, sure, but the real reason it hasn’t been widely adopted is that it’s hard to deploy.

Consider some of the elements of an MTD enterprise deployment and consider how little alignment exists with current security solutions:

• Mobile app/agent deployment to all employees, and all the challenges associated with the requirement that all users must deploy this security app (help desk, battery drain, “big brother” concerns by employees)
• Remediation policies, including requiring employees to delete offending apps (including related HR policies)
• Enterprise policies regarding rooted/jailbroken devices
• EMM integration
• PII management, especially regarding EMM integration and agent deployment

On top of that, there’s a whole new taxonomy for the enterprise IT staff to master and new concepts that must be operationalized: mobile malware and its many variants (spyware, trojans and fake apps, ad fraud, click fraud, ransomware); man-in-the-middle attacks; targeted attacks, secure transport enforcement; OS vulnerability assessment; and the list goes on.

Finally, BYOD devices are far more personal, and likely to have far more personal data, than legacy desktop or laptop systems. Taking some element of control over such devices in the workplace raises big concerns for employees who have their text messages, chats, pictures, and other personal data on their device. Even the apps that are installed on the device can imply much about a user. Any mobile security deployment that’s not done in conjunction with clear and transparent HR policies will almost certainly encounter personnel issues down the road.

This is the heavy lifting of MTD: A security team has to master new concepts, terms and systems to deploy and manage MTD. Furthermore, the system has to be justified even though it doesn't leverage the current security infrastructure.

So what should an enterprise do?

-->

In upcoming posts, I will be exploring options for enterprise mobile security that leverage existing security infrastructure while providing a more lightweight but effective solution. Stay tuned!