Here are the top threats to Mobile security in 2023, along with tips for avoiding them.

Our mobile devices are now the foundation of our social, financial, and communication life, making them tempting targets for hackers. Threat actors are always developing new ways to hack smartphones, whether you use an Apple iOS or a Google Android model. This covers everything from common spam and harmful links shared on social media to malware that may track you, compromise your banking apps, or infect your device with ransomware.

The top threats to Android and iOS smartphone security in 2023

Smishing and scamming

When attackers send you phoney and phoney messages, it is phishing. Cybercriminals try to trick you into handing up your account credentials for a bank, PayPal, social network, email, and other services in exchange for personal information, clicking on harmful links, installing and unintentionally executing malware on your computer, or other actions. 

Phishing attacks on mobile devices can be sent via whatever channel a PC can, including social network posts and email. However, smishing, or phishing attempts sent over SMS texts, can also affect mobile devices.

Whether you are using an iOS or an Android device, phishing can happen to either. All mobile devices are created equal in the eyes of fraudsters and online criminals.

Your best line of defense is to never click links in emails or texts unless you are certain that they are legitimate.

SIM hijacking 

When clients need to exchange their SIM and phone numbers between operators or devices, telecom companies legitimately offer a service known as SIM swapping or SIM porting. SIM hijacking, also known as SIM switching or SIM porting, is the misuse of this service.

A customer would typically phone their telecom provider and ask to switch. But an attacker can impersonate you and trick customer service agents into handing over your number by using social engineering and the personal information they learn about you, like your name, address, and contact information.

A cybercriminal will be able to divert your calls and texts to a device they possess if their attack is effective. This is significant because it also means that any two-factor authentication (2FA) codes used to secure your banking, email, and social media accounts, among others, will also end up in their possession. 

 Since SIM hijacking requires physical effort and data collection, it is typically a targeted attack. They can, however, have disastrous effects on your privacy and the safety of your online accounts if they are successful.

Your best line of defence is to safeguard your data using a variety of cybersecurity best practises to prevent social engineering attacks. Think about requesting that your telecom company include a "Do not port" remark to your file (until you come in person).

FREE Wi-Fi

Hotel rooms and coffee cafes both have open and unsecure Wi-Fi networks. Although they are designed to be a customer service, their openness makes them vulnerable to attack.

In particular, open Wi-Fi connections could make your phone or computer vulnerable to Man-in-the-Middle (MiTM) attacks. Your information will be stolen, malware payloads will be sent to your device, and it's possible that your device may be taken over if an attacker intercepts the conversation between your handset and browser.

The best defence is to use mobile networks as opposed to public Wi-Fi. Consider using a virtual private network (VPN) if you must connect to them. 

Physical security

Physically protecting our mobile devices is an important security practise that many of us overlook. We are not allowed to utilise a PIN, pattern, or biometric verification like a fingerprint or retina scan because doing so leaves our handset open to hacking. Additionally, your phone could be stolen if you leave it unattended.

Your best line of defence is to secure your phone with a strong password or PIN number, at the very least, to prevent unauthorised access to your accounts and data should it fall into the wrong hands. 

Ransomware

Both PCs and mobile devices can be affected by ransomware. Ransomware will try to encrypt your files and directories, locking you out of your phone, and then demand payment through a threatening landing page, usually in cryptocurrency. The two best examples are Koler and Cryptolocker. 

Ransomware is frequently used as a payload on rogue websites or in third-party software. For instance, you might see a pop-up asking you to download an app that might be used to encrypt your phone in a matter of minutes. This app could be anything from a software cracker to a pornographic viewer.  

Your best line of defence is to keep your phone's firmware up to date, enable the basic security features on your Android or iOS device, and avoid downloading apps from sources other than authorised repositories.

malware and Trojans

Although there are countless mobile malware variations, many are stopped in their tracks by Google and Apple's fundamental security measures. Trojans top the list of malware families, which you should be wary of.

Trojans are types of malware that are created with the intention of stealing data and making money. Drinik, MaliBot, and EventBot are examples of mobile variations.

Users typically download malware themselves, which may be disguised as a trustworthy and benign software or service. On your phone, though, they overlay a banking app's display and collect the login information you enter. The attacker can use this information to steal money from your bank account after it is transmitted to them. The 2FA verification codes may potentially be intercepted by some variations.

Most financial trojans target Android mobile devices. iOS variations are less common, however strains like XCodeGhost are still around. 

Your best line of defence is to keep your phone's firmware up to date, enable the basic security features on your Android or iOS device, and avoid downloading apps from sources other than authorised repositories. Stop using financial apps, turn off your internet connection, do a personal check, and run an antivirus scan if you think your phone has been compromised.

What should I do if I believe that my iOS or Android phone has been compromised?

You should act quickly to preserve your privacy and security if you believe your Android or iOS device has been infected with malware or has been hacked in any other way. Consider the following actions:

 1. Run a malware scan:-

You should make sure your phone has the most recent firmware and operating system because updates frequently include patches for security flaws that could be used in attacks or the spread of malware. Users can get security protection from Google and Apple, but it wouldn't harm to use a specialised antivirus app. Avast, Bitdefender, and Norton are available options. Even using only the free versions of these applications is still preferable to doing nothing.

2. Review permissions:-

On your mobile device, you should occasionally look at the apps' permission settings. Consider revoking them or removing the app altogether if they seem excessive for the app's features or utility. Remember that some developers, particularly those working in the Android ecosystem, will publish useful tools and apps on Google Play only to later repurpose them for harmful purposes.

In other words, reputable programmes aren't necessarily what they seem to be, and things might suddenly alter. For instance, in 2021, a well-known barcode scanner developer released a rogue upgrade that allowed him to instantly take over millions of devices.

3. Securing communication channels:-

Avoid utilising free, open Wi-Fi networks. Stick to mobile networks instead, and disable Bluetooth, GPS, and any other features that could broadcast your data if you don't need them. 

4. Premium service dialers:-

Go through your apps and uninstall anything suspect if you've received unforeseen invoices. Additionally, you can contact your telecom company and ask them to block premium SMS and phone numbers.

5. Ransomware:-

If you've unluckily fallen victim to mobile ransomware and are unable to access your smartphone, you have a few options. 

Cut off any internet and other connections, including any wired ties to other devices, if you were made aware of the ransomware before your device was encrypted and a ransom letter was shown. Then, restart your phone in Safe Mode. Before any serious damage takes place, you might be able to delete the problematic software, run an antivirus scan, and clean up.

Your options are more constrained if your phone is locked because getting rid of the spyware only solves a portion of the issue. 

Consider tying your important 'hub' accounts, financial services, and cryptocurrency wallets to a number that isn't associated with you publicly in order to reduce the risk in the first place. If your personal or business numbers are hacked, there are less prospects for theft with a simple pay-as-you-go number. 

 
Thank you.