Apple or Android is irrelevant: Zimperium reveals how hackers are breaking into your phone

Texas-based Zimperium, which protects the mobile phones of US troops, says Australians are among the world’s worst for downloading apps from non-official sites.

The Asia Pacific region outpaced all others in “sideloading” or downloading apps from unofficial stores, Zimperium says.

Hackers are “exploiting the trust employees” have in the smartphones in an attempt to stage Medibank and Optus-style cyber attacks, according to the company that protects the mobile devices of US troops.

Texas-based Zimperium, which built a “mobile threat defence” shield at a data centre in Canberra, said 82 per cent of phishing sites – a common way of tricking people to share personal and sensitive information – were increasingly targeting enterprise mobile devices.

Zimperium said Microsoft was the “most phished brand” representing 23 per cent of all imitated sites last year, while hackers were also skirting security measures embedded in Android and iOS devices.

Australians and others in the Asia Pacific region were more likely to engage in what is known as sideloading – downloading apps which aren’t from official app stores – heightening the risk of installing malware on their phones and their data or life savings being fleeced, it found.

The company, formerly backed by Titanium Ventures, said criminals were targeting Australian airports and planes, using a simple device that could be bought on eBay for $20, to create fake Wi-Fi networks to steal data from unsuspecting users.

In its latest Mobile Threat Report, Zimperium said the number of enterprise devices connected to unsecured networks had surged 45 per cent in the past year, leaving Australian businesses exposed. It said on average a mobile phone connects to a “risky network” about 17 times each year, providing a gateway for criminals to steal sensitive corporate data.

Zimperium chief executive Shridhar Mittal described the “mobile-first” approach as “mishing”, given the attacks specifically exploited smartphone vulnerabilities.

He said most phishing attacks (76 per cent) targeted enterprise users via HTTPS links, lulling people into a false sense of security that the websites they were clicking on were safe. Mr Mittal said employees were less likely to notice the phishing attempt because of the smaller screen sizes of mobile devices and “less visible security indicators, such as hidden URL bars”.

“It is undeniable that mobile devices and applications have become the most critical digital channels to protect in our organisations,” Mr Mittal said.

“In today’s digital age, where 71 per cent of employees leverage smartphones for work tasks, enterprises must effectively protect their mobile endpoints by adopting a multi-layered security strategy including mobile threat defence and mobile app vetting. Our zLabs researchers meticulously analysed the nature of mobile attacks, uncovering an attack surface within enterprises that requires a strategic and mobile-centred response.”

Zimperium senior vice-president of product management Chris Cinnamo said hackers were also getting around iOS and Android security measures.

The number of what Mr Cinnamo called “common vulnerability and exposures” increased 10 per cent to 269 on iOS devices, while Android devices recorded a 58 per cent increase to 1421 compared with 2022.

“Mishing attacks and mobile malware are increasingly evading detection – often going unnoticed by businesses,” Mr Cinnamo said.

“The data underscores that iOS and Android devices are not inherently secure, with both platforms seeing significant vulnerability increases. Despite frequent updates – 24 for Android and 35 for iOS in 2023 – enterprises are finding it difficult to manage updates across all devices, highlighting the need for proactive mobile security strategies beyond platform updates.

“To effectively navigate this evolving mobile threat landscape, enterprise security teams must prioritise the attacks specifically targeting employee mobile devices. Without proactive measures, these attacks will continue to weave into enterprises, exploiting the sensitive data and disrupting organisational operations.”

Zimperium said “sideloading” has been a particular problem for banks and financial services. It said 68 per cent of these mobile threats could be attributed to sideloading,

“APAC (Asia Pacific) outpaced all regions in sideloading risk, with 43 per cent of Android devices sideloading apps,” Zimperium said.

“zLabs researchers found that mobile users who engage in sideloading are 200 per cent more likely to have malware running on their devices than those who do not.

“Riskware and trojans, applications that disguise themselves as legitimate apps, are the most common malware families found.”