Mobile Threat Defense

May 24 2021

The President’s Executive Order on Cybersecurity is a Massive Shift for Security

The latest ransomware attack on Colonial Pipeline highlights the worst secret in cybersecurity; our nation’s critical infrastructure is not prepared to stand up against the modern cyber threats. Systems like these have been the target for attacks from domestic and foreign cybercriminals for years. These groups are armed with the latest and most effective zero-day exploit attacks that traditional signature-based defenses simply cannot defend against. And the attacks maintain the upper hand against these outdated security systems that meet bare minimum security requirements.

But on May 21, 2021, President Joe Biden announced the most substantial executive order on cybersecurity, focusing on improving the Federal Government’s efforts to defend itself from future cyberattacks. While most of the rules stated in the executive order direct Federal systems, it also raises the bar of security expectations from vendors regarding support of these new security guidelines, focusing on prevention, detection, response, and investigation. While this language is not unique to many that have adopted the latest in security architecture, it advances the Federal Government’s mission. It supports the ‘lead by example’ vocabulary included in the order.

“The Federal Government must lead by example. All Federal Information Systems should meet or exceed the standards and requirements for cybersecurity set forth in and issued pursuant to this order.”

A vital component of the executive order appears in Section 3, focusing on modernizing the Federal Government’s Cybersecurity around Zero Trust architecture and minimizing the barriers of cybersecurity data sharing for identifying and managing risks. Zero Trust architecture addresses this with its foundation of “never trust, always verify”, designed to secure modern workspaces against comprehensive threats through network segmentation, device attestation, and identity verification. Zero Trust is advanced access control that requires verification from every user trying to gain access to data, no matter their location or device being used. This architecture defines that all data, endpoints, and services are considered resources, and access is defined by a policy that takes into consideration the requesting endpoint, behavioral attributes, and the security state of the requestor’s identity.

As Federal agencies adapt and enable users to work outside established security perimeters and access data through mobile endpoints, they must also address the inherent risks involved. And over the last year, agencies have followed the National Institute of Standards and Technology (NIST)’s SP 1800-22 Mobile Device Security: Bring Your Own Device (BYOD) to enable their employees to work in remote and distributed functions. But in order to truly secure the data accessed on personal mobile devices, Zero Trust must be implemented, and with it, mobile device integrity must be insured. This executive order addresses the gaps that exist, like with mobile implementations into advanced EDR, XDR, and Zero Trust security architectures, for a cohesive and progressive security strategy.

“Zero trust assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location (i.e., local area networks versus the internet) or based on asset ownership (enterprise or personally owned). Authentication and authorization (both subject and device) are discrete functions performed before a session to an enterprise resource is established.” – NIST Zero Trust Architecture, SP 800-207, August 2020

While Zero Trust architectures already do exist within areas of Federal systems, the standards set out by the executive order show that the Federal Government is taking a progressive and aggressive approach to shoring up the security of its digital infrastructure. And with the modernization of Federal systems comes the added goal of driving the public sector to match the security improvements, leading to a cohesive national push towards prevention against the next attack. By using the standards set by NIST’s SP 800-207: Zero Trust Architecture, both public and private sectors are provided the strategic roadmap needed to move from a static-network-based security perimeter to an advanced security model that addresses modern threats.

“The private sector must adapt to the continuously changing threat environment, ensure its products are built and operate securely, and partner with the Federal Government to foster a more secure cyberspace.”

One of the biggest challenges for critical infrastructure and Federal agencies has been migrating from legacy security solutions to an architecture that supports a constantly evolving threat. As the latest attack on the Colonial Pipeline has shown, meeting the minimum standards is not enough to stand up against the advanced capabilities of the modern cybercriminal. For the Federal Government to avoid being the victim themselves, they must evolve their own security to match and exceed the capabilities. With this executive order, though, the President is setting a precedent that the old, legacy approaches to security must be addressed, paving the way for a modern approach to threat prevention.

“[This executive order] shall require agencies employing software developed and procured prior to the date of this order (legacy software) either to comply with any requirements issued pursuant to subsection (k) of this section or to provide a plan outlining actions to remediate or meet those requirements, and shall further require agencies seeking renewals of software contracts, including legacy software, to comply with any requirements issued pursuant to subsection (k) of this section, unless an extension or waiver is granted in accordance with subsection (l) or (m) of this section.”

While other executive orders have emerged from past Presidents, never before has one been so focused on implementing what is seen as industry standard outside the Federal space. Following the release of the executive order, Defense Information Systems Agency (DISA) released their report Department of Defense (DOD) Zero Trust Reference Architecture, laying the framework for the next generation of cybersecurity architecture. Evolving from legacy approaches to security, DISA’s findings are based on Zero Trust principles, addressing not only the threat of today but tomorrow.

“Zero Trust implements continuous multi-factor authentication, micro-segmentation, encryption, endpoint security, analytics, and robust auditing to DAAS seven pillars to deliver cyber resiliency. As the Department evolves to become a more agile, more mobile, cloud-instantiated workforce, collaborating with multiple federal and non-governmental organizations (NGO) entities for a variety of missions, a hardened perimeter defense can no longer suffice as an effective means of enterprise security.”

Just as the private sector has evolved with the modern workforce, DISA recognizes the need to protect the resources within the security perimeter and data that travels outside it. As the lines have blurred between the mobile and traditional endpoint in the workforce, with mobile devices taking the lead as the most commonly accessed device, DISA significantly advances the notion of complete endpoint coverage for security. With advanced mobile threat defense solutions implemented into security architectures, agencies can deliver comprehensive Mobile Endpoint Protection (MEP) to their unclassified mobile offerings and shoring up the President’s Zero Trust initiatives.

“Zero trust is a response to enterprise network trends that include remote users, bring your own device (BYOD), and cloud- based assets that are not located within an enterprise-owned network boundary. Zero trust focuses on protecting resources (assets, services, workflows, network accounts, etc.), not network segments, as the network location is no longer seen as the prime component to the security posture of the resource.”

Just as the threats against our infrastructure have evolved, so has the modern workplace for private and public sectors. But to keep up with both, the approach to critical security systems must advance beyond the legacy, signature approaches and into cohesive security architectures that secure all data-accessing systems, from BYOD to traditional endpoints.

Ultimately these two releases, one spurred by a cybersecurity attack and the other developed as an evolving component of the Federal security strategy, reflect positive shifts in cybersecurity mindsets within the public sector. It is time for the cybersecurity strategy of the country to evolve and not just meet the minimum requirements. To prevent future attacks, the mindset must change and evolve to match the threats. While the Colonial Pipeline incident may not have surprised many in the space, the lessons can direct the future of cybersecurity for the nation.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS, and Chromebook threats. Powered by z9, Zimperium provides protection against device, network, phishing, and malicious app attacks. For more information, visit www.zimperium.com.

The President’s Executive Order on Cybersecurity is a Massive Shift for Security

Source

May 18 2021

Sideloaded Applications: The Risk of Fewer Restrictions

Would you trust an application on your device from a third-party app store? Would you trust that same app store on the endpoints connected to your corporate infrastructure?

The premise of a third-party app store is relatively innocent on the surface, with hundreds of repositories set up to enable mobile device users to get the apps they want without some of the hurdles that may stand in their way. And beyond that, some app developers even provide direct-download options that take advantage of Sideload capabilities to bypass app store controls altogether. In the traditional endpoint space, none of these alternatives or means of access feel out of the ordinary for a conventional user.

But for mobile endpoints, it’s a different story. What happens if those apps aren’t being vetted by the official app store?

Google Android and Apple iOS devices all come pre-installed with their own app stores, filled to the brim with everything a user could want. Protected under an umbrella of processes from security scans to approvals, these applications must meet guidelines to be accepted into and available to the users of these devices. The user has increased confidence in the application itself with the trusting nod from Apple and Google (OEMs).

But outside these OEM app stores, there exist alternative means that don’t have these layers of confidence built-in. While some third-party app stores are OEM alternatives from the likes of Samsung and Huawei, most of them exist as massive app repositories for mobile endpoint users to bypass existing rules, controls, or fees to deliver their app to the masses. Available on both iOS and Android devices, these alternative app stores often act as a black market with very similar traits; the available app could be the same, or an elaborate copy and decoy, and the only way to tell is to take it apart. But as most mobile users won’t be breaking down the code of the app they just installed, these alternatives have become ripe with malicious code.

Simply put, unofficial app stores cannot be trusted. They put users, enterprises, and all the data they access at risk.

Another rising trend in the mobile application world is to offer a download directly from the developer’s website, circumventing any controls, restrictions, and management that comes with OEM-based stores. Providing instructions to users on sideloading, these direct methods have been used to deliver applications to mobile endpoints after they have been banned due to security or privacy concerns, refusing to accept established terms of service, or regional restrictions.

While most third-party app stores run through browser-accessed repositories, some have formalized their process with their own on-device app. Both approaches require a user to enable the installation of apps from unknown sources, including the browser, bypassing the standard safety checks found in OEM app stores. These unmanaged, unprotected store applications open mobile devices up to risks and vulnerabilities and sometimes are used to deliver malware directly to the user’s phone.

Circumventing the established protocols for code verification, app management, and security leave users at risk of vulnerabilities that might not have been caught during development. And while many of these developers are putting in the hard work to deliver genuine products, side-loaded applications are outside the purview of app store updates, requiring users to update manually.

Is it worth the risk?

OEM are consumer-friendly repositories with layers of local control to keep apps up to date to the latest versions and provide users with the information they need. And while many organizations rely on mobile device management for their environment, these tools lack security controls and capabilities that can keep mobile endpoints secure from all apps, no matter their origin.

In the end, the only way an IT and security team can be confident of the mobile applications connecting to their network are secure is with mobile threat defense (MTD). Securing these highly accessible devices from the risks and vulnerabilities in both OEM and third-party app stores and protecting against other common attack vectors raises the security confidence of a team while minimizing the attack surface. While users control the device in hand, the IT and security teams will have granular control to secure enterprise data.

“MTD products not only prevent attacks but also detect and remediate them. MTD focuses on identifying and thwarting malicious threats, rather than relying on device management configuration to protect against simple user mistakes.” – Gartner

While enterprises continue to adapt and expand their data accessibility with mobile devices, they need to approach the security of these endpoints with the same mindset as traditional devices. With more means of connectivity, communication, and portability, the enterprise attack vector is already stretched thin without the risk of third-party app stores. Enabling teams to stay ahead of attacks, scan and remediate risk applications, and close these security gaps keeps enterprises mobile and secure.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS, and Chromebooks threats. Powered by z9, Zimperium provides protection against device, network, phishing and malicious app attacks. For more information, visit www.zimperium.com.

Sideloaded Applications: The Risk of Fewer Restrictions

Source

May 14 2021

Covering Mobile Endpoints in EPP: Zimperium partners with the most Gartner MQ leaders

Gartner EPP MQ

The 2021 Magic Quadrant for Endpoint Protection Platforms (EPP) by Gartner was recently released covering the full spread of strong EPP vendors in the space. As Microsoft and CrowdStrike continue to show dominance as leaders, SentinelOne and Trend Micro are nipping close on their heels. And organizations like Symantec, Cisco, and VMware held strong as visionaries while Blackberry, Check Point, Fortinet, and Bitdefender represent the strongest of the niche players category (in my opinion).

Even though mobile threat defense (MTD) leaders like Zimperium would not be considered for this report, Zimperium is strongly represented through both OEM and security architecture partnerships with organizations in three of the four categories covered by Gartner. And while Gartner’s recognition of this critical security layer does not go into detail over the mobile solution’s effectiveness, the inclusion of the detail in such a substantial report continues to drive home the importance of mobile device security. The analyst firm did recently cover the need for mobile threat defense in-depth with their Gartner 2021 Market Guide for Mobile Threat Defense.

Within the Magic Quadrant (MQ), there is no pattern to those organizations that have adopted MTD into their security offerings, but the numbers speak for themselves. Spread across the full Gartner MQ, BlackBerry, Check Point, Crowdstrike, Cybereason, Fortinet, Microsoft, Panda, Sophos, and Symantec were all recognized by Gartner for their mobile offerings.

On the flip side, only one vendor was cited for the lack of a mobile solution. But this relevant data point provides a brief glimpse into the mindset of Gartner’s analysts as they categorize mobile threat defense as a “common feature.” Gone are the days of passive approaches to corporate-owned and BYOD security, replaced by the need for comprehensive security stacks covering all the endpoints.

Gartner’s position on the adoption and integrations of MTD to support endpoint protection platforms (EPP) is a supporting focus in this year’s report, especially as enterprises need to cover all the endpoints within the infrastructure for their growing distributed workforce.

“EPP solutions may also add mobile threat defense and integration with unified endpoint management to reduce the overall administration burden and allow further consolidation of security operations and IT operations tools.” – Gartner

Not included in the Gartner MQ report but linked to at the end, the Top Security and Risk Management Trends of 2021 focuses heavily on the BYOD environments many enterprises have adopted. This additional report continues to show Gartner’s focus on mobile as a critical area of the EPP, EDR, XDR, and Zero Trust landscape for organizations looking to adapt to modern, distributed workforces.

“All cybersecurity technologies are under pressure to accommodate countless forms of digital transformation, including the use of public cloud computing and reliance on personal mobile devices. Gartner believes a mesh approach is especially useful for cybersecurity. Organizations that want to prepare for a graceful transition to the next decade must reconceptualize their cybersecurity approach to a model that accommodates composability. For many organizations, the cultural issues of “this is not how we do security” will be more challenging than the actual implementation of a service-delivered model.”- Gartner

About Zimperium

Covering Mobile Endpoints in EPP: Zimperium partners with the most Gartner MQ leaders

Source

May 05 2021

Flubot vs. Zimperium

Over the past few weeks, reports of the newest aggressive malware family to impact Android devices have made the rounds. Flubot, the credential and banking malware family, uses SMS phishing techniques to propagate to its victims, purporting to be various vendors and delivery services. The group behind this aggressive malware takes advantage of a common but effective social engineering technique.

The Zimperium zLabs team has analyzed over 300 variants of Flubot and the URLs used to distribute them, finding that the aggressive credential stealer comes with unique features that make it stand out from many other examples of mobile malware seen in the past. The Android malware has been so effective, the UK’s National Cyber Security Centre has issued a cybersecurity warning, providing instructions for removal and reporting of any attempts.

The modern bank robbery is not happening through the front door of a building but with the path of least resistance – banking credentials. Flubot’s credential theft effectiveness comes in the form of its delivery and execution. The victim’s phone receives an SMS, instructing them to click a link to track their “package” via one of the known global shippers. The victim is redirected to a fake or compromised website where the malicious APK is downloaded and installed via side loading. The user wants to track their package and installs the application via side-loading onto the Android device – even walking the victim through the process if unfamiliar.

After installation, a window appears asking for the victim to “Accessibility Services” (a restricted capability allowing monitoring and interaction with all apps/screen content) for the application, enabling the now-installed application to take control without the user even knowing. Once the application has this permission, it uses it to get others such as READ_SMS, RECEIVE_SMS, and READ_CONTACTS. The app registers itself as the main SMS client, which will be later used to steal 2FA credentials.

A key component of credential-stealing malware is an effective command and control (CNC) capability, giving the attacked the ability to grab what they want and not be flooded with untargeted data. In the case of Flubot, the CNC backend is not hardcoded into the malware itself. Instead, it uses a Domain generation algorithm (DGA) – common in advanced desktop malware to generate the CNC URL server address. This enables Flubot to continue to evade its victim’s mobile endpoints if a security team was to block one single address.

Its effectiveness on mobile endpoints is made more so by Flubot’s capability to automate actions. After disabling Google Play Protect, the Android malware then asks to be set as the default SMS and notification tool, enabling it to continue spreading to more victims by collecting contact lists and preventing the victim from seeing the actions. From the moment the malicious application is installed, it also begins monitoring all the applications installed in the device. When a targeted application is opened, Flubot performs an overlay attack to collect user credentials and send this data back to the CNC. At the same time, Flubot uses SMS permissions to read second-factor authentication codes.

One final and very effective trick Flubot pulls on victims is collecting credit card information via a fake Google Play credit card re-verification popup. This is again performed as an overlay attack, looking just like the real popup notification. The unsuspecting victim is encouraged to fill in the necessary details without a second thought.

Flubot vs. Zimperium

Zimperium zIPS customers are protected against 100% of the Flubot variants analyzed with our zero-day, on-device z9 Mobile Threat Defense machine learning engine.

As a standard protocol, the Zimperium zLabs team checks new malware samples against not only the current machine learning model but past ones as well. In the case of Flubot, Zimperium zIPS customers were protected against this aggressive credential stealing Android malware since the first variant was first reported in February 2020.

The screenshot above highlights how Flubot samples are detected with extreme accuracy by different releases of our on-device malware classifier. In the Figure, classifiers up to 3 months back in time are displayed, but samples were detected by classifiers going back over one year.

Zimperium’s z9 malware engine is also able to correctly identify the family of malware (“banker” in this case) on device, allowing customers to create policies around specific malware types, and provide supporting forensics.

The URLs used to deliver the APK consisted 80% of compromised domains (a legitimate website whose hosting server is compromised and a malicious site is stored on it), rendering most traditional phishing prevention techniques obsolete. All reported URLs were analyzed using Zimperium’s z9 ML-based phishing engine. In this case, z9 proactively blocked over 98% of the URLs, preventing the attack chain from its inception. This adds to the layer of protection and security coverage for our customers.

To ensure your Android users are protected from this latest malware, we recommend a quick risk assessment. Inside zConsole, admins can review which apps are side-loaded onto the device that could be increasing the attack surface and leaving data and users at risk.

Remediating a Flubot Infection on Android

Non-Zimperium Customers: If you have fallen victim to the Flubot malware on your Android device, immediate action is necessary to avoid more risks. First, disconnect the device from all connections, including cellular and WiFi, by putting the device into airplane mode. Next, the most effective way to remove the Android malware is through a factory reset. This will wipe the mobile device and load a fresh, clean version of the operating system. Do not restore from backup if it was created after the malware installation. Installing all your user applications fresh from Google Play ensures that you are downloading safe, approved, and secure apps. Finally, reset all your banking passwords, enable 2FA if possible, and notify your banks to increase monitoring on your account.

Not a Zimperium customer? Contact us today for a free mobile risk assessment.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS and Chromebooks threats. Powered by z9, Zimperium provides protection against device, network, phishing, and malicious app attacks. For more information or to schedule a demo, contact us today.

Flubot vs. Zimperium

Source

Apr 14 2021

Zimperium and Ping Identity Extend Zero Trust Controls to the Most Vulnerable Endpoint: Mobile

Integration of Zimperium’s mobile device risk attestation into the PingFederate platform enables real-time Zero Trust authorizations and access to corporate resources

Zimperium is excited to announce a partnership with Ping Identity, enhancing Zero Trust architectures by delivering comprehensive mobile risk posture data to enable joint customers to implement more robust controls and policies to provide end-users with clear, actionable alerts directing them to resolve security or compliance issues. With the real-time mobile threat detection, notification, and response from Zimperium and the PingFederate architecture and enterprise workflows, security teams can ensure mobile endpoint coverage is an integral part of their Zero Trust security posture.

The established perimeters around corporate devices have faded away, replaced by an ever-mobile distributed workforce with global access into enterprise assets. Increased connectivity and data availability enable organizations to grow and evolve beyond a physical location’s confines while minimizing the friction an employee would typically experience in this new, spread-out workspace. For enterprises to securely enable employees to access the data they need on the devices they use the most, Zero Trust must be enabled with advanced mobile threat defense.

Ping Identity, the Intelligent Identity solution for the enterprise, believes zero trust technology is essential to securing business and consumers in an increasingly connected world. And Zimperium’s integration into the PingFederate platform provides joint customers with enhanced controls, addressing the mobile device’s security posture by providing the granular telemetry data back to the Ping Identity Zero Trust architecture.

Using Zimperium’s patented on-device, machine learning-based mobile security technology, the integration enhances Ping Identity’s existing mobile endpoint identity management and access controls. Joint customers will be protected against targeted mobile risks and attacks and will immediately experience the benefits of enhanced Zero Trust capabilities and workflows, such as:

Broadest range of mobile risk and threat-based detection in the industry;
Real-time conditional access across all mobile devices and accounts across a broad range of apps and services;
Direct user feedback on detected risks within the protected app (where applicable)
Defined access policies best suited for the environment; and
Reduced attack surface through mobile endpoint access and authorization controls.

“Due to the rise in distributed work and bring your own device policies, the average enterprise is not securing 60% of the connected devices in their network – mobile endpoints,’ said Jon Paterson, CTO of Zimperium. “The integration between Zimperium and Ping Identity not only brings those devices into the security fold, but it also enhances mobile Zero Trust controls, minimizing mobile risks and attack surfaces.”

This integration between Zimperium and Ping Identity enables enterprises to evolve and scale without sacrificing their security posture. By enhancing existing mobile endpoint identity management and access tools, security operations teams can understand their whole risk posture and raise their mobile security confidence on managed and unmanaged mobile devices.

“Identity is the new perimeter that enterprises need to secure, and the best way to effectively do that is to leverage a zero trust approach that unifies mobile threat defense with strong authentication,” said Loren Russon, vice president of product management at Ping Identity. “Our integration with Zimperium will make zero trust implementation easy for security teams to deliver a more seamless and secure user experience.”

For More Information

Attend our webinar on April 29th at 11am EDT to see a how Zimperium enhances Zero Trust architecture on mobile endpoints.

About Zimperium

Zimperium, the global leader in mobile security, offers the only real-time, on-device, machine learning-based protection against Android, iOS and Chromebooks threats. Powered by z9, Zimperium provides protection against device, network, phishing and malicious app attacks. For more information, visit www.zimperium.com.

Zimperium and Ping Identity Extend Zero Trust Controls to the Most Vulnerable Endpoint: Mobile

Source