The advent of new technology is turning Africa into a source and a target for malware attacks.
By Tullah Stephen
While Africa prides itself of achieving mobile first status, the prestige has brought with it a peril that is fast hurting her people. The rise of mobile malware attacks targeting mobile phones has increased unabated. Malware, is any form of malicious software written with the intent of doing harm to data, devices or to people. Initially, they were designed to only target mobile desktops, laptops and servers but things have since changed.
A recent study on the impact of mobile attacks in enterprise environments carried by Check Point a global cyber security, revealed that enterprise mobility was found to be susceptible to attack on both major mobile platforms, android and iOS.
Out of 850 organizations worldwide surveyed by Check Point, 51 per cent in the EMEA had experienced at least one mobile attack in the last year with an average being 54 per company. A research by Serianu an IT service and business consulting firm in 2016, ranked the sectors most vulnerable to cybercrime on the continent placing Finance and government at the top. Technology firms, telcos and manufacturing sectors were also key targets for attackers.
“The explosion of mobile devices, remote workers and Bring Your Own Device (BYOD) has been among the reasons we are seeing an increase of malware attacks on mobile,” says Ryan McGee, Mobility Sales leader at Check Point. Attackers are exploiting the weaker security controls in less developed nations. Attackers McGee explains, have realized that it is easier to target mobile phones than corporate networks.
A report by global digital agency We Are Social and Hootsuite, reported that Africa currently has over 4 billion people using the internet growing by 20 per cent in 2017. Affordable mobile technologies and devices have also contributed largely to the growth of internet users.
Ryan-McGee, Mobility Sales leader at Check Point.
Mobile devices have increasingly become assimilated into the business environment through BYOD, CYOD methods. Employees are choosing to use their phones to access work emails or undertake other sensitive information. They are also downloading apps sold on third party platforms that in most cases are infected with malware. Some of these devices are not managed by security measure such as enterprise mobility management (EMM) platform of any mobile threat management platform. Such platforms have been known to restrict some of the liberal authorizations and user settings on BYOD devices.
“Attackers are using network based attacks such as hoaxed Wi-Fi, malicious management profiles to phish data as well as attacks on mobile operating system. They are focusing efforts on malware that can also disable security services and infect machines in order to be easily exploited.”
Some of the common sources are from malware-infected app downloaded from third party stores. Other sources include; man-in-the middle attacks over Wi-Fi where a malicious actor intercepts, sends and receives data meant for another person without either of the parties knowing. Operating System exploits and malicious links sent over SMS have also been common types of attacks on users.
With increasing risks, McGee says the solution is not prohibiting the use of Mobile IT to prevent attacks. EMM is the foundation of threat mitigation without which employees will be exposed to smartphone attacks. “There are demonstrated advantages that corporates can get from mobile users accessing their devices to access information where and when they need it. Therefore a growing need to ensure it is done in a safe environment.”
There are a number of solution providers who are offering products that corporates can use to protect their employees and their devices. Check Point, for example is rolling out a product dubbed SandBlast which the company says identifies malwares and actively blocks it with minimal impact on user delivery times. SandBlast Mobile adds a critical security layer that can be used to dynamically change access privileges to reflect risk levels and transform static management policies into dynamic mobile threat prevention. The product currently rolled out in two packages; corporate and personal offerings. Pricing can be per device or on user bases depending on what customers prefers.
McGee says challenge in combating cybercrime in Africa in generally a lack of understanding on what cybercrime is. In addition to the ignorance, criminals have taken advantage of the weak legislative environment. However there has been a growing awareness with corporate and government acknowledging the impacts malware attacks and the need for effective response.
