Most Frequently Used Mobile Hacking Techniques

Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobile device users in the last decade. There are over 3.7 billion mobile users globally while over 3 billion of them use smartphones. Mobile device security has come to the front burner given increase in smartphone penetration worldwide, which average at about 75% in developed economies (mostly west countries) and 52% in developing economies.

  The attack surface for mobile devices and endpoints is diverse due to several vulnerabilities associated with mobile devices just as is the case with traditional computing systems (e.g. PCs, servers) in addition to their direct access to the internet. The far-reaching impact of mobile hacking some of which are reputational damages and financial losses arising from theft of confidential and personal identifiable information has dramatically altered the cybersecurity landscape. Unauthorized access could be gained into stored and communication data, recording instruments such as microphones and cameras, location data and peripheral tools like Bluetooth & Wifi, among other. This section explores some of the modern techniques used to exfiltrate personally identifying information from mobile devices without the knowledge of mobile users. Effort will be made to also explain the detection modes and ways of preventing same.

Hackers are not re-inventing the will. Same traditional or conventional methods used to attack PCs are what is being rewritten for mobile device hacking. What changed is platform differences (Windows/UNIX/Linux for PCs/severs and Android/IOS/Windows for mobile devices).

Here are some of the common ways hackers are accessing your mobile device without you ever knowing about it.

Malware:

Just as in PC and server environment, malware remain a potent means through which access can be gained into your mobile device without your consent. Channels through which malwares are introduced into your device and disseminated to other users remain the same as always, some of which are through being tricked to download files already infested with malware as gaming, social or productivity apps, phishing techniques such as email phishing where tricking links of important resource are sent through email that triggers malware download once clicked, smishing (sms phishing) attacks where fabricated input forms or malware are hidden in an eye-cashing SMS message to induce users to act on them, among others. Some of the known malware for mobile devices include the infamous SkyGoFree, a spyware designed to steal personally identifiable information. The programs are also capable of collecting audio through the microphone, photos and video through the camera in real-time as well as live location data through GPS functionality, wire-tapping phone communications and event/contextual driven data collections.

Synchronization:

Given that most mobile users operate their mobile devices as an extended removable storage drive, there is always the tendency to synchronize their devices either with their PCs or other peripherals for easy access to multimedia files such as photos, music and videos. From this point of view, when mobile devices are synchronized with PCs or other peripheral devices, some types of malware (e.g. virus, trojan horse, worms, etc.) could jump to (or potentially from) both ends. Users are to beware of who they synchronize their devices with as well as peripheral devices they connect to in public places as some of them could have been spoofed or compromised and then used to disseminate malwares.

 

Buffer Overflows:

This type of attack can be used to compromise the integrity of data being stored or in-transit in a mobile device. Where data packet injections are constantly being made to overrun a temporary storage or memory area in a manner to overwhelm the devices and make it unavailable for legitimate task, it could render the device unusable and give room for codes to be injected/executed remotely in addition to privilege escalation for the purpose of taking over the devices for illegitimate or unauthorized use. This form of attack could be facilitated by things like unvalidated inputs vulnerabilities that a hacker most have discovered from either an application or operating system of a device.

Denial of Service (DoS) Attacks:

DoS attacks are deployed to render mobile device resources unusable or unavailable for legitimate users by flooding the device with endless requests in order to overwhelm it. Most of the time, the hacker must have discovered a vulnerability or loophole of some sort on the device and exploit same to their advantage not for any real/tangible benefit but to make the device unusable. This is usually done to damage the reputation of the phone manufacturer in a large scale to cause customer dissatisfaction to the extent that will shift buyers away from the company.

Old-School Voicemail Attacks:

Voicemail attacks are one technique that harkens back to the days of phreaking and the origins of hacking. Phone companies often select a default voicemail PIN for accounts that have not yet specified one, and these default PIN codes are available online. The hacker then calls the target’s voicemail, references the default PIN code, and gains access to their voicemail account. The hacker can then collect information from voicemails, gain unauthorized access to phone menus, and make unauthorized changes to services that rely on voicemail and automated menus.

Bluetooth Techniques:

Though not frequently used as phishing and malware attacks, Bluetooth hacking is equally a potent technique for many mobile device hackers. Bluejacking is a method of sending unsolicited messages over Bluetooth connections to Bluetooth-enabled devices such as mobile phones, PDAs or laptop computers. Through OBEX protocol, vCard typically containing a message in the name field (i.e., for bluedating or bluechat) is sent to another Bluetooth-enabled device. Bluesnarfing is gaining unlawful access to information from a wireless device through a Bluetooth connection, often between Bluetooth-enable devices like phones, desktop & laptop PCs, and other PDAs. OBEX protocol for Bluetooth business cards (vCard) is vulnerable and could be exploited for a hacker’s device to access the target’s device directly without their permission as long as their Bluetooth is turned on. The take away here is to always put off your Bluetooth when not in use.

Physical Access to Devices:

The one who have physical access to a target device has more control and can make the most potent harm. In this case, attack is more direct with less sophistications unlike the other methods that will require some level of sophistication and effort. Attackers with physical access to the device can easily install malware or establish covert unauthorized connections with the intention to use them later. While this form of attack is very potent, it is the most unlikely of them all given the effort required to get hold of the target device except where close family member or domestic staff are used to facilitate same.

  Cybersecurity awareness and education is the foundation towards preventing the above listed attacks. Mobile users most understand the threat/attack vectors that could facilitate the perpetration of these forms of attacks and guard against them by showing the right attitude to security. They must be able to recognize phishing/smishing messages when they see one, ensure regular patching of their operating system software and applications for fixes that have been made by the OEMs and App vendors, limit physical access to their mobile devices, turning off file sharing services when not in use, among host of others.  
 

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at info@oxleyconsults.com.ng.



Back To Information and Cyber Security Jobs

Learn More About Our Valuable IT Audit Programs/Checklists

Learn More About Our Valuable Risk Assessment &Templates & Checklist

Learn More About Leading Practices in Internal Audit Function

Popular Articles

Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More
Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More
Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More
The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More
The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financialLearn More
The series attempted to answer most of the governance and mgt questions/concerns and how IT Governance and Management Questions are mapped to COBIT 5Learn More
Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
Privilege access mgt is one of the critical elements of user access mgt for every organization & building controls around them is vital for security of IT assets..Learn More
Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised daily...Learn More
To ensure the security and performance of application database, it is best to adopt security baselines (a.k.a. minimum security requirements) in addition to other operational controlsLearn More
Learn how you can secure your web APIs using the best security practices and control frameworks. For IT and information assurance practitioners.Learn More

IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia

Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now

 

Let us know your thoughts post. Leave a Comment below.