Mobile Device Security: Best Practices Against Malware

Introduction: Mobile Security in the Digital Age

As the Internet has become the dominant means of communicating, sharing information, conducting business, storing data, and maintaining records in the Digital Age, the importance of mobile security has become increasingly apparent (Zhang et al., 2017). Not only do companies have to invest in digital security to safeguard against threats such as hacking and malware, but individuals also need to be aware of the risks to their personal information and property now that so much of daily life takes place online.

This is particularly important given that so many people today carry pocket computers in the form of a mobile phone — an iPhone, a smartphone, a tablet, an iPad — all of which require mobile protection, as they can connect to the Internet wherever one goes. Cybercriminals are ready and willing to attack mobile devices to steal data, passwords, personal information, and emails — anything that can be obtained through an unsecured network. For that reason, users must exercise extra caution in today's digital world.

Malware Risks in App Marketplaces

One cannot expect free security apps to safeguard against all forms of malware. Zhou, Wang, Zhou, and Jiang (2012) conducted an experiment in which they downloaded 204,040 apps from five different Android Markets between May and June 2011. Of those more than two hundred thousand apps, 211 contained malicious malware: 32 came from the official Android Market (approximately 0.02% of its apps), and 179 came from other online marketplaces, yielding an overall infection rate of around 0.35%. Thus, regardless of where one downloads apps, there is a real risk that an app may contain malware capable of harvesting information or taking control of a device. That risk may be below 1%, but it is never zero — and users should always be aware of it.

Best practices for downloading apps include reviewing an app thoroughly before installing it. However, even that is not a guaranteed safeguard, as many apps on Google Play have been found to be infected with malware in recent years (Bird, 2017). The Android security model, which is based on the isolation model, essentially leaves it to users to assess the security of the apps they download (Delac et al., 2011). Being wary of apps with no reviews or predominantly negative ratings is a reasonable starting point, but it is not a sufficiently sophisticated line of defense. Even if an app is popular and has been downloaded thousands of times, the presence of malware cannot be ruled out simply on the basis of popularity.

It is better to install malware detection software on mobile devices to ensure active protection rather than guessing about risk (Zhou et al., 2012). Seo, Gupta, Sallam, Bertino, and Yim (2014) demonstrate that malware detection is essential for protecting information on mobile devices — without it, a user is dangerously exposed, much like driving without a seatbelt at high speed on an icy road at night with no headlights. Similarly, Ahmadi, Sotgiu, and Giacinto (2018) show that IntelliAV, a system they developed, can function as a learning-based on-device anti-malware solution.

Bird (2017) reported that among the many types of malware found on Google Play, one of the most harmful was ExpensiveWall, which sent unauthorized text messages and charged users for services they had not requested. At least 50 apps on Google Play were found to be infected with this malware. Delac, Silic, and Krolo (2011) found that worms, Trojan horses, and other viruses are commonly installed on mobile devices through the downloading of harmful or infected apps.

Platform Security Models and Vulnerabilities

Some protections against infection are built into Android phones, which operate on a Linux kernel and use an isolation model (Delac et al., 2011). However, this approach comes with its own limitations, as it can reduce the functional effectiveness of apps. The shared user ID feature permits mobile devices to share information with one another, which in turn makes them vulnerable to security threats, including hacking, malware, and spyware. An iOS platform could also benefit from isolation (Delac et al., 2011), though isolation alone is not a guarantee of complete security.

Conclusion

The Internet today can be a dangerous place, and though most users are not inclined to think about security, the fact is that they have to be very mindful of it, especially as they are now more connected to the Web than ever before. Their mobile devices are all potential targets for cybercriminals, which means that users must be informed about best practices for protecting their information, securing their data, and safeguarding their devices.

Assuming that downloading apps only from trusted sites like Google Play is sufficient protection would be a serious error in judgment. Even reputable platforms have vulnerabilities. The best approach is therefore to ensure that one's devices serve as both the first and last line of defense. Anti-malware should be installed, devices should never be jailbroken or rooted, software updates should always be applied promptly, and third-party app sites should be avoided. The popularity of an app is no guarantee that it is malware-free. Safe devices are effective devices, and installing robust security features should be the default choice for all mobile device users in today's Digital Era, where new threats continue to emerge.

References

Ahmadi, M., Sotgiu, A., & Giacinto, G. (2018). IntelliAV: Building an effective on-device Android malware detector. arXiv preprint arXiv:1802.01185.

Bird, D. (2017). Mobile threat. ITNOW, 59(4), 46–47.

Delac, G., Silic, M., & Krolo, J. (2011, May). Emerging security threats for mobile platforms. In MIPRO, 2011 Proceedings of the 34th International Convention (pp. 1468–1473). IEEE.

Seo, S. H., Gupta, A., Sallam, A. M., Bertino, E., & Yim, K. (2014). Detecting mobile malware threats to homeland security through static analysis. Journal of Network and Computer Applications, 38, 43–53.

Zhang, Y., Chen, X., Li, J., Wong, D. S., Li, H., & You, I. (2017). Ensuring attribute privacy protection and fast decryption for outsourced data security in mobile cloud computing. Information Sciences, 379, 42–61.

Zhou, Y., Wang, Z., Zhou, W., & Jiang, X. (2012). Hey, you, get off of my market: Detecting malicious apps in official and alternative Android markets. NDSS, 25(4), 50–52.