WireX shines a spotlight on app security

Botnet hijacked smartphones for DDoS attacks, reinforcing need for users to pay closer attention to apps they download, use

intro sneaky malware2

The WireX botnet, which used compromised apps to hijack smartphones to send bad traffic in the execution of DDoS attacks, introduced a new threat: weaponized smartphones.

And what’s even more startling is that Android devices – an estimated 70,000 – and their users were unknowingly participating in DDoS attacks because the botnet was secreted away inside hundreds of apps that users were downloading from the Google Play Store. 

While Google has since removed the offending apps, WireX and malware like it illustrate the need for mobile network operators to be diligent about security, and also for app users to pay closer attention to the apps they’re downloading and using.

App users don’t put security first

WireX was successful, in part, because many device and smartphone users either don’t consider security when downloading an app or they don’t know what a botnet is, and are therefore unaware how to protect themselves. 

According to recent A10 Networks research (the author is an employee of A10), 38 percent of IT decision makers say their company’s endpoints and infrastructure have suffered a botnet attack at least once, and 12 percent are not sure.

Meanwhile, one in four employees say they don’t know what a botnet is and 11 percent don’t know if they’ve been a victim. On top of that, one out of three (37 percent) employees surveyed say they aren’t familiar with DDoS attacks, which makes it hard to protect someone when they don’t know what the dangers are. 

This is even more disturbing when almost half (48 percent) of IT leaders say they agree or strongly agree that their employees do not care about following security practices, according to the survey findings.

Who’s responsible for the security of your mobile apps?

App developers, IT departments and end users are at odds over who is responsible for application security and best practices regarding the many apps on your phone. Only two out of five (41 percent) employees claim responsibility for the security and protection of non-business apps they use. 

Yet the survey revealed that four out of five (83 percent) employees only think about the potential security risk when they first download an app, but after that initial download security is less of a thought or priority. And nearly one in five say they do not think security is a concern at all when downloading apps.

Additionally, only one in four (24 percent) employees surveyed think of security as the most important attribute of an app, ranking security behind performance and ease of use.

Roughly one in three employees think about security when it comes to using personal apps, while security is even less of a thought when using business apps, with only one in five citing security as a top thought while using them.

While WireX hijacked thousands of devices through seemingly harmless apps, it’s a frightening reminder that it only takes one app with weak security to infect a mobile device and become part of  large DDoS attack  , which can bring entire businesses to a screeching halt.

Attacks like those carried out leveraging WireX present a good opportunity for IT to remind employees to pay closer attention to the apps they’re downloading and that run on corporate networks and to use good identity hygiene by implementing multi factor authentication, using longer pass phrases over passwords and deprecating expired employee accounts and monitoring access logs.

Copyright © 2017 IDG Communications, Inc.

Microsoft's very bad year for security: A timeline