This article first appeared in Digital Edge, The Edge Malaysia Weekly on May 9, 2022 - May 15, 2022
The mobile phone has evolved to become our lifeline, so much so that we have practically everything stored on a single device. We keep most of our information there — from birthdays to highly sensitive data such as our passwords and banking details.
Even since the Covid-19 pandemic struck, mobile phones have become even more ubiquitous, serving as the primary tool that connected us with the rest of the world during prolonged lockdowns while accelerating the bridging of the intergenerational digital gap as more users became tech-savvy.
As we enjoy this convenience, however, it is wise to remember that these devices are prone to cybersecurity threats, says Kaspersky general manager for Southeast Asia Yeo Siang Tiong. The following are excerpts from an interview with Yeo.
How did the Covid-19 pandemic affect the rate of mobile attacks compared to the pre-Covid era, and why?
In 2021, our experts observed a downward trend in the number of attacks on mobile users. But it is too early to celebrate, simply because the attacks are becoming more sophisticated in terms of malware functionality and vectors.
In 2019, the cybercriminals’ focus was on users’ personal data and trojans. Cybercriminals resorted to social engineering tools in 2020, by passing a malicious application off as another popular and desirable app.
Last year, the most important trend we saw was that cybercriminals are now targeting banking and gaming applications, which is expected, given the boom in digital banking and online gaming.
The decline in the number of attacks in 2021 also means cybercriminals are now consolidating their efforts to focus on more dangerous and profitable threats instead of the usual “spray-and-pray” type of attack.
The latest data indicates that Malaysia was the No 2 country in Southeast Asia with the highest number of foiled mobile attacks from January 2020 to June 2021, where 4.42% Malaysian users were targeted during the first half of 2021.
What were the top mobile threats in 2021?
AdWare, or advertisement-supported software, accounted for the largest share of all detected threats in 2020 and 2021, at 42.42% and 57.26% respectively.
Next was RiskTool, a programme with various functions, such as concealing files in the system, hiding the windows of running applications, or terminating active processes.
Why are the online banking and gaming sectors becoming the main focus of attacks?
Banking remains cybercriminals’ most lucrative targets. There is a demand for mobile gaming credentials, which are often sold on the darknet or to be used to steal in-game goods from users.
The common denominator here is that banking and gaming are a treasure trove of money and data — particularly critical personally identifiable information (PII).
So, while they change their attack techniques, cybercriminals remain the same — they follow the money.
According to the Kaspersky Mobile Threat 2021 report, banking trojans are getting more realistic and advanced to deceive users. How does one distinguish between a real bank personnel or a bank trojan so that he/she does not fall into the trap?
• If you receive a call or email from your bank that you are not expecting, treat it with suspicion and never disclose personal details in emails or unless you have called the bank yourself;
• Access your bank account only from a secure wireless network;
• Never post personal information that could reveal your banking details on social network sites;
• Check your account and credit card statements regularly for suspicious transactions. If you see something strange, report it to your bank immediately;
• Use common sense and be cautious. Do not click on links that say they are from your bank. Double check that a message is genuine, and call your bank if you are in doubt; and
• Your mobile devices need a robust security app to protect it against malicious programs and cyberattacks.
With regard to cybercriminals disguising malicious apps as popular and desirable to attract downloads, how can official app stores prevent mobile threats to its users?
It is safer to download your apps only from official stores such as Apple App Store, Google Play or Amazon Appstore. While apps from these markets are not 100% safe, at least they are checked through filtration systems in place.
In the middle of 2021, our experts discovered 20 unsafe applications advertised on app stores offering additional Minecraft features. Later, these malicious apps were deleted from official stores, but we continued to find newly developed ones.
Deleting apps from official stores does not always lead to victory over the malware, as we continue to see the developers uploading new, modified versions to the store, under different names and different developer accounts.
We trust that app stores are doing improvements to their systems to ensure that malicious apps are kept at bay. Meanwhile, we also urge consumers to:
• Think before you download a new app. Do you really need it?
• Read the app’s reviews thoroughly. Check the developer’s reputation if possible.
• Install a security app on your mobile phone. As mentioned, cybercriminals are becoming more and more creative. So, we should see to it that our mobile devices have a robust security solution to stop malware in case we commit unconscious mistakes.
Kaspersky’s mobile antivirus app for Android has more than 50 million downloads. Based on this insight, what is your opinion on mobile user awareness towards the importance of cybersecurity?
Android maintains its position as the leading mobile operating system worldwide, and will remain the target of cybercriminals because of the high number of users. That is how the cybercriminals go after a larger pool of victims.
While we see that awareness is growing, we are still waiting for the real action to happen. With this, we mean that we are becoming more aware that cybercriminals can spam us or phish us and steal our money online and on our mobile devices, but how many of us actually download security solutions to protect their phones?
Our money and essential data are currently in our mobile devices, so it is important for every Android device to install a reliable security app to guard their privacy and identity, and be protected from common malware and advanced hacking tricks.
Beyond staying cautious while surfing the internet, what are the extra measures that mobile users can take to protect their data from threats?
We would advise mobile users to:
• Download your apps from official stores only;
• Check the permissions of apps that you use and think carefully before permitting an app, especially when it comes to high-risk permissions such as accessibility services. The only permission that a flashlight app needs is the flashlight, which does not involve camera access;
• Install a reliable security app that helps you detect malicious apps and adware before they start behaving badly on your devices;
• iPhone users have some privacy controls provided by Apple, and users can block app access to photos, contacts and GPS features if they think these permissions are unnecessary; and
• Update your operating system and important apps as updates become available. Many safety issues can be solved by installing updated versions of software.
What are the cybersecurity trends for 2022? Will the number of mobile threats continue to decline or will we see new forms of attacks coming to play?
Our experts see that, in Southeast Asia, cybercriminals will focus on making advanced scam and social engineering attempts using non-technology focused attacks and exploiting human vulnerabilities. The scams would be through SMS, automated phone calls, popular messengers, social networks and others.
We also expect an even more significant wave of attacks on cryptocurrency businesses and even against the rising non-fungible token (NFTs). It will also be the target of cybercriminals, as Southeast Asia — and Malaysia, in particular — is leading in terms of NFT ownership. Malaysia is at 23.9% across the region.
Save by subscribing to us for your print and/or digital copy.
P/S: The Edge is also available on Apple's AppStore and Androids' Google Play.