(770) 424-3393 Facebook logo Twitter logo Linkedin logo YouTube 001 gplus RSS feed

Carceron Blog

Carceron has been serving the Atlanta area since 2002, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

A Classic Example of Why You Should Only Allow Trusted Apps to Access Your Data

A Classic Example of Why You Should Only Allow Trusted Apps to Access Your Data

If your employees are given an Android device to use for work, or if they bring in their own as a part of a Bring Your Own Device strategy, you may want to pay special attention to what follows.

Google has just removed a piece of malware that managed to make its way into the listings of the Google Play Store. Disguised as a strategic card game called “Beaver Gang Counter,” the malware seemed at first glance to be a harmless enough app to download as a way to pass some time every now and then. This impression unfortunately turned out to be inaccurate for a few different reasons.

Why Was it a Threat?
First, the app itself reportedly was a bit of a one-trick pony, losing any of its entertainment appeal very swiftly. Of course, what do you do with an app that you’ve grown bored with and no longer want? You delete it to make room for other apps that you will have more use for, but not before the malware comes into play.

The disguised malware would specifically target those whom also had Viber, the vastly more popular communications app, installed on their device. Once the Beaver Gang Counter app was installed, the malware would access the directories contained in Viber as well as uploading any of the user’s Viber images to an external website.

Google has since removed Beaver Gang Counter from the Play Store, and thus far it seems that little damage was done. However, the entire situation asks the question: how did this happen?


There were ultimately a number of factors that led to Beaver Gang Counter having the ability to access files belonging to another app; an ability that the Android platform is supposed to block. However, the security measures put in place by Android do nothing to prevent the review of data saved on the SD removable storage.

Due to the expectation of inter-device compatibility that comes with SD cards, the inter-app file sharing that Android usually blocks is left unfettered in the SD storage, depending on the permissions granted at install. Therefore, if assigned to SD memory (as it would have been in almost all cases), Beaver Gang Counter could potentially access any and all data saved to the SD. Instead, the malware developers had simply chosen to target Viber users specifically.

However, there’s an excellent case to be made that the app should never have reached the Google Play storefront at all, and that Google’s review process seems to need some work.

Upon opening the app, you are brought to the game’s main menu screen, with the following options: Help, Players, Statistics, and the all-important "New Gane”. Yes, you read that right. "New Gane". There was a spelling mistake, right there on the most important element of the main menu, visible from the download screen itself, that Google either missed or disregarded without digging any deeper.

 

What Does this Mean for My Business?
While Beaver Gang Counter didn’t target anything that would likely damage a business if the malware infiltrated a business-provided or BYOD device, it really makes one consider how many other apps may be out there that could potentially cause harm to a business through similar actions. The only truly clear lesson to be learned from this story is that Google isn’t infallible, and so they cannot be relied upon to defend your company from all threats that are sent through their systems. Ultimately, it falls to you to pick up the slack, and as such, you should implement the following best practices.

  • Steer clear of unknown apps: If nobody online is talking about an app, there’s a better chance that it is a less safe option (and that’s the best case scenario). Avoid utilizing unknown and unreviewed apps on business devices. Furthermore, despite their failure to catch Beaver Gang Counter, Google’s marketplace for apps is still much safer than the unregulated Android marketplaces that are out there.
  • Keep important data on your actual device: Clearly, Android prioritizes the protection of data on its native storage over that of data stored on removable media. Therefore, you should keep this in mind as you elect where to store data and keep critical files on the device itself.
  • Set terms for employee devices: This will admittedly be simpler to enforce with company-provided devices, as BYOD relies on the employee using their own property and therefore a device that they have control of. While you may disable non-company approved apps in devices provided by the company, you may have to take a few extra steps if implementing a BYOD policy. A mandatory security solution may be a fair term for an employee wishing to use their own device, as well as required security best practice training.

By implementing these practices, you just may be able to keep an issue like this one from affecting your company sometime down the line.

For more IT news and best practices, be sure to keep check our blog, and be sure to reach out to Carceron if you have any questions about your own security. Give us a call at (770) 424-3393.

Comments

 
No comments yet
Already Registered? Login Here
Guest
Tuesday, 27 September 2016
If you'd like to register, please fill in the username, password and name fields.

Captcha Image

Tag Cloud

Security Technology Best Practices Privacy Internet Microsoft Tip of the Week Business Management Managed Service Provider Software Workplace Tips Cloud Backup Saving Money Hardware Data Small Business Productivity Gadgets Hackers Business Computing Mobile Office Business Email Hosted Solutions Google IT Services Quick Tips Malware Social Media IT Support Virtualization Mobile Devices Upgrade Business Continuity Users Passwords Smartphones Microsoft Office Network Windows WiFi Server Disaster Recovery Miscellaneous Innovation VoIP Computer User Tips Windows 10 Efficiency Vendor Management Mobile Computing Communication Mobile Device Management Unified Threat Management Operating System Smartphone Marketing BYOD Apps The Internet of Things Holiday Remote Computing IT Consultant Facebook Analytics History Health Android Going Green Wireless Technology Apple Windows 8 Ransomware Bring Your Own Device Alert Network Security Content Filtering Information Technology Printer Saving Time Hard Drives Tech Support Lithium-ion Battery Outlook Office Big data Remote Monitoring Phishing Collaboration Employer-Employee Relationship Gmail Spam Data Management Save Money Firewall Humor Browser Computer Repair Bandwidth Smart Phones Proactive IT Save Time Maintenance Tutorials Computers Hiring/Firing Automation Best Practice Antivirus Search Intranet Business Intelligence Avoiding Downtime Router iPhone Internet of Things Document Management Administration Education Phone System Budget Excel Fax Server App Current Events Two-factor Authentication Money Wireless PowerPoint Mobile Device Running Cable Help Desk Managed IT services Sports User Error Hacking User Virus Inbound Marketing Company Culture Safety Hosted Solution Chrome Social Cost Management Comanaged IT SaaS Downtime Customer Service Government USB IBM Pain Points Recovery Programming Printer Server Cybercrime Black Market Password Compliance Thin Client Gaming Console Statistics Cortana Business Growth Encryption Streaming Media Presentation Risk Management Processors Net Neutrality communications Networking Documents End of Support Artificial Intelligence Retail Digital Payment Customer Relationship Management Social Networking Bluetooth Legal Website Laptop Computer Accessories Comparison Data storage Virtual Desktop Augmented Reality Network Congestion Experience Heating/Cooling Flexibility Text Messaging VPN Office Tips Computing Analytic Virtual Reality Office 365 Society Entertainment Riske Management Efeciency Micrsooft IT service Application Windows XP Content Management Digital Signature Pirating Information Computing Infrastructure Recycling CIO Robot Memory Archive Wi-Fi DDoS Music Update External Harddrive Upgrades Flash Video Surveillance Tablet Trending Telephone Systems Online currency organize Word Point of Sale Deep Learning Settings Public Speaking LiFi HIPAA Debate Skype Banking Webinar Electronic Payment Entrepreneur Teamwork Monitors Language Hacker Visible Light Communication Lifestyle Leadership Business Metrics Google Wallet Best Available Displays GPS Managed IT IP Address Advertising Storage Read Chromebook Human Resources Drones BDR Microserver Keyboard YouTube File Sharing Value 3D Work/Life Balance Touchscreen Twitter Law Enforcement PDF Writing Turn Key Shortcut Outsourced IT Adroid Unified Communications Troubleshooting Staffing Download LinkedIn switches Wearable Technology Paperless Office Domains Permissions Business Owner Mouse eWaste Disaster Operating Systerm Microchip Google Docs Regulations Adminstration Co-Managed IT Harddrive Identity Theft Solid State Drive Specifications Environment Securty Competition IT consulting Display Ebay

Mobile? Grab this Article!

QR-Code

Recent Comments

No comments yet.

Blog Archive