In my previous blog post, I described how one of my monthly Privacy Professor Tips readers recently sent me a question
about some unusual coincidences where it seemed that home conversations
and activities were then known and discussed by workers. When working
from home, or mobile working while traveling, it is important to
remember that cybercrooks and business competition are actively
exploiting the vulnerabilities that are present in most home offices,
hotels, restaurants, airports, and a long list of other locations where
remote work occurs.
This series of blog posts focuses on fours ways in which digital
spies enter home office areas, and mobile working locations, and
provides some basic information security and privacy protections you can
put in place to shut the holes in the digital pathways created into
your organization through working from home office and other remote
areas.
Part 1 provided an overview of how digital spies come into your work areas through IOT devices. Part 2 now provides an overview of how spies get into your home through phone and other types of computing device apps.
Most folks now have at least one smart phone. And on those smart phones are usually a large number of apps. Most phone owners have completely forgotten about even downloading most of the apps to begin with. However, even if they are not being used, those forgotten apps are still doing what the often-used apps are also often doing; collecting data from the phone’s contact list, accessing the IDs and passwords stored in the phone, making posts on behalf of the phone user, controlling the video, camera and audio recorders, all while sharing any or all of the files on the phone with the app providers and all the third parties associated with them.
Here are four basic security and privacy protection actions to take:
When speaking about app security and privacy with my clients and at
events, I like to start by asking those present to answer this question,
without looking at their phone: How many apps do you have on your
phone? Then I have them look at their phones and ask: How many apps are
actually on your phone? I’ve never had a situation where the answer to
the second question was the same as, or less than, the answer to the
first question. Typically, people have many times more apps on their
phones than they knew about, or remembered. Some website will download
an app without the website visitor realizing it. People also generally
forget about an app once they download it. Then, if they never use it
again, it could be an app that is still active and recording all
activities on the phone and sending back to the app vendor, or listening
to everything in the vicinity, recording and sending back the
recordings to the app vendor, turning on the video and recording in
situations where you may be discussing or doing something confidential
and sharing with third parties of the app vendor,
and a wide range of other possibilities. Remove all apps from your phone that you have not used in more than a month or two, to limit the data leakage through them.
Some apps you need to use, for work purposes, or to help you navigate
when you are driving, or when using delivery services, to pay bills,
etc. However, how many of these apps, that you have determined
necessary, need to record what you are saying or doing? Many
apps ask for access to control the video, microphone and camera even if such access is not necessary to serve the purpose
for which you downloaded the app to begin with. Review the settings of
all the apps you actively use and turn off the microphone, video, and
camera access from the apps where you do not need to have these tools
used.
When installing most apps, they will require you to give a large amount
of access to basically all information on your phone. The location, or
GPS, information is almost always in the list of data types to which
apps want to get access. This information may seem innocuous, but be
aware that app developers will often share your location with third
parties, such as companies who develop targeted ads based on your
location and interests. This information can also be used to track your
whereabouts,
and has been used to stalk and assault people. Keep location sharing turned off in apps to limit the number of people who know at any point in time where you are located.
Do not use your social media passwords to authenticate into other
apps. App passwords are notoriously vulnerable to capturing when using
public networks, when using peer-to-peer (P2P) services, and by the app
vendors and their third parties. Some people use the same password for
everything; using the same passwords on apps that they use to access
their bank, work, and other sites. That is a very risky and bad
practice. Hackers love to capture those passwords and sell them on the dark net
where they can get rich doing so, and where those cybercrooks
purchasing them will then drain your bank accounts, commit identity
fraud with your information, or a wide range of other types of nefarious
activities that will be harmful to you, your business, or possibly even
your customers, coworkers or patients. Never use any of the same
passwords for your apps as what you use for your banks, credit card
companies, retail stores, social media sites, work sites, etc.
While these four actions will establish a large amount of security
and privacy protections on your phone, you still need to do more. Take
other actions as applicable to your organization’s type of business.
Know and follow your organization’s work from home security and privacy
policies and procedures.
If you are responsible for your organization’s policies and
procedures, take other actions to ensure employee-owned, as well as
organization-owned, IOT devices are appropriately secured, as applicable
to your organization’s type of business. Make these actions part of the
work from home requirements in your employee work agreements, and
incorporate them into your organization’s information security and privacy work from home and mobile working policies and procedures.
Part 3 of this series will provide an overview of how cyber spies get into home and remote offices through wi-fi networks.
For more information, systems, applications and cyber security and privacy blog posts, click here.
