Hacking

Ethical hacking: BYOD vulnerabilities

Introduction

With the influx of millennials and rising demand for flexible employment, the transition from using corporate devices to personnel bringing their own devices is having a significant influence on how IT handles data security. Companies that apply BYOD, or bring-your-own-device, in the workplace need to implement certain security measures to ensure the protection of valuable and sensitive corporate data.

However, there might be security holes in the corporate system that the companies aren’t even aware of. Ethical hacking can assist in the identification of BYOD vulnerabilities and provide insight on the countermeasures that need to be taken. Before we discuss how, though, let’s look at BYOD vulnerabilities in detail.

Earn two pentesting certifications at once!

Enroll in one boot camp to earn both your Certified Ethical Hacker (CEH) and CompTIA PenTest+ certifications — backed with an Exam Pass Guarantee.

View Pricing

Top BYOD vulnerabilities

Third-party network flaws

Employees typically connect their personal devices to a range of networks outside of the organization’s control. Third-party networks, however, lack the range of security features that are increasingly incorporated into corporate networks. 

Cylance, for example, discovered a vulnerability in network routers used by hotels across 29 countries. The flaw allowed hackers to monitor and tamper with traffic from Wi-Fi networks and even access management systems. As a result, personnel storing corporate data on BYOD-approved devices put their employers at risk of compromise when they connected to third-party wireless networks.

Rooted and jailbroken devices

Most BYOD security suites consider rooted and jailbroken devices to be the root cause of compromise. Because these devices bypass the vendor’s as well as the enterprise’s safeguards, their back end is even more vulnerable to viruses, malware and other hacks than standard devices. 

When these devices connect to the enterprise network, a malware or virus piggybacking on their back end can be easily routed into it. This allows adversaries to make unauthorized uploads, create fake redirects and cause other types of damage.

Malformed content

Employees may be unaware of the fact that adversaries can exploit vulnerabilities in malformed content (like videos, GIFs and landing pages) to infiltrate a targeted OS or app. 

Personnel using Android devices are at a greater risk due to the presence of software vulnerabilities in the media processing component of Android. Hackers could leverage malicious media files, such as MP4s, to attack the media processor component on unpatched Android handsets and gain deeper access to data, such as corporate messages and document downloads.

Lost or stolen gadgets

According to a study conducted by Trend Micro, 45.6 percent of organizations that enabled employees to access their corporate network through BYOD devices experienced some kind of data breach, with device loss and theft being a key reason for data breaches. Though many of the devices are stolen for their value, the number of stolen or lost devices whose information is accessed via hardware and software vulnerabilities is also on the rise. And with employees keeping both personal company information and private data on the same device, the risk of enterprise data leaking out in the event of device theft is now a frightening possibility.

OS-related vulnerabilities

Traditionally, most organizations relied on a single software ecosystem to run their operations (usually a Windows/Microsoft) framework). With the adoption of BYOD, it’s not uncommon to see a combination of Android, iOS and Windows being used in the workplace. Every operating system — and the framework it runs on — has its own unique set of vulnerabilities, which means that enabling personnel to use any device increases the possibility of hacks and data breaches. 

Malicious apps

Not all apps installed on an employee’s device are as safe as they seem to be. Even apps coming from official app stores could contain malicious code. In most instances, malicious apps have the potential to take control of the user’s device, which can result in loss of work information, call charges and enterprise data theft.

What can ethical hackers do?

Ethical hackers have a wide array of tools at their disposable to assist organizations in identifying BYOD vulnerabilities. Through ethical hacking, organizations can be made aware of serious flaws in their security systems with regards to the implementation of BYOD in the workplace.

For example, the ethical hacker can use a dynamic analysis tool like Cycript to analyze the apps running on iOS-based BYOD devices. Cycript essentially allows pentesters to see the inner workings of active iOS apps. This in turn enables them to make an SQL injection attack, which can be used to explore malicious code and potential vulnerabilities.

Final verdict

By installing third-party applications without the approval of the IT department, or by visiting malicious websites on the company’s network, employees may unknowingly place the entire company’s reputation at risk. 

As with many other sides of a BYOD threat, pentesters must be comfortable with using a vast array of tools and techniques against their targets’ vulnerabilities. However, as BYOD flexibility cause users to bring in various types of devices, ethical hackers will need to evaluate if the cost of exploiting an app or an operating system is really worth the benefit — especially where other computer program or network-based exploits could be more beneficial. 

What should you learn next?

From SOC Analyst to Secure Coder to Security Manager — our team of experts has 12 free training plans to help you hit your goals. Get your free copy now.

Get Your Plan

 

Sources

1. Implementing BYOD Plans, Trend Micro
2. Superion’s Click2Gov breaches affects thousands of municipal customers across several states, SC Magazine
3. BYOD vs. enterprise security: Is it possible to have both?, CIO Dive
4. What are the Risks to Your Corporate Data?, Trend Micro