eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
In 2024, the World Economic Forum identified mobile devices exposing personal and corporate data as one of three trends set to drive cyberattacks and ransomware this year. Why? WEF attributes it to mobile devices often having less robust security measures and connecting to public Wi-Fi or weakly-secured IoT devices more often. From mobile devices, attackers can jump into cloud applications, corporate networks, and PCs in order to steal credentials or leak sensitive data. More and more initial attacks are targeting mobile instead of the cloud or PCs.
Over the past year, Lookout identified a variety of CVEs affecting mobile devices, including several that can gain footholds in Android mobile devices through Google Chrome. Lookout’s experts understand that tracing how attacks happen is key to stopping them.
In many cases involving mobile devices, threat actors follow a mobile kill chain that moves them closer and closer to valuable information in order to launch an attack. With Lookout’s Mobile EDR solution, defenders can detect and shut down attacks wherever they occur.
The Mobile Threat Kill Chain Explained
In order to go from exploring options to infiltrating an organization, attackers need to follow a ‘kill chain’ — a sequence of steps that carries them deeper into the target devices or network. Defenses like Lookout’s Mobile EDR solution can throw up barriers to attackers’ attempts at every stage.
The Mobile Threat Kill Chain and its Stages
The mobile threat kill chain is the sequence of steps attackers follow to compromise a mobile device and steal data. The mobile threat kill chain can be different from that of traditional endpoint, since mobile devices are especially open to file-less attacks and can slip through traditional endpoint detection. By understanding it, defenders can identify potential weak points and reinforce them.
Stages of the Mobile Threat Kill Chain
The modern kill chain is composed of five stages:
Reconnaissance: The attacker learns about your organization and its employees, sometimes through phishing or through publicly available information such as corporate sites and social media.
Social engineering/Compromising user credentials: If an attacker finds out what single sign-on (SSO) provider you use, they could spoof its login page and send spam text messages to get user credentials. Because of the small form factor of mobile devices, employees may be more likely to click on a malicious link on a phone or tablet than on a laptop or PC.
Initial access: If the organization’s system isn’t defended at the attacker’s entry point, they can use the access granted to their stolen credentials to move between apps.
Data theft: The attacker steals as much data as possible or pinpoints the most valuable data and focuses on it.
Extortion: The attacker puts the stolen data up for ransom or profits from it in another way.
The Benefits of a Mobile-Centric EDR Approach
An endpoint detection and response platform like Lookout provides comprehensive visibility into mobile device activity. IT teams with better visibility can identify and address security risks at multiple points throughout the kill chain, creating a gauntlet of defenses.
For organizational leaders, Lookout empowers organizations to enforce their Bring Your Own Device (BYOD) strategy. That way, personal devices are less likely to threaten the whole organization. Maintain safety and control over the mobile environment in which your employees spend a large portion of their days with mobile EDR.
Reduced Risk of Data Breaches
Lookout takes a multi-layered approach in its efforts to reduce the risk of data breaches originating in mobile devices. If an employee receives a spam text message, Lookout won’t let them get past the link and onto that fake SSO page the attacker crafted. Instead, the page will be flagged as malicious both on the employee’s phone and on Lookout’s security dashboard.
If an attacker does get in, Lookout can detect them and alert the organization of geolocation anomalies, unusual behavior, and what type of device is being used.
Lookout Mobile EDR includes automated remediation and awareness training, which notifies users if their phone’s permissions are excessive or their data-sharing capabilities are too broad. This helps educate users about potential threats and best practices for the tasks they’re performing on their devices. To minimize false positives and provide real-time threat detection, Lookout Mobile EDR uses telemetry from 220 million devices and 325 million apps, and a world-class mobile threat intelligence team.
Improved Security Posture
Through all of the above, Lookout can help organizations reach their goal of achieving a proactive security posture, meaning they are able to stop incoming threats before the attackers can do damage. In turn, achieving a proactive security posture with Lookout frees up IT teams’ time, letting them spend less time putting out fires that stem from mobile security breaches and more on strategic planning to improve the organization’s overall security.
Lookout Mobile EDR: Disrupting the Kill Chain at Every Stage
- Proactive Threat Detection:
-
- As well as the approaches detailed above, Lookout also provides real-time threat intelligence and machine learning to spot when an attacker might be infiltrating a mobile device. Using machine learning and real-time threat intelligence, Lookout scans for malicious or risky code and can detect suspicious websites or content. During the reconnaissance and social engineering stage, Lookout can alert security teams to ongoing phishing attempts, malware downloads, and other malicious behavior.
- Comprehensive App Security:
- Lookout assesses the security posture of apps installed in devices that might be paths into an organization’s systems. It can flag vulnerabilities or areas where risky permissions may create accidental back doors into escalated privileges. Lookout’s mobile threat defense solution provides real-time visibility and policy enforcement across devices, regardless of whether those devices are Android or iOS, BYOD or company-owned. Comprehensive app security can be particularly helpful during mergers and acquisitions when IT teams will need to pay careful attention to what new connections are created between corporate resources.
- Endpoint Protection:
- Even if an attacker does grab your organization’s sensitive data, Lookout provides ways to stop them from walking away with it. Device lockdown, for instance, minimizes the attack surface if a device is lost or stolen, while data encryption prevents the attacker from using the stolen data. Lookout uses application control features to block exfiltration to anywhere outside the corporate-approved system.
- Automated Incident Response:
-
- Lookout takes some of the weight of security work out of your organization’s hands with automated detection and response. This reduces the amount of time attackers have to move around in your system and search for and exploit vulnerabilities. When you’re conducting incident investigation and remediation, Lookout can also save time, giving attackers less time to cause harm.
Conclusion
Understanding the mobile threat kill chain is key to securing the mobile devices used in your businesses.
Lookout Mobile EDR:
- makes it less likely for attackers to perform a data breach.
- blocks phishing attempts.
- prevents attacks that may take over device cameras or microphones.
- stops fraud before it begins.
- keeps your organization’s data out of the wrong hands.
Lookout Mobile EDR addresses all stages of the kill chain, giving your organization more time to prevent attackers from profiting off of your data.
Ready to safeguard your data and business with an EDR strategy designed for mobile? Learn more about Lookout at lookout.com.