I'm not playing Buzzword Bingo this week, but I am going to mention BYOD (or Bring Your Own Device, if you prefer) and - as enterprises around the globe will testify - plenty of people do.
The explosion in using consumer devices in the workplace should not have caught anyone by surprise. When such devices catch up with, and in many cases surpass, business kit in terms of sheer power, flexibility and cost, then BYOD becomes a no-brainer. This is a good phrase, as it also sums up what appears at first glance to be some very worrying security news that broke this time last week.
The story claims the mobile Gmail app can be hacked with an impressive 92 per cent success rate. The fact research scientists at a couple of US universities have demonstrated a method by which it's possible, across Android, iOS and Windows platforms no less, to obtain personal data including passwords is surely a nail in the coffin of BYOD?
I'm not convinced, despite the shared-memory side channel-using 'UI state interference attack' being technically very interesting indeed. My 'meh' mode is activated because, practically speaking, it's much less interesting.
Here's the lowdown: a user downloads multiple apps, they all run on the same shared platform, and it's possible for one of those apps to employ that memory side-channel which is found in just about every GUI to access the others.
It was possible to do this 92 per cent of the time with Gmail. Shocking stuff huh? Not as shocking as the detail of what is actually required to get this to work.
First, the app that allows this to happen has to be installed. That's an unsigned app, and one that's carrying malicious code. The kind of app that would be prohibited by any half-decent enterprise BYOD policy, and avoided by any half-brained employee who wanted to keep their job.
However, even allowing for the fact such an app may get installed via a rogue app store or by an idiot user, even then attack success is not a given.
Secondly, on the 'things that are required for this exercise in intellectual masturbation to work' list is the attack would have to take place at the precise, exact, same moment the user was performing the action to be accessed using the target app.
Throw in the third requirement, that all of this is done without user knowledge at any point, and it becomes startlingly clear that in the real world (outside of the rubber walls of the research labs) it's an attack that is very unlikely ever to be successfully pulled off.
This reminds me of something very similar that I was writing about back in 2012, for our sister publication Cloud Pro, under the title of 'Cryptography attack: side-channel cloud threat is all nerd and no knickers.'
Although the side-channel threat is obviously made a lot easier on a mobile device, with regards to the requirement to be running on the same platform at the same time, I stand by the gist of what I said back then. Namely, that if you are an enterprise which follows basic security best-practice strategies, including BYOD policy implementation, then you can move on as there's really nothing to see here except fear, uncertainty and doubt.
-
Bigger salaries, more burnout: Is the CISO role in crisis?In-depth CISOs are more stressed than ever before – but why is this and what can be done?
-
Cheap cyber crime kits can be bought on the dark web for less than $25News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Microsoft 365 admins warned over new Gmail anti-spam rulesNews Microsoft 365 users have been warned they could be penalized for failing to adhere to new anti-spam standards
-
Google launches dark web monitoring tools for US Gmail usersNews First launched for Google One customers, the dark web report service is rolling out to all US-based Gmail users
-
Enabling secure hybrid learning in schoolsWhitepaper The importance of creating security awareness among key players
-
North Korean-linked Gmail spyware 'SHARPEXT' harvesting sensitive email contentNews The insidious software exfiltrates all mail and attachments, researchers warn, putting sensitive documents at risk
-
Android malware campaign 'targets 1 million Google accounts'News Check Point says Android malware campaign can steal tokens from Google accounts
-
Gmail will soon alert you if you receive unencrypted emailsNews Google researchers plan warning system to fend off malicious messages
-
Are trusts putting NHS data at risk by ignoring need for BYOD policies?News NHS trusts don’t know what staff are using their devices for, reveals FoI request
-
Google plays down Gmail address & password leakNews Search giant claims fewer than two per cent of the five million usernames and passwords leaked would have worked
