Mobile Malware is a Non-issue

If you have been to a security trade show, or even received security vendor emails, you have seen endless hype about mobile security. From all the attention and excitement around it, you would think that it was a gigantic problem for businesses.

So we are often asked, why is there no mobile version of Passages for Android or iOS?

We try to stay laser-focused on the real security issues that businesses face every day and, despite all the smoke and heat, there is no fire burning around mobile devices.

I don’t think I could say it any better than Verizon did in their 2015 data breach report: “I Got 99 Problems and Mobile Malware Isn’t Even 1% of Them.” They found that only 0.03% of Android phones are infected in a given week sample period, and the rate for iOS much lower. They found that most of the suspicious activity seen directed at iOS devices was actually misdirected Android exploits.

In fact, the Motive® Security Labs H1 2015 Malware Report showed that the 80% of malware detected on mobile networks is coming from Windows PCs.

An important point is that almost none of this tiny amount of mobile malware is coming in through the web; it is mostly trojan applications which are coming from unofficial app stores. Even the recent XcodeGhost attack on iOS was application-based rather than a direct web-based attack on the phone.

The big trend on mobile devices is to use the browser less and less. Whereas you might read email and visit Facebook in your desktop browser, you would probably use the respective apps on a phone or tablet. The impact of securing the mobile browser is much smaller because it is used much less.

Further, mobile browsers are generally more secure than the desktop equivalents. They don’t do plugins, don’t do Java, they generally don’t do flash, and are more isolated by the operating system. They are a poor choice for a web attack.

Think about the economics for the attacker. It is relatively easy to create an attack for every Windows user in the world. It is much more difficult to hit the mobile devices and even after succeeding there is not nearly the same access to data and files. A desktop is a much richer trove of data than a mobile device. So, based on return on investment, hackers almost always go after windows with their web-based attacks.

Desktop browsers are the real threat to businesses today. That may not grab the headlines like mobile attacks, but it is the reality. We are putting our time and effort where it will have maximum impact, which is in the browser on the desktop. I hope that purchasers of business security solutions do the same with their dollars.