Trying to “Catch Them All?” – What Corporate Users Need to Look Out For

By Eric Noonan • July 25, 2016

You may have heard all the buzz about Pokémon Go, Nintendo’s latest generation of games developed after the popular animated show from the 90’s, created as a mobile phone app. In people’s haste to download and install the latest and greatest, users are also falling victim to additional malicious apps disguised as tutorials or alternate versions of the game. As the app is only officially offered in the US, New Zealand, UK, and Australia, users in other countries are passing around Android Package Kit (APK) files in an attempt to play the game as well. However, users are required to “sideload” the app in order to download the APK which modifies their core Android security settings and allows their device to install applications from untrusted third-party sources.

Users have been cautioned against these illegal downloads as one of the popular APK files has been modified to install a backdoor known as DroidJack. DroidJack is a Remote Access Tool (RAT) that allows third parties to take remote control of a user’s device, record private conversations, read emails, browsing the history, and texts, and tracks the user’s physical location all without their knowledge. If a user has downloaded DroidJack on any device linked to their bank accounts, corporate/personal email, all that information is now available to untrusted third parties.

The threat of this malicious software is very real, as the security firm Proofpoint discovered the infected version of the app within 72 hours of the game’s launch in New Zealand and Australia on July 4th. To verify the version, malicious or not, of the app you have installed on your device, navigate to your Android device settings for Pokemon Go and scroll through the list of app permissions. If the version installed on your device has permission to directly call phone numbers, read/edit your SMS messages, record audio, read browser history, read/edit your contacts, read/edit call logs, and edit network connectivity, then you should wipe your device immediately. This is the only guaranteed method of removal from your device. Business leaders, especially those overseas, caution your employees about this application as the user base is not exclusive to any age group.

When working with CyberSheath, we will empower your organization against common threats such as these to effectively reduce risk through proper security and awareness training.

Cybersheath Blog

3 Reasons Why You Need a Privileged Access Risk Assessment

A privileged account is one used by administrators to log in to servers, networks, firewalls, databases, applications, cloud services and other systems used by your organization. These accounts give enhanced permissions that allow the privileged user to access sensitive data or modify key system functions, among other things. You can…

Incident Response – Learning the Lesson of Lessons Learned

“Those who do not learn from history are condemned to repeat it.” Over the years, variations of this famous quote have been spoken by everyone from philosophers to world leaders. The message — that we must learn from our mistakes or continue to repeat them — is also highly relevant…

What is DFARS 252.204-7012 and NIST SP 800-171?

With the Department of Defense (DoD) promising the release of an update to NIST Special Publication 800-171, it is imperative defense contractors understand what DFARS 252.204-7012 and NIST SP 800-171 Clause is and how noncompliance with the Clause will impact their business.  Compliance is mandatory for contractors doing business with…

Our Trusted Partners

Cyberark McAfee Thycotic RSA Tenable Alien Vault Alert Logic Trace Security