Mobile and IoT Device Security Flashcards

What is the primary security risk of sideloading apps on a mobile device?

Answer: Sideloaded apps bypass official app store security reviews and may contain malware

Sideloading installs apps from sources outside official app stores, bypassing the security vetting process that screens for malware, excessive permissions, and other security issues.

What security vulnerability is associated with default credentials on IoT devices?

Answer: Attackers can easily access devices using widely known factory-default usernames and passwords

Many IoT devices ship with common default credentials (like admin/admin) that are publicly documented and easily exploited if users do not change them during setup.

Why is remote wipe capability important for mobile device security?

Answer: It allows all data on a lost or stolen device to be erased remotely to prevent unauthorized access

Remote wipe allows you to erase all data on a lost or stolen mobile device from another device or computer, preventing thieves from accessing personal information, accounts, and sensitive data.

What is a man-in-the-middle attack on a mobile device?

Answer: An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path

In a mobile MITM attack, an attacker intercepts the communication between a device and a network service—often through rogue Wi-Fi access points—to steal data or inject malicious content.

What security risk does Bluetooth pose when left enabled and discoverable on a mobile device?

Answer: Attackers can exploit Bluetooth vulnerabilities to access data, eavesdrop on communications, or gain control of the device

Leaving Bluetooth enabled and discoverable exposes the device to attacks like Bluejacking, Bluesnarfing, and BlueBorne that can steal data, install malware, or take control of the device.

What is the security concern with granting excessive permissions to mobile apps?

Answer: Apps may access sensitive data like contacts, location, camera, and microphone beyond what is needed for their functionality

When apps receive unnecessary permissions, they can access sensitive data and device capabilities beyond their legitimate needs, potentially harvesting personal information for unauthorized purposes.