CSCU Mobile and IoT Device Security 2 â Questions and Answers
Question 1: What is the primary security risk of sideloading apps on a mobile device?
- Sideloaded apps use more battery power
- Sideloaded apps bypass official app store security reviews and may contain malware (Correct answer)
- Sideloaded apps cannot access the internet
- Sideloaded apps are always larger in file size
Correct answer: Sideloaded apps bypass official app store security reviews and may contain malware
Sideloading installs apps from sources outside official app stores, bypassing the security vetting process that screens for malware, excessive permissions, and other security issues.
Sideloading refers to installing applications from sources other than the device's official app store (Google Play Store, Apple App Store). Official app stores implement security review processes that scan apps for malware, verify developer identities, check for excessive permission requests, and monitor for policy violations. When apps are sideloaded from third-party websites, file sharing services, or unofficial stores, they bypass all these protections. Sideloaded apps may contain malware, spyware, or trojans disguised as legitimate applications. Even if the app appears functional, it may secretly harvest personal data, record keystrokes, or provide backdoor access to the device. Android devices require explicitly enabling installation from unknown sources, while iOS requires jailbreaking (which itself introduces additional security risks). Always download apps exclusively from official sources and carefully review permissions before installation.
Question 2: What security vulnerability is associated with default credentials on IoT devices?
- Default credentials make devices run slower
- Attackers can easily access devices using widely known factory-default usernames and passwords (Correct answer)
- Default credentials use too much storage space
- Default credentials prevent firmware updates
Correct answer: Attackers can easily access devices using widely known factory-default usernames and passwords
Many IoT devices ship with common default credentials (like admin/admin) that are publicly documented and easily exploited if users do not change them during setup.
Default credentials on IoT devices represent one of the most exploited security vulnerabilities in the connected device ecosystem. Manufacturers ship devices with factory-default usernames and passwords (commonly admin/admin, admin/password, or root/root) that are identical across all devices of that model and widely documented in product manuals and online databases. Many users never change these defaults during setup. Attackers use automated scanning tools like Shodan to find internet-connected IoT devices and systematically attempt default credentials. The Mirai botnet famously exploited this vulnerability, compromising hundreds of thousands of IoT devices (cameras, routers, DVRs) using a list of just 62 common default credential pairs, then using the botnet for massive DDoS attacks. Mitigation requires immediately changing default passwords during setup, using unique strong passwords for each device, and choosing devices from manufacturers that require password changes during initial configuration.
Question 3: Why is remote wipe capability important for mobile device security?
- It cleans the screen of the device remotely
- It allows all data on a lost or stolen device to be erased remotely to prevent unauthorized access (Correct answer)
- It restarts the device to clear temporary files
- It updates the device's operating system wirelessly
Correct answer: It allows all data on a lost or stolen device to be erased remotely to prevent unauthorized access
Remote wipe allows you to erase all data on a lost or stolen mobile device from another device or computer, preventing thieves from accessing personal information, accounts, and sensitive data.
Remote wipe is a security feature that allows the owner or administrator of a mobile device to send a command that erases all data on the device, restoring it to factory settings. This capability is critical when a device is lost or stolen because modern smartphones and tablets contain vast amounts of sensitive informationâemail accounts, banking apps, saved passwords, personal photos, work documents, and access to cloud services. Both iOS (Find My iPhone) and Android (Find My Device) offer built-in remote wipe capabilities. For corporate devices, Mobile Device Management (MDM) solutions provide selective wipe options (removing only corporate data while preserving personal data). To be effective, remote wipe requires the device to have internet connectivity after being lost. Therefore, it should be combined with strong device encryption and biometric/PIN locks that protect data even without a network connection.
Question 4: What is a man-in-the-middle attack on a mobile device?
- Physically stealing a phone from someone's hand
- An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path (Correct answer)
- A person reading someone's screen over their shoulder
- Blocking cellular signal to prevent phone calls
Correct answer: An attacker intercepting communications between the mobile device and a server by positioning themselves in the network path
In a mobile MITM attack, an attacker intercepts the communication between a device and a network serviceâoften through rogue Wi-Fi access pointsâto steal data or inject malicious content.
A man-in-the-middle (MITM) attack on mobile devices occurs when an attacker positions themselves between the device and the server it is communicating with, intercepting and potentially modifying the data in transit. Common mobile MITM vectors include rogue Wi-Fi access points (evil twin attacks mimicking legitimate hotspots), ARP spoofing on local networks, DNS spoofing redirecting traffic to attacker-controlled servers, and compromised or malicious proxy servers. Mobile devices are particularly vulnerable because users frequently connect to untrusted Wi-Fi networks. Attackers can capture login credentials, session tokens, personal messages, and financial transactions. Protection includes using VPNs on public Wi-Fi, verifying HTTPS connections, enabling certificate pinning in apps, avoiding auto-connect to open Wi-Fi networks, and being cautious of certificate warnings that may indicate an ongoing MITM attack.
Question 5: What security risk does Bluetooth pose when left enabled and discoverable on a mobile device?
- It drains battery faster
- Attackers can exploit Bluetooth vulnerabilities to access data, eavesdrop on communications, or gain control of the device (Correct answer)
- Bluetooth interferes with Wi-Fi signal quality
- It reduces cellular reception strength
Correct answer: Attackers can exploit Bluetooth vulnerabilities to access data, eavesdrop on communications, or gain control of the device
Leaving Bluetooth enabled and discoverable exposes the device to attacks like Bluejacking, Bluesnarfing, and BlueBorne that can steal data, install malware, or take control of the device.
Bluetooth, when left enabled and discoverable, creates an additional attack surface on mobile devices. Several types of Bluetooth-specific attacks exist: Bluejacking sends unsolicited messages to Bluetooth-enabled devices; Bluesnarfing steals data (contacts, emails, messages) from a device through a Bluetooth connection; BlueBorne is a set of vulnerabilities that allow attackers to take complete control of devices, spread malware, and establish man-in-the-middle connectionsâall without requiring the device to be paired or discoverable. Bluetooth attacks typically have a limited physical range (usually 10-30 meters, but can be extended with directional antennas). Best practices include disabling Bluetooth when not in use, setting devices to non-discoverable mode, rejecting unexpected pairing requests, keeping firmware updated to patch known vulnerabilities, and removing paired devices that are no longer used.
Question 6: What is the security concern with granting excessive permissions to mobile apps?
- Apps with more permissions use more storage
- Apps may access sensitive data like contacts, location, camera, and microphone beyond what is needed for their functionality (Correct answer)
- Permissions make apps load more slowly
- Apps with permissions cannot be uninstalled
Correct answer: Apps may access sensitive data like contacts, location, camera, and microphone beyond what is needed for their functionality
When apps receive unnecessary permissions, they can access sensitive data and device capabilities beyond their legitimate needs, potentially harvesting personal information for unauthorized purposes.
Mobile app permissions control what device resources and data an app can accessâincluding contacts, photos, location, camera, microphone, storage, and SMS messages. When users grant excessive permissions without scrutiny, apps can access far more data than needed for their stated functionality. A simple game or utility app requesting access to contacts, microphone, and precise location is a red flag. Some apps collect this data for advertising profiles, while malicious apps may harvest it for more nefarious purposes including identity theft, surveillance, and data sale on dark markets. Both Android and iOS now support granular permission management, allowing users to grant, deny, or limit permissions on a per-app basis and revoke them later. Best practices include reviewing requested permissions before installation, denying unnecessary permissions, periodically auditing app permissions in device settings, and uninstalling apps that request suspicious access.
CSCU Mobile and IoT Device Security 2
What is the primary security risk of sideloading apps on a mobile device?