Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

This question already has an answer here:

What can a malicious user / attacker do if access is gained to a mobile device (smartphone/tablet) on a company network ?

share|improve this question

marked as duplicate by Xander, TildalWave, AviD Oct 26 '13 at 21:06

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

4  
This is a "How long is a piece of string?" question - the answer depends entirely on any security measures in place, and the skill, determination, and motivation of the attacker. Are you able to narrow the question down to a specific threat or important asset? –  scuzzy-delta Oct 26 '13 at 19:34
    
I guess my question was too broad ! What I wanted to understand was if a compromised mobile device is as risky as a compromised computer... ie. can be used to pretty much do anything depending on the skill, determination, and motivation of the attacker like you mentioned. –  vibez_well Oct 26 '13 at 19:41
    
@vibez_well Mobile devices = mobile computers –  Sean W. Oct 26 '13 at 20:16

1 Answer 1

up vote 0 down vote accepted

Ok, I'm answering the question as posed in your comment:

[Is] a compromised mobile device as risky as a compromised computer?

Yes. Absolutely.

Per @Sean W, a modern smartphone/tablet is a computer, albeit a little one with not that much CPU, that is easy to carry around and prone to being dropped into puddles. Therefore the risk profile is similar (at the very least).

In fact, in many cases I would argue that a smartphone/tablet is much more risky once compromised:

  1. It's small and easily hidden. If connected to AC power in a dark corner, it might go un-noticed for months.

  2. They often have data connectivity via cellular network, allowing an attacker to bypass any corporate security controls.

  3. The mobile OS usually runs on chips (as opposed to hard drives, which can be removed). This makes post-attack analysis much more difficult for Infosec analysts.

An attacker connects to the smartphone, which in turn is connected to the corporate network. End result? The attacker is connected to the corporate network, just as if a desktop computer had been compromised. Almost every mobile device will have enough CPU to run a SSH server for the attacker to connect to.

share|improve this answer
    
thank you scuzzy-delta ! brilliant :-) let me look around for some journal articles on this now. ta ! –  vibez_well Oct 27 '13 at 22:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.