Can an infected phone infect other computers in a network?
For example do you need to worry about private phones in a company enviroment?
Or is that already paranoid?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A modern smartphone is far more powerful and connected than, say, a 1990s office work-station. There's nothing about it being a "phone" that makes it not a network-connected general-purpose computer. This is also true of many Internet of Things devices. The fact that a WiFi light socket is a light socket doesn't make it any less network-enabled or computationally-capable.
Typically, a private phone won't be on a corporate network unless there is a separate "guest" network meant for that purpose, as Mike Scott describes. Still, a smartphone could attempt an attack from that "guest" network (and it's not like compromising that network wouldn't be a problem of its own), or it could directly attempt to attack WiFi access points used by the internal network. Further, if an employee plugs their phone into their work computer to charge it, this is another vector for the phone to attack the internal network.
Another concern for some organizations is the phone's ability to record audio and video. Here, whether the phone is "infected" or not is less of a concern. Even if you trust the owner of the phone, the recording features can be enabled without the owners knowledge or consent.
If you can imagine how an infected laptop or desktop could cause a problem in such an environment, a phone is only an even more network-connected and discreet platform. In other words, for many reasons a phone is an even better platform for attacks as compared to a laptop or desktop.
Yes, any infected device can potentially compromise other devices on the same network. A corporate network should really not allow access for personal devices or any other devices not managed by the corporate IT team, except perhaps to a partitioned-off DMZ to allow access to the Internet but not to internal networks.
This has nothing to do with being infected. If an infected phone can attack your network, then I can write software to run on the phone that performs the exact same attack. That way there is no difference between an infected and an uninfected phone.
The only difference is that in addition to being attacked by the phones of malicious employees, you could also be attacked by the phones of careless employees who allowed their phones to be infected.
What you should really worry about is whether your network is vulnerable to any attacks.