What can a malicious user / attacker do if access is gained to a mobile device (smartphone/tablet) on a company network ?

  • 4
    This is a "How long is a piece of string?" question - the answer depends entirely on any security measures in place, and the skill, determination, and motivation of the attacker. Are you able to narrow the question down to a specific threat or important asset? Oct 26 '13 at 19:34
  • I guess my question was too broad ! What I wanted to understand was if a compromised mobile device is as risky as a compromised computer... ie. can be used to pretty much do anything depending on the skill, determination, and motivation of the attacker like you mentioned.
    – vibez_well
    Oct 26 '13 at 19:41
  • @vibez_well Mobile devices = mobile computers
    – Sean W.
    Oct 26 '13 at 20:16

Ok, I'm answering the question as posed in your comment:

[Is] a compromised mobile device as risky as a compromised computer?

Yes. Absolutely.

Per @Sean W, a modern smartphone/tablet is a computer, albeit a little one with not that much CPU, that is easy to carry around and prone to being dropped into puddles. Therefore the risk profile is similar (at the very least).

In fact, in many cases I would argue that a smartphone/tablet is much more risky once compromised:

  1. It's small and easily hidden. If connected to AC power in a dark corner, it might go un-noticed for months.

  2. They often have data connectivity via cellular network, allowing an attacker to bypass any corporate security controls.

  3. The mobile OS usually runs on chips (as opposed to hard drives, which can be removed). This makes post-attack analysis much more difficult for Infosec analysts.

An attacker connects to the smartphone, which in turn is connected to the corporate network. End result? The attacker is connected to the corporate network, just as if a desktop computer had been compromised. Almost every mobile device will have enough CPU to run a SSH server for the attacker to connect to.


Not the answer you're looking for? Browse other questions tagged or ask your own question.