{"id":8831,"date":"2017-03-12T10:40:21","date_gmt":"2017-03-12T17:40:21","guid":{"rendered":"http:\/\/blog.hellotech.com\/?p=8831"},"modified":"2024-07-15T12:47:41","modified_gmt":"2024-07-15T19:47:41","slug":"android-for-work-secure","status":"publish","type":"post","link":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure","title":{"rendered":"Android for Work Isn’t as Secure as You Expect It to Be"},"content":{"rendered":"\n

Android is considered to be one of the most secure mobile platforms on the planet. Sure, a few viruses slip through the gates and infect several users but, most of the time, Google’s efforts are effective in protecting users from online threats. Unfortunately, online security firm Skycure has discovered a loophole<\/a> that can put Android users at risk. This loophole targets those who use Android for Work, which means that personal security isn’t the only issue here since sensitive corporate information is also at risk.<\/p>\n\n\n\n

What is Android for Work?<\/h2>\n\n\n\n

Android for Work was introduced in 2014 along with Google Play for Work. These two services fulfill businesses\u2019 needs by allowing enterprise-level apps to coexist with personal apps without interacting with each other. This proved to be a big hit among business owners and employees since they no longer had to bring a work phone along with their personal phone. With just one device, they could access work-related applications while keeping their personal stuff separate.<\/p>\n\n\n\n

Technically, the service is no longer called “Android for Work” since Google renamed it to simply “Android” late last year. However, nothing much has changed. The major difference is that many of the features found in the enterprise service are now a core part of the Android and Google Play for the general public, so there\u2019s no need for separate branding.<\/p>\n\n\n

\n
\"Android<\/span>
image: AndroidAuthority<\/figcaption><\/figure>\n<\/div>\n\n\n

One of Android for Work\u2019s biggest benefits is that it safeguards work-related data. IT administrators can use special tools to protect work profiles so, even when enterprise and personal apps are used side-by-side, there\u2019s minimal risk of security breaches \u2014 at least in theory.<\/p>\n\n\n\n

How Android for Work Can Be Breached<\/h2>\n\n\n\n

Skycure proved that Google\u2019s defenses are far from being impenetrable. During the 2017 RSA Conference (which took place on February 13 to 17), the company discussed how an innocent-looking-but-actually-malicious app can \u201cbridge\u201d the separation between personal and enterprise applications. When this happens, the harmful app can obtain users\u2019 information \u2014 including sensitive corporate details.<\/p>\n\n\n\n

Phone Notifications<\/h3>\n\n\n\n

As Skycure demonstrated during the RSA Conference (and discussed on their blog), malicious apps can breach Android for Work\u2019s defenses by using phone notifications. In devices with Android for Work, users can receive enterprise-related notifications alongside any notifications from their personal apps. If a malicious app is given the permission to access notifications (and this is something that almost every mobile application nowadays can do), it can collect enterprise information and pass it on to cyber criminals.<\/p>\n\n\n\n

Skycure demonstrated this using a personal app that allows users to mirror notifications from their Android device to their PC, presumably so they won\u2019t have to glance down at their phone every now and then. For the app to work, users need to give it the permission to view and take action on their notifications. The problem lies in the fact that Notification Access is given as a device-level, not <\/span>app-level, permission so the malicious app can access both personal and enterprise-related notifications.<\/p>\n\n\n

\n
\"Android<\/span>
image: GiffGaff<\/figcaption><\/figure>\n<\/div>\n\n\n

The app definitely works as advertised, but what users don\u2019t know is that it\u2019s also copying their notifications and sending them to hackers \u2014 who can now read their work emails, office calendar reminders, and chats with their managers and coworkers.<\/p>\n\n\n\n

Even worse: a hacker can further take advantage of this situation by using the \u201cforgot password\u201d feature in apps and websites. Usually, when a user clicks the \u201cforget password\u201d link, the service provider sends him an email to allow him to reset his password. If the hacker already has access to the user\u2019s email account (through the malicious notification-mirroring app), he can intercept the email and use it to give himself access to the user\u2019s other accounts. The user won\u2019t even know that this happened since the hacker can dismiss the notification right away and archive the email.<\/p>\n\n\n\n

Accessibility Permissions<\/h3>\n\n\n\n

Android\u2019s Accessibility Service is helpful for users with visual impairment since it translates on-screen text into an audible narration. To make this possible, the service needs to have access to all the controls in the device (both for reading and writing) \u2014 something that can be hijacked by attackers.<\/p>\n\n\n

\n
\"Android<\/span>
image: SitePoint<\/figcaption><\/figure>\n<\/div>\n\n\n

To illustrate this, Skycure used a personal app called StickiWiki that allows users quickly look up information on Wikipedia by simply typing \u201c@wiki\u201d in any application. To perform this function, StickiWiki has to ask permission to access all content on the screen so it would know when to perform a search on Wikipedia. There\u2019s nothing wrong with this \u2014 unless StickiWiki is a malicious app. If it is, it can use its Accessibility Permission to access both personal and enterprise apps and render Android for Work virtually useless.<\/p>\n\n\n\n

Possible Solutions<\/h3>\n\n\n
\n
\"Android<\/span>
image: InfoWorld<\/figcaption><\/figure>\n<\/div>\n\n\n

One of the best ways to work around these vulnerabilities is to require employees to use a separate smartphone for work-related tasks. If this is not possible, it\u2019s advisable to use third-party apps that offer mobile security on top of Android\u2019s built-in defenses. Of course, users must do their part and ensure they\u2019re not downloading unsafe apps.<\/p>\n","protected":false},"excerpt":{"rendered":"

Android is considered to be one of the most secure mobile platforms on the planet. Sure, a few viruses slip through the gates and infect several users but, most of the time, Google’s efforts are effective in protecting users from online threats. Unfortunately, online security firm Skycure has discovered a loophole that can put Android users at risk. This loophole targets those who use Android for Work, which means that personal security isn’t the only issue here since sensitive corporate […]<\/p>\n","protected":false},"author":1,"featured_media":8858,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[17582,17587,17593],"tags":[],"class_list":["post-8831","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-mobile","category-news","category-staying-safe"],"acf":[],"yoast_head":"\nAndroid for Work Isn't as Secure as You Expect It to Be<\/title>\n<meta name=\"description\" content=\"A new loophole targets Android for Work, which means that personal security isn't the only issue here since sensitive corporate information is also at risk.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Android for Work Isn't as Secure as You Expect It to Be - The Plug - HelloTech\" \/>\n<meta property=\"og:description\" content=\"Android is considered to be one of the most secure mobile platforms on the planet. Sure, a few viruses slip through the gates and infect several users\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\" \/>\n<meta property=\"og:site_name\" content=\"The Plug - HelloTech\" \/>\n<meta property=\"article:publisher\" content=\"http:\/\/www.facebook.com\/hellotech\" \/>\n<meta property=\"article:published_time\" content=\"2017-03-12T17:40:21+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-07-15T19:47:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2017\/03\/androidforwork-min.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"640\" \/>\n\t<meta property=\"og:image:height\" content=\"426\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@HelloTech\" \/>\n<meta name=\"twitter:site\" content=\"@HelloTech\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c\"},\"headline\":\"Android for Work Isn’t as Secure as You Expect It to Be\",\"datePublished\":\"2017-03-12T17:40:21+00:00\",\"dateModified\":\"2024-07-15T19:47:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\"},\"wordCount\":864,\"publisher\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\"},\"articleSection\":[\"Mobile & Phone\",\"News\",\"Staying Safe\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\",\"url\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\",\"name\":\"Android for Work Isn't as Secure as You Expect It to Be\",\"isPartOf\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#website\"},\"datePublished\":\"2017-03-12T17:40:21+00:00\",\"dateModified\":\"2024-07-15T19:47:41+00:00\",\"description\":\"A new loophole targets Android for Work, which means that personal security isn't the only issue here since sensitive corporate information is also at risk.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/android-for-work-secure#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.hellotech.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Android for Work Isn’t as Secure as You Expect It to Be\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#website\",\"url\":\"https:\/\/www.hellotech.com\/blog\/\",\"name\":\"The Plug - HelloTech\",\"description\":\"Turn to The Plug for informative tech news that you can use. \",\"publisher\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.hellotech.com\/blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#organization\",\"name\":\"HelloTech\",\"url\":\"https:\/\/www.hellotech.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png\",\"contentUrl\":\"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png\",\"width\":1000,\"height\":174,\"caption\":\"HelloTech\"},\"image\":{\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"http:\/\/www.facebook.com\/hellotech\",\"https:\/\/twitter.com\/HelloTech\",\"http:\/\/www.instagram.com\/hello_tech\",\"https:\/\/www.youtube.com\/channel\/UCIR-fbAKRfVuAbciDr2z4nQ\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g\",\"caption\":\"admin\"}}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Android for Work Isn't as Secure as You Expect It to Be","description":"A new loophole targets Android for Work, which means that personal security isn't the only issue here since sensitive corporate information is also at risk.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure","og_locale":"en_US","og_type":"article","og_title":"Android for Work Isn't as Secure as You Expect It to Be - The Plug - HelloTech","og_description":"Android is considered to be one of the most secure mobile platforms on the planet. Sure, a few viruses slip through the gates and infect several users","og_url":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure","og_site_name":"The Plug - HelloTech","article_publisher":"http:\/\/www.facebook.com\/hellotech","article_published_time":"2017-03-12T17:40:21+00:00","article_modified_time":"2024-07-15T19:47:41+00:00","og_image":[{"width":640,"height":426,"url":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2017\/03\/androidforwork-min.jpg","type":"image\/jpeg"}],"author":"admin","twitter_card":"summary_large_image","twitter_creator":"@HelloTech","twitter_site":"@HelloTech","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure#article","isPartOf":{"@id":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure"},"author":{"name":"admin","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c"},"headline":"Android for Work Isn’t as Secure as You Expect It to Be","datePublished":"2017-03-12T17:40:21+00:00","dateModified":"2024-07-15T19:47:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure"},"wordCount":864,"publisher":{"@id":"https:\/\/www.hellotech.com\/blog\/#organization"},"articleSection":["Mobile & Phone","News","Staying Safe"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure","url":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure","name":"Android for Work Isn't as Secure as You Expect It to Be","isPartOf":{"@id":"https:\/\/www.hellotech.com\/blog\/#website"},"datePublished":"2017-03-12T17:40:21+00:00","dateModified":"2024-07-15T19:47:41+00:00","description":"A new loophole targets Android for Work, which means that personal security isn't the only issue here since sensitive corporate information is also at risk.","breadcrumb":{"@id":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hellotech.com\/blog\/android-for-work-secure"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.hellotech.com\/blog\/android-for-work-secure#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.hellotech.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Android for Work Isn’t as Secure as You Expect It to Be"}]},{"@type":"WebSite","@id":"https:\/\/www.hellotech.com\/blog\/#website","url":"https:\/\/www.hellotech.com\/blog\/","name":"The Plug - HelloTech","description":"Turn to The Plug for informative tech news that you can use. ","publisher":{"@id":"https:\/\/www.hellotech.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hellotech.com\/blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hellotech.com\/blog\/#organization","name":"HelloTech","url":"https:\/\/www.hellotech.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png","contentUrl":"https:\/\/www.hellotech.com\/blog\/wp-content\/uploads\/2018\/11\/HT-logo-revised-final.png","width":1000,"height":174,"caption":"HelloTech"},"image":{"@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["http:\/\/www.facebook.com\/hellotech","https:\/\/twitter.com\/HelloTech","http:\/\/www.instagram.com\/hello_tech","https:\/\/www.youtube.com\/channel\/UCIR-fbAKRfVuAbciDr2z4nQ"]},{"@type":"Person","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/dec00225dd888a509740ace5e4d9de6c","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hellotech.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/cbb537d18df244ad7d57a3639d94ede5cd90bf1fb742392af5731beaf11ffeb1?s=96&d=mm&r=g","caption":"admin"}}]}},"_links":{"self":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts\/8831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/comments?post=8831"}],"version-history":[{"count":0,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/posts\/8831\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/media\/8858"}],"wp:attachment":[{"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/media?parent=8831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/categories?post=8831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hellotech.com\/blog\/wp-json\/wp\/v2\/tags?post=8831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}