Kirwan brings over 20 years of experience across the network monitoring and cyber security landscape in EMEA and APAC, alongside several years building and scaling enterprise SaaS businesses across EMEA. He stepped into the CEO role in June 2026.

Kirwan takes over a business with an established position in mobile security and a growing presence in the European enterprise market. His appointment reflects Corrata’s focus on its next phase of growth.

“I am proud to lead this team into our next chapter,” said Mark Kirwan, CEO of Corrata. “Corrata has built something genuinely valuable in mobile security, and the opportunity ahead in the enterprise market is significant. My focus is on building on that foundation and bringing Corrata’s protection to more organisations across Europe and beyond.”

Healy, who founded the company and led it through its early growth, will remain involved in an advisory capacity. 

“It has been a privilege to build Corrata and to work with the team we have today,” said Colm Healy, founder of Corrata. “Mark is the right person to lead the company into its next stage. He brings the experience and the discipline to take what we have built and grow it, and I am confident the company is in good hands.”

Kirwan’s appointment is effective immediately.

About Corrata

Corrata is a mobile endpoint security company headquartered in Dublin, Ireland. Its on-device technology delivers comprehensive threat detection and response for iOS and Android devices, combining advanced mobile threat defence with data loss prevention. Corrata is recognised by independent analysts and customers as a leader in Mobile Threat Defence, with customers spanning healthcare, logistics, professional services, manufacturing and the public sector. Corrata is a verified European cybersecurity company, a member of the Microsoft Intelligent Security Association, and is ISO 27001 certified.

The post Corrata Appoints Mark Kirwan as Chief Executive Officer appeared first on Corrata.

Company investing in domain-specific Small Language Model for privacy-compliant mobile threat detection as AI reshapes the attack landscape

DUBLIN and LONDON, 3 June 2026 (Infosec Europe, ExCeL London) ** Updated on 9 June 2026: terminology updated from “on-device LLM” to “domain-specific SLM” to more accurately describe the model in development. — Corrata, the mobile endpoint security company, today announced a comprehensive reimagining of its approach to mobile device security in response to the rapid transformation of the threat landscape by artificial intelligence. The announcement encompasses new AI governance capabilities, enhanced data loss prevention, and a commitment to developing anon-device domain-specific small language model (SLM) for next-generation mobile threat detection.

“The device in your employee’s pocket is simultaneously connected to AI tools, targeted by AI-powered attackers, and operating in an environment where the threat landscape is being rewritten in real time,” said Colm Healy, CEO of Corrata. “The controls deployed two or three years ago were not built for this world. We have rebuilt ours to match it.”

How AI Is Reshaping the Mobile Threat Landscape

Mobile devices sit at the epicentre of three distinct AI-driven risk dimensions that security teams must now contend with simultaneously.

Hyper-personalised social engineering. AI has transformed phishing from a numbers game into targeted precision. Attackers now use large language models to construct lures from publicly available data, producing messages indistinguishable from genuine communications. Research puts the click-through rate on AI-generated phishing at 54%, against 12% for traditional campaigns. On mobile, where 85% of phishing attacks already occur outside email, across SMS, WhatsApp, Teams and other messaging channels, the impact is acute.

AI-accelerated exploits. In May 2026, Google Threat Intelligence Group confirmed a real-world threat actor had used a zero-day exploit developed with AI, planned for mass exploitation and only stopped by proactive counter-discovery. Finding and weaponising vulnerabilities no longer requires deep expertise or months of effort. The median time from disclosure to active exploitation had already fallen from 771 days in 2018 to single-digit hours before frontier AI models entered the picture. Mobile is particularly exposed, where apps are deployed quickly and sometimes outside the review processes that govern traditional software.

Shadow AI and data loss. When employees find that an AI tool makes them more productive, they use it, approved or not. Research suggests 43% of employees share corporate data with LLMs without authorisation. On mobile, where personal and professional boundaries are already blurred, the exposure is acute: sensitive documents uploaded to consumer AI services, client details pasted into chatbots, proprietary code submitted for debugging. Institutional knowledge is leaving organisations at an unprecedented rate, with no visibility and no controls in place.

How Corrata Is Responding

Corrata has always been built on a simple premise: mobile devices deserve the same depth of security monitoring as laptops and servers. Its on-device architecture inspects 100% of network traffic without routing it through a cloud relay, a visibility advantage no competitor has matched. In the AI era, that foundation becomes more important, not less. Corrata has now extended it across three areas.

On-device domain-specific SLM for enhanced threat detection. The vast majority of mobile traffic is now encrypted, and current detection methods will struggle against the more sophisticated social engineering and exploit techniques that AI is enabling. Corrata is developing an on-device domain-specific SLM purpose-built for the mobile environment. A general-purpose LLM cannot run on a phone with the speed, memory footprint and power budget that continuous threat detection requires. By narrowing the model to this single task, Corrata makes it small enough to run on the device itself, in real time, with no data leaving the phone.

AI governance for the mobile workspace. Corrata’s AI Governance capability lets organisations define which AI services and SDKs are sanctioned in the mobile workspace and enforces those policies automatically. Approved tools are unaffected; access to unsanctioned services, including consumer chatbots, AI coding assistants and embedded LLM SDKs in third-party apps, is flagged or blocked. As AI governance frameworks including ISO 42001 and the EU AI Act mature, mobile is the enforcement gap most organisations have yet to close. Corrata closes it.

Precision mobile DLP for the AI age. Data leakage via mobile is no longer confined to lost devices or unencrypted email. AI tools are now a primary exfiltration channel. Corrata’s enhanced data loss prevention uses fine-grained traffic analysis to detect sensitive corporate data being transmitted to external services, whether deliberately or inadvertently, enabling security teams to act on genuine data loss events rather than chase false positives.

“Corrata brings together the deepest visibility into mobile traffic of any solution on the market with a new generation of AI-native capabilities built for the threats that matter most right now,” said Colm Healy.

Availability

Corrata’s AI Governance and enhanced DLP capabilities are available now. The on-device domain-specific SLM is in active development, with availability to be announced.

About Corrata

Corrata is a mobile endpoint security company headquartered in Dublin, Ireland. Its on-device technology delivers comprehensive threat detection and response for iOS and Android devices, combining advanced mobile threat defence with data loss prevention and AI governance. Corrata is a member of the Microsoft Intelligent Security Association (MISA), verified for use with FirstNet, and is accredited as ‘Cybersecurity Made in Europe’ by ECSO. For more information, visit corrata.com.

###

The post Corrata Reimagines Mobile Device Security for the AI Era appeared first on Corrata.

Something changed in 2026. The kind of iOS spyware that was once the exclusive preserve of intelligence agencies and their approved commercial vendors – tools costing millions of dollars and deployed against a carefully selected handful of dissidents, journalists, civil rights activists, and senior politicians – is now in the hands of cybercriminals.

The emergence of two exploit kits, Coruna and DarkSword, marks a turning point. For the first time, we have clear evidence of nation-state-grade iOS exploitation being used to drain cryptocurrency wallets, steal banking credentials, and conduct broad-based financial fraud. The threat model has fundamentally changed: where previously an ordinary business user had little reason to fear Pegasus-style spyware, today any unpatched iPhone visiting the wrong website is a potential target.

This post traces how we got here – from the first discovery of Pegasus in 2016, through a decade of escalating sophistication, to the moment that sophisticated iOS exploitation went criminal – and explains what your organisation needs to do about it now.

The Beginning: Pegasus and the First Pegasus Attacks (2016)

The story of iOS commercial spyware begins in 2016, when Ahmed Mansour, a UAE human rights activist, received suspicious text messages promising “new secrets” about detainees tortured in UAE jails. Instead of clicking the links, he forwarded them to Citizen Lab. Researchers used a jailbroken iPhone to visit the URLs and discovered a weaponised exploit chain delivering a sophisticated implant – the first publicly documented case of a commercial company selling advanced iOS malware.

The malware was Pegasus, developed by Israeli firm NSO Group. That first version used a WebKit vulnerability as its entry point and required the target to click a link – what the industry calls a “one-click” attack. Once on the device it installed an implant called BridgeHead (BH), dropped persistence files to disk, and exfiltrated data. Because NSO made no attempt at cleanup, Citizen Lab and Lookout Security were able to identify the implant process name, the infrastructure URLs, and the persistence mechanism with relative ease.

The public disclosure was a turning point. NSO Group understood they had been caught – and immediately set about making Pegasus harder to detect.

Going Zero-Click: WhatsApp and iMessage (2019–2021)

By 2019 NSO had shifted to zero-click attack surfaces, meaning the target’s phone could be compromised without the victim doing anything at all. A joint investigation by WhatsApp and Citizen Lab revealed that NSO was exploiting a vulnerability in WhatsApp calls – simply receiving a call was enough to trigger infection. Missed calls appeared in the victim’s call log, which became one of the primary forensic indicators for this campaign.

In 2021 the Pegasus Project – a collaboration involving Amnesty International, Citizen Lab, and media partners – analysed a leaked list of roughly 50,000 phone numbers believed to be potential Pegasus targets. Forensic analysis of around 100 devices found 80 confirmed infections. Targets included President Emmanuel Macron of France, senior politicians in Spain and other countries, journalists, lawyers, and human rights activists across dozens of nations. By this point Pegasus had clearly moved far beyond its original stated purpose of targeting criminals and terrorists.

The technical highlight of this period was the “FORCEDENTRY” exploit, which attacked iMessage’s image rendering pipeline by building a virtual machine inside a PDF parser to achieve code execution and sandbox escape without any user interaction. Google Project Zero published a detailed analysis describing it as one of the most technically sophisticated exploits ever seen in the wild.

Forensically, Pegasus was becoming more careful. Process names were now chosen to mimic legitimate iOS processes, though with subtle one-letter variations that a trained analyst could spot. The implant also began delaying device shutdowns – a behaviour that left traces in a file called shutdown.log – and started attempting to clean up iMessage attachment directories after infection. Crucially, it cleaned only one of two relevant database tables, leaving a distinctive discrepancy that became a reliable detection signal.

The Ecosystem Expands: State Campaigns and New Vendors (2019–2022)

NSO was not operating alone. Several other commercial and state-linked actors emerged during this period.

iSoon / Chinese State Actor (2019). Google’s Threat Analysis Group documented a campaign attributable to the Chinese contractor iSoon (not publicly named at the time) that hosted five different WebKit exploit chains – fourteen vulnerabilities in total – targeting devices from iOS 10 through iOS 14. Anyone who visited the infected web servers would have been compromised regardless of their identity. The malware transmitted stolen data completely unencrypted over the network, a remarkable operational security failure that allowed researchers to recover everything. This was the first publicly documented case of iOS exploits used in mass, indiscriminate attacks.

LightSpy / TwoSail Junk (2020). In early 2020, Trend Micro and Kaspersky documented a watering hole campaign against iOS users in Hong Kong that used a full remote exploit chain to install a modular implant named LightSpy. The attackers built web pages mimicking local news sites, including one that copied the HTML of a Hong Kong newspaper, and embedded a hidden iframe that loaded the exploit script. Links were posted to four Hong Kong discussion forums, and anyone visiting with a vulnerable iOS version was compromised. The chain targeted iOS 12.1 and 12.2, combining a kernel bug tracked as CVE-2019-8605 with a Safari vulnerability that Apple had patched silently without assigning a CVE, according to Trend Micro’s technical brief. Kaspersky discovered the initial watering hole on 10 January 2020, observed mass distribution from 18 February, and tracked the activity under the name TwoSail Junk, which it described at the time as a provisional designation. The implant was a modular backdoor supporting remote shell execution, file manipulation, and plugin modules that exfiltrated data from applications including WeChat and Telegram. An Android counterpart, dmsSpy, was distributed separately through public Telegram channels.

Predator / Intellexa (2021 onwards). Developed by the Intellexa consortium (previously trading under the name Cytrox), Predator typically used WebKit as its infection vector. Google TAG and Citizen Lab documented campaigns targeting Meta employees, politicians, and journalists. A Predator infection found in Greece led to a criminal conviction: one of the founders of the Intellexa group was sentenced to eight years in prison for his role in the affair. Forensically, Predator spoofed legitimate iOS process names (such as usereventsagent), stored a configuration file in /private/var/keybagd/, and notably used Apple Shortcuts as a persistence mechanism. Later versions moved toward network-injection delivery – using a privileged position on the mobile network to inject exploit code into unencrypted (or fraudulently-signed encrypted) web traffic, effectively turning any unencrypted web browsing into a zero-click attack surface.

Hermit (2022). The Hermit spyware, linked to Italian vendor RCS Lab, took a different approach: social engineering combined with a sideloaded application. Operators worked with mobile network carriers to temporarily cut off a target’s internet connection, then sent an SMS inviting the victim to download an app to restore service. Inside the app, Hermit used a combination of public and privately-held exploits to gain privileged access. Detection is comparatively straightforward – sideloaded apps leave provisioning profiles and appear in device application lists.

Operation Triangulation (2023)

Kaspersky discovered what it called Operation Triangulation, a sophisticated espionage campaign targeting iOS devices – including Kaspersky employees – via zero-click iMessage exploits. The technical sophistication was a step above anything previously documented: the attack used a three-stage chain, cleaned up iMessage attachment directories, flushed crash logs, and disguised activity under legitimate system process names such as BackupAgent. Attribution pointed toward a nation-state actor with substantially greater operational security discipline than commercial vendors.

A New Generation: Graphite and the Paragon Group (2025)

In early 2025 Citizen Lab published the first evidence of a new commercial spyware vendor – Paragon Solutions – whose tool is known as Graphite. The attack vector identified was WhatsApp. Forensic indicators were deliberately limited; Citizen Lab identified network-level artifacts it named “small pretzel” and “big pretzel” but withheld detailed IOCs to preserve detection capability. Graphite’s use of raw IP addresses rather than domain names for command-and-control communication was noted as an attempt to evade DNS-level monitoring tools deployed by mobile security vendors.

The Rules Change: Coruna and DarkSword (2025–2026)

Early 2026 has brought a fundamental shift in the iOS threat landscape. Two exploit kits – Coruna and DarkSword – have demonstrated that sophisticated iOS exploitation is no longer the exclusive preserve of nation-states and their approved commercial vendors. The tooling is now proliferating to organised crime.

Coruna

Google Threat Intelligence Group (GTIG) identified Coruna, an iOS exploit kit whose developers named it internally, in early 2025. The kit is extraordinary in scope: five complete exploit chains, 23 individual exploits, and coverage of every iPhone model running iOS 13.0 through iOS 17.2.1. The exploit code is extensively documented in native English with docstrings and comments, suggesting significant professional engineering investment.

Coruna’s history illustrates exactly how dangerous exploit proliferation has become. GTIG tracked it through three distinct phases:

• A commercial surveillance vendor used parts of the Coruna framework in targeted operations in early 2025.
• UNC6353, a suspected Russian espionage group, embedded the same JavaScript framework on compromised Ukrainian websites in summer 2025 as a watering hole attack, delivering exploits to any iPhone user visiting those pages.
• UNC6691, a financially motivated Chinese threat actor, deployed the complete Coruna kit across hundreds of fake cryptocurrency exchange websites, using it to steal credentials and drain crypto wallets.

The payload recovered from the Chinese campaign – GTIG tracks it as PLASMAGRID – injected itself into powerd (a root-level system daemon) and loaded modular plugins targeting 18 different cryptocurrency wallet applications, scanning memos and images for BIP39 seed phrases and banking credentials.

Technically, Coruna is impressively engineered: exploit payloads are encrypted with ChaCha20, served from URL paths derived by hashing a unique cookie, and packaged in a custom binary format. The kit checks for Lockdown Mode and bails out if it detects it. It also incorporates mitigation bypasses – including some exploitation techniques not previously seen in public research – and reuses modules from Operation Triangulation.

Coruna only works against iOS 17.2.1 and earlier. It is not effective against current iOS versions. Any device still running iOS 17.2.1 or earlier should be updated immediately.

DarkSword

Published by Google in March 2026, DarkSword is a separate full-chain exploit kit targeting iOS 18.4 through 18.7. Where Coruna is a compiled, multi-architecture framework, DarkSword is implemented entirely in JavaScript – making it trivially easy to adapt, host, and reuse.

GTIG observed DarkSword used by at least three distinct actors within months of its first appearance:

• UNC6748 targeted Saudi Arabian users via a Snapchat-themed phishing site (snapshare[.]chat), delivering a backdoor called GHOSTKNIFE capable of exfiltrating messages, location history, browser data, signed-in accounts, and audio recordings.
• PARS Defense, a Turkish commercial surveillance vendor, used DarkSword against targets in Turkey and Malaysia, deploying a different backdoor, GHOSTSABER, which supports arbitrary SQL queries against device databases, file exfiltration, and remote JavaScript execution.
• UNC6353 – the same suspected Russian group that used Coruna against Ukrainian targets – incorporated DarkSword into fresh watering hole campaigns on compromised Ukrainian websites, deploying a dataminer called GHOSTBLADE that harvests iMessage conversations, WhatsApp and Telegram data, photos, location history, Safari data, cryptocurrency wallet information, and device keychains.

DarkSword uses six vulnerabilities across its chain, including CVE-2025-31277 and CVE-2025-43529 (both JavaScriptCore memory corruption bugs), CVE-2026-20700 (a PAC bypass in dyld exploited as a zero-day), and additional sandbox escape and privilege escalation bugs. All six have now been patched – most in iOS 18.7.2/18.7.3, with the PAC bypass patched in iOS 26.3.

Any device running iOS 18.7.1 or earlier, or iOS 26.0 through 26.2, is potentially vulnerable to DarkSword variants and should be updated without delay.

How the Threat Landscape Has Evolved

The shift in 2025 and 2026 is the democratisation of high-quality iOS exploits. Both Coruna and DarkSword were used by multiple independent actors within months of their first appearance in the wild, and DarkSword exploit code has since been published to GitHub. For ordinary business users this is a different risk profile from the targeted spyware threat of previous years, because the economics no longer require anyone to consider a given device worth a seven-figure operation.

The delivery model itself, though, is not new. The 2019 campaign documented by Google’s Threat Analysis Group and the 2020 LightSpy campaign both compromised anyone who visited the wrong page. What is new is that the same model is now funded by financial crime as well as by intelligence collection, and that the tooling behind it changes hands between unrelated operators.

Proliferation also runs in the other direction. In August 2026, Arctic Wolf reported that LightSpy, previously linked to Chinese state-backed operations, is now run as a commercial platform with its own branding, billing, and customer demonstrations, and that it has been found infecting routers, which gives operators visibility into every device on the same network.

What Apple Is – and Isn’t – Doing

Apple has shipped a significant number of security mitigations over this decade, including Pointer Authentication Codes (PAC), the Page Protection Layer (PPL), the Secure Page Table Monitor (SPTM), and most recently memory integrity enforcement on iPhone 17. Lockdown Mode, introduced in 2022, does reduce the attack surface – it would have mitigated parts of both Coruna and DarkSword – but at a significant usability cost that makes it impractical for most users.

Apple also issues threat notifications when it has evidence a device may have been targeted. However, these notifications rely primarily on iMessage metadata and Apple service monitoring rather than on-device detection; they provide little actionable forensic detail about the nature or timeline of an infection.

What Apple does not ship is any on-device detection framework analogous to the Endpoint Security framework available on macOS. There is no mechanism for security tools to monitor process creation, file system access in sensitive directories, or crash log patterns in real time. Given that monitoring the /tmp directory and crash logs would have surfaced indicators for every major commercial spyware family documented over the past decade, this remains a significant gap.

In the absence of on-device visibility, network traffic monitoring is the only reliable method for remotely detecting an active spyware infection. Every implant documented in this post – from Pegasus to GHOSTBLADE – must communicate with a command-and-control server to exfiltrate data and receive instructions. That traffic, however well encrypted, has to traverse the network, and at that point it becomes detectable. Anomalous connections to raw IP addresses, unexpected domains, unusual data volumes from system processes, or traffic patterns inconsistent with normal application behaviour are all signals that network-layer monitoring can surface. On-device forensic analysis remains the gold standard for confirming and investigating a suspected infection, but for continuous, scalable detection across a fleet of corporate devices, the network is where the evidence reliably appears.

What Organisations Should Do

Immediately:

• Update every iPhone and iPad in your environment to the latest iOS or iPadOS release available for that device. As of August 2026 the current release is iOS 26.6. Do not treat a specific version number as a permanent floor: Apple has been patching this chain across successive releases, and guidance from a few months ago is already out of date.
• Identify devices that cannot run iOS 26 and check them separately. Apple has backported fixes to older branches, including iOS 15 and 16, so an update is available even where a major version upgrade is not. These devices are the largest population still exposed and the one most likely to be missed by a policy written around the current major version.
• List any device that can no longer receive updates at all and remove it from corporate use.

Within three months:

• Implement network traffic monitoring for mobile devices. Network-layer anomalies are detectable even when on-device access is limited, and for payloads that clean up after themselves they may be the only evidence available.
• Review your mobile endpoint security strategy. If your mobile device management platform is your only security control, you have blind spots. MDM gives you an application list; it gives you nothing about exploitation activity.
• Confirm that OS version compliance is monitored continuously rather than audited periodically. The interval between a disclosure and a working public exploit is now measured in weeks.

Within six months:

• Deploy a mobile threat defence (MTD) tool that continuously monitors network traffic for anomalous command-and-control behaviour, rather than one that relies on application reputation checks alone.
• Establish an incident response procedure for suspected iOS compromise, including clear guidance on evidence preservation and access to forensic expertise. On-device forensic analysis is the route to confirming an infection, and it is worth knowing in advance who will perform it.

Corrata provides mobile threat defence for iOS and Android, including network-level detection of spyware communication and vulnerability management to ensure devices are running patched OS versions. Learn more about Corrata’s spyware detection capabilities.

Frequently Asked Questions

Can an iPhone be infected with spyware without the user clicking anything?

Yes. Zero-click iOS spyware has been documented since 2019, when Pegasus was delivered through a WhatsApp call that the target never had to answer. Later chains, including FORCEDENTRY in 2021 and Operation Triangulation in 2023, arrived through iMessage and required no interaction at all.

More recently the delivery model has shifted back towards the web. The Coruna and DarkSword exploit kits compromise devices when a user simply loads a web page, with no download, no permission prompt, and no visible sign that anything has happened.

What are Coruna and DarkSword?

Coruna and DarkSword are iOS exploit kits disclosed by Google Threat Intelligence Group in March 2026. Both take full control of an iPhone when the user visits a malicious or compromised web page. Coruna, also tracked as CryptoWaters, covers iOS 13.0 through 17.2.1 across five exploit chains. DarkSword targets iOS 18.4 through 18.7 and is written entirely in JavaScript.

They matter because of who used them. Each kit was picked up by several unrelated operators within months, including a Russian espionage group, a Turkish surveillance vendor, and a financially motivated actor that deployed Coruna across fake gambling and cryptocurrency sites to drain crypto wallets. A version of DarkSword was later published openly on GitHub.

Which iOS versions are vulnerable, and which should my organisation be running?

Every iPhone and iPad should run the latest iOS or iPadOS release available for that hardware. As of August 2026 the current release is iOS 26.6. Apple has patched the Coruna and DarkSword vulnerabilities across a sequence of releases rather than in one update, so a partial update does not close the chain.

Older hardware is the bigger risk. Devices that cannot run iOS 26 are not out of scope, because Apple has backported fixes to earlier branches including iOS 15 and 16. Any device that can no longer receive security updates at all should be removed from corporate use.

How can you tell if an iPhone has spyware on it?

There is usually no visible sign. Modern iOS spyware hides under legitimate process names, deletes its own staged files, and in the case of DarkSword payloads exits the device once exfiltration is complete. Apple sends threat notifications to users it believes have been targeted, now covering 110 countries, but these arrive after the fact and carry little forensic detail.

The reliable signal is network traffic. Every implant has to reach a command-and-control server to send data out and take instructions, so connections to raw IP addresses, unexpected domains, and unusual data volumes from system processes are all detectable at the network layer. On-device forensic analysis confirms an infection once suspected, but for continuous monitoring across a device fleet the network is where the evidence appears.

Is mobile device management (MDM) enough to protect against iOS spyware?

No. MDM enforces policy and reports on device state, so it will tell you which applications are installed and which OS version a device is running. It has no visibility into exploitation activity, because these attacks install no application and request no permissions.

Closing that gap requires a mobile threat defence (MTD) tool that inspects network traffic for command-and-control behaviour, alongside continuous OS version compliance rather than periodic audits. MDM and MTD address different problems and are generally deployed together.

The post From Pegasus to DarkSword – The alarming history of iOS Spyware appeared first on Corrata.

Corrata, a leading provider of enterprise mobile threat detection and response solutions, today announced its recognition as both a Leader and Fast Mover in the GigaOm Radar for Mobile Threat Defense report.

GigaOm praised Corrata’s comprehensive response capabilities, particularly its ability to instantly restrict compromised devices from accessing enterprise resources, as well as its detailed forensic insights. The report also noted Corrata’s high scores across both core and emerging features, stating:

“Corrata is well-positioned for both SMB and large enterprise deployments, thanks to its scalable architecture that processes security functions directly on devices: without routing traffic through proprietary infrastructure.”

In GigaOM’s rating of twenty MTD solutions Corrata’s achieved the highest overall score confirming its position as a market leader.

With the acceleration of digital transformation and the shift to cloud-based services, mobile devices now serve as primary access points for sensitive enterprise data, often lacking the robust controls found on traditional endpoints. Corrata fills this critical security gap with an enterprise-grade solution that defends against advanced spyware, communication interception, and social engineering attacks: including threats delivered via SMS, WhatsApp, Microsoft Teams, and other messaging platforms.

The GigaOm report underscores the growing importance of mobile threat defense (MTD), stating:

“MTD represents a critical cybersecurity capability in today’s increasingly mobile-first business environment. This technology offers comprehensive protection for mobile devices against sophisticated threats including malware, phishing, network-based attacks, and malicious apps. As organizations expand mobile workflows, MTD has become an essential component of enterprise security architecture.”

Colm Healy, Co-founder and CEO at Corrata, commented:

“This recognition reflects our deep commitment to delivering best-in-class threat detection and response for mobile environments. Today, over 50% of devices accessing enterprise systems are phones and tablets: yet many organizations have virtually no visibility into the threats targeting them. Our research shows up to 22% of threats go undetected by traditional solutions. Corrata closes this visibility gap and significantly reduces mobile’s appeal as an attack vector.”

To be included in the GigaOm Radar, vendors were evaluated based on their product capabilities, strategic roadmap, and market presence.Learn more about Corrata’s mobile threat defense solution here.

SOURCE Corrata Ltd

The post Corrata: Leader & Fast Mover in GigaOm MTD Radar appeared first on Corrata.

DUBLIN, May 21, 2025 — Corrata, the leading mobile endpoint threat detection and response provider, published the Living With ECH Report. The first-of-its-kind report examines the impact of the Encrypted Client Hello (ECH), a new privacy protocol that information security professionals fear could make widely-used security tools blind to large swaths of internet traffic.

ECH is an extension to TLS 1.3, the most recent version of the Transport Layer Security standard used to secure the vast majority of internet communications. ECH proposes to enhance privacy by encrypting key information between devices and Content Delivery Networks (CDNs), preventing network providers from identifying the names of websites that individuals are looking to access. Information security professionals have raised concerns that its implementation may compromise the ability of enterprises to detect and counter cyber threats.

The inaugural report analyzed first-party platform data, billions of connections to web servers made by enterprise employee mobile devices, between January and March 2025. According to the research, more than 9% of the top 1 million domains are ECH-enabled, but less than .01% of TLS connections used the protocol.

However, even though ECH is rarely relied upon in practice, malicious actors are taking advantage of the anonymity the protocol provides: 17% of the total ECH-enabled sites are risky. Chrome users with encrypted DNS enabled are most at risk.

Findings from the Living With ECH Report include:

ECH could degrade, not improve, privacy: Banks and other regulated entities are often required to monitor the internet traffic going into and out of their organization. To date, these enterprises have been able to selectively decrypt traffic without looking at sensitive data like employees’ health records.

But with ECH blocking their filtering, enterprises would have little choice but to decrypt all internet traffic for inspection, drastically degrading employees’ privacy.

Cloudflare is driving ECH adoption: Cloudflare remains the sole tier-one CDN supporting ECH. Almost all of the sites that are ECH-enabled use Cloudflare infrastructure. Major website owners also seem to be wary of adopting the protocol, concerned that users might be blocked from accessing their services by enterprise security infrastructure or by public authorities.

While ECH reduces the visibility of internet service providers (ISPs) and enterprise security teams, CDNs like Cloudfare can still access data under the protocol.

Malicious actors are taking advantage of Cloudflare: Over 90% of phishing detections use Cloudflare infrastructure, according to Corrata’s analysis. In addition to the anonymity provided by ECH, these sites take advantage of other Cloudflare features.

For example, the “captcha” page can be used to direct desktop traffic to the legitimate site while mobile traffic is sent to the fake one. Alternatively, traffic not coming from the targeted country may be redirected to the legitimate site. These are deliberate tactics to avoid detection by security providers.

Barriers to widespread adoption are high: Widespread adoption of ECH would severely curtail the ability of enterprises to identify and block connections to malicious domains, but industry heavyweights who play different roles and have varied motivations must all support ECH before its use can become widespread. While 20% of devices are configured to use encrypted DNS and DNS resolvers which support ECH, the lack of support from browsers such as Safari and operating systems such as Android make such choices moot.

“The extremely low level of ECH adoption suggests that the security community’s fears that enterprise internet traffic would go dark are not yet being realized,” said Matthieu Bentot, CTO of Corrata. “While the potential certainly exists for ECH to become a thorn in the side of defenders, the early signs are that this is the time to prepare rather than panic.”

The Living With ECH Report is available today.

Research Methodology
Corrata analyzed billions of connections made by devices running Corrata’s threat detection and response solution. Corrata’s software is used to protect iOS and Android devices and is representative of that important segment of enterprise internet traffic. Corrata has visibility of DNS query and TLS connection metadata for all of these connections and tracked the number of successful ECH connections created between January and March 2025.

About Corrata
Corrata provides endpoint threat detection and response for mobile. Our pioneering architecture delivers real-time visibility into threats targeting both iOS and Android devices, without compromising performance or privacy. Corrata software detects and disables malware, blocks phishing attacks and ensures compromised devices cannot access sensitive data.

Corrata has customers across multiple verticals including healthcare, logistics, manufacturing and the public sector and is verified for use with FirstNet, the US Government network for first responders. With deployment in less than 24 hours and seamless integration into your existing security infrastructure, Corrata ensures your mobile environment is no longer your weakest link. Corrata is a proud member of the Microsoft Intelligent Security Association and Cyber Ireland. Visit corrata.com.

###

The post Corrata Report Examines Impact of New Privacy Protocol appeared first on Corrata.

If, like the founding team at Corrata, you’ve been working in the mobile space since the dawn of the smartphone age, you’ll fully appreciate that the most critical messaging channel on a mobile phone is not the email inbox but the messaging client. You’ll also understand that the messaging client has only whatever protection your carrier, Google, Apple, or Samsung choose to provide. And as a mobile security professional you’ll question whether relying on consumer-grade protections is an acceptable strategy when it comes to your organization’s data.

To answer this question it’s important to understand the evolving mobile messaging landscape. Many of you will have heard the announcement from Apple that they plan on enabling interoperability between iMessage and the RCS messaging standard increasingly found on Android devices. The RCS (Rich Communication Services) standard has supplanted SMS and MMS on many more recent Android devices. RCS, while offering a messaging experience more akin to WhatsApp than traditional mobile messaging, has not been without its issues. In 2022 RCS services were halted in India due to a deluge of spam. RCS spam has also recently spiked in the US. In the light of these changes it’s worth reviewing not just the evolution of mobile messaging but also how these changes are impacting it as a threat vector.

In the beginning

In the beginning there was only SMS.  SMS is not an IP based messaging protocol. Instead it uses spare resources on the SS7 layer of the telecommunications network. The Short Messaging Service, to give it its full name, debuted in the early 1990s. Nokia’s implementation of the messaging client was particularly successful and contributed to explosive growth both for Nokia and for SMS. By the early 2000s people were sending billions of messages every year. Each New Year’s eve would bring new records in the number of greetings sent by text, threatening to tear down entire mobile networks in the process.

Initially SMS messaging was device to device. This limited its vulnerability to fraud: there was a physical limit on the number of messages which a mobile device could send. What’s more, per message charging meant that the economics of email spam didn’t apply to SMS. This gradually changed with the growth of application to person messaging (also known as wholesale or bulk messaging). A2P messaging was driven by ringtone distribution and voting on reality TV shows such as Big Brother and American Idol. Wholesale messaging was quickly recognised as a money spinner by mobile carriers who opened up their infrastructure to capture the new revenue streams. The decentralized nature of the mobile telecoms system (there are over 750 mobile carriers worldwide) has made it impossible to block spam and other malicious content. The reality is that there will never be an end to SMS based fraud at the network level.

Enter iMessage and RCS

There is nonetheless reason for hope as new IP based messaging systems developed or delivered by Google and Apple start to grab market share. iPhone users will be familiar with iMessage. Today iMessage only works between two Apple users. Apple users can also use iMessage to communicate with a business (Apple Messages for Business) but such communication must be initiated by the end users.

A newer Kid On The Block is Android’s RCS based messaging system. RCS is an operator developed standard which was designed as an evolution of SMS/MMS. It incorporates richer messaging features such as sending files, engaging in chats and responding with emojis. In other words, all of the features that we know and love from popular messaging applications such as WhatsApp.

Initially, RCS was completely unsuccessful due to a failure by carriers to launch the service. Now Google has taken the lead and has developed a successful RCS ecosystem. Using the Google messaging app, or in some cases the built in messaging app, you can send RCS messages to other Android users. Apple’s recent decision to support interoperability between iMessage and RCS is a game changer though it is unlikely that SMS will ever completely disappear (neither Google nor Apple have any plans to stop supporting it).

Anti-spam/Anti-phishing

Security around the RCS/iMessage environment has a number of important elements. Earlier this year Google introduced end to end encryption for RCS messages sent between two Google messaging clients. Google also verifies senders and filters A2P messages sent via its wholesale RCS Business Messaging (RMB) service. These messages, are not end to end encrypted, allowing Google to examine content for signs of fraud or other mis-use. What’s more in contrast with SMS, with RCS there’s effectively a single gatekeeper on wholesale messaging. Messages for Business is Apple’s equivalent to RMB. Critically, from an anti-spam/anti-phishing perspective, Messages for Business only works where an end user initiates an interaction by, for example, directing a question to an online support chat service.

The other important element is the spam filtering performed by the messaging client. This attempts to filter out spam messages which arrive on the device. Google’s messaging client appears to be very effective in this area. iMessage on the other hand has much weaker capability. And the messaging clients provided by phone manufacturers (which are often the default option on Android) provide only very patchy filtering.

Looking to the future

This of course begs the question as to how malicious messages are still ending up on devices notwithstanding Google inspection of wholesale messages. We believe that cyber criminals are bypassing this control by sending messages directly from devices (or more likely dozens of phones racked). End to end encryption makes centralized scrutiny of these messages impossible. What’s more, because the messages are IP based they cost nothing to send and can be sent in large numbers even without a wholesale connection to the service. For these reasons alone we have to expect that message based fraud will remain a viable option for determined attackers targeting high value opportunities. The publication of pypush, an open source proof of concept library that enables any type of computer to send and receive end-to-end encrypted messages over the iMessage protocol, demonstrates that it will also remain relatively easy to push malicious content into the iMessage environment notwithstanding Apple’s efforts.

The widespread adoption of RCS and its interoperability with iMessage will, we believe, significantly reduce consumer focused messaging fraud. In particular, improved spam filters on messaging clients will reduce the incidence of messaging scams reaching the end user. Ironically this will make the messaging channel an even more attractive option for the kind of targeted phishing attack which we see being launched against high value targets. Ultimately we face a future where messaging spam becomes less prevalent but targeted phishing attacks over the mobile channel remain a serious concern.

The post The most dangerous app on your phone appeared first on Corrata.

The Internet of Things (IoT) has been a game-changer in personal and professional realms. With simple, cost-effective devices, we’re now able to secure our homes, remotely manage climate control, and grant access to facilities: all at our fingertips.

And it’s not just in our homes. The availability of low-cost, wide-area network-enabled sensors and other devices has allowed a degree of optimization and automation that was previously unthinkable except in the most tightly controlled industrial settings. IoT is improving both the performance and efficiency of whole industries, including areas such as agriculture, health care, and logistics. Additionally, it is bringing the era of truly smart cities a step closer.

Shadow IT on steroids?

Yet, as we harness IoT to optimize operations, we face the many of the same challenges we faced with ‘Shadow IT’: the use of IT systems within organizations without approval. This comparison is apt due to several overlapping concerns:

• Lack of oversight: IoT devices are often added to enterprise environments with minimal scrutiny on their cybersecurity implications.
• Cybersecurity neglected: Security measures may be sidelined or overlooked, viewed more as hurdles than necessities.
• Device management is inconsistent: The upkeep of these devices is frequently inconsistent, with many left unsupported or unmonitored.

IoT devices also present challenges unique to their nature:

• Opaque network behavior: Their operations can be difficult to monitor or understand.
• Underestimation of value: They might not be viewed as critical business assets, leading to neglect.
• Background operation: Many devices operate silently in the background, making them easy to overlook.

Generally, anything that lurks in the shadows will present unseen risks.  IoT devices are no different.

The Concealed Dangers of IoT

The growth of IoT introduces compliance challenges as devices handle data interactions with the physical world, which may be secondary to their core function. The implications for data management and potential vulnerability to tampering are significant, with security often taking a backseat to functionality.

While IoT devices are marketed for their ease of use, this convenience can be a double-edged sword. Simplified setups can inadvertently make it easier for attackers to exploit vulnerabilities. It is hard to make software easy and convenient for legitimate uses without also making it easy and convenient for an attacker to achieve illegitimate ones.

And so we regularly come across apps controlling IoT devices over unencrypted connections using hardcoded default credentials.

For instance, consider this security camera setup:

GET /web/ HTTP/1.1

Host: 192.168.1.200

User-Agent: Mozilla/5.0 (X11; Linux ×86_64; rv:60.0) Gecko/20100101 Firefox/60.0

… [rest of the headers] …

Authorization: Basic YWRtaW46YWRtaW4=

Connection: close

Turns out that the “Authorization” code above is simply admin:admin in Base64.

This directly leads to the usual issues: an attacker could add the device to a BotNet, take control of it and abuse its hardware components, or access or compromise its data. An attacker could also use the device as a stepping stone into other internal systems or devices. What’s more, having such hard-coded credentials makes it difficult to patch security vulnerabilities without breaking the device.  As a result many IoT devices are poorly maintained. 

A real-world concern arises when enterprises lose sight of their IoT devices. Without regular maintenance, these devices can become sleeping security timebombs. We’ve encountered organizations with numerous IoT devices running unchecked due to uncertainty about their function and location: posing serious cybersecurity risks.

As we integrate more IoT devices into our daily lives and workspaces, it’s crucial to be proactive in understanding and mitigating the risks they pose. A holistic approach to IoT security can help ensure that we reap the benefits without compromising safety.

Embracing IoT with Awareness

IoT technology is forging our future, introducing interconnectedness that must be managed with caution. These devices should be treated with the same security rigor as computers, with dedicated policies for consistent updates and monitoring.

As IoT’s ecosystem flourishes, keeping abreast of technological vulnerabilities is as crucial as celebrating innovation. A commitment to continuous education and vigilance will enable organizations to benefit from IoT without sacrificing security.

In conclusion, integrating IoT into enterprise systems demands a balanced approach: valuing innovation while upholding strong security standards to avoid the pitfalls that accompany these advanced technologies.

The post IoT – Shadowy Things ? appeared first on Corrata.

Last year, Meta disclosed that the hacker group Bitter APT had embedded their Dracarys malware into fake versions of Signal, Telegram and Whatsapp. Corrata has also encountered similar malware in the wild. And more recently, researchers at ESET discovered trojanized versions of Signal and Telegram on Google Play and in the Samsung Galaxy Store. 

What’s Happened?

These malicious apps, named ‘Signal Plus Messenger’ and ‘FlyGram’, were embedded with the BadBazaar spyware and were uploaded by a Chinese APT hacking group known as GREF. Initially, this malware targeted ethnic minorities in China, but recent data indicates that users in countries including Ukraine, Poland, the Netherlands, Spain, Portugal, Germany, Hong Kong, and the US are now being targeted.

The spyware’s capabilities are extensive, ranging from tracking device locations, stealing call logs, SMS, recording phone calls, to exfiltrating contact lists and files. The malicious versions of these apps have novel features that allow attackers to link victims’ Signal accounts to their own devices, enabling them to monitor all future messages. Both malicious apps (FlyGram and Signal Plus Messenger) have been removed from Google Play and Samsung Galaxy Store but are still available from 3rd party sites. 

The Hidden Threat: Trojanized Messaging Apps on the Rise

As you can see above, hackers are successfully deceiving users into downloading counterfeit versions of popular messaging apps. These imposter apps have been ‘trojanized’, meaning they contain concealed malware within what appears to be a safe application. At first glance, these apps might seem appealing due to additional features not present in the standard versions. However, the hidden malware can pilfer a broad spectrum of data, including the messages themselves.

This type of attack is possible because of a key aspect of internet applications: the application developer may control the back-end but ultimately cannot fully control the front-end application.  This is true whether the user is accessing the application via a browser or a mobile app.  

The end-user has control over the software running locally (i.e. the mobile app or the browser). This is fine if the app is the legitimate version, but if the user has downloaded a fake version, the owner of the legitimate service (e.g. WhatsApp) has no way of knowing this. 

Why is this Alarming?

Given the sensitive nature of information shared over these messaging platforms, the risks associated with using a malicious version are immense. This concern is magnified when you consider that employees often use these apps for work-related communication.

Attackers typically take the source code of legitimate apps like Signal and layer on additional features that serve dual purposes:

1. Attracting users with enhanced features.
2. Granting malicious capabilities to the hacker.

With this malicious layer, attackers can:

• Link other devices, maintaining persistent access even after the malicious app’s removal.
• Leak data from the account.
• Perform on-device malicious actions, such as accessing files, location, and messages.
• Often grant extensive permissions to legitimate apps. For instance, WhatsApp requires access to photos, videos, in-chat media, and user location. Malware often manipulates users into granting these permissions, especially when the app appears legitimate.

The Bigger Picture

While these attacks are often targeted at consumer applications such as the ones named above, there’s no barrier preventing business tools like Slack, Teams, or Outlook from being trojanized similarly. Signing into these compromised apps could grant attackers access to company data, credentials, and authentication tokens – see here. The “Adversary” in this case is not traffic-level eavesdropping but on-device eavesdropping.

Mobile users are advised to always take care to download only the official versions of apps and to steer clear of third-party versions that claim to offer enhanced features, even if they are available on official app stores.

How to protect your organization

Robust defense against such threats consists of three elements:

• Firstly, make sure that your mobiles are prevented from accessing websites which host malware. 
• Secondly, ensure that your employees’ devices are continuously scanned for potentially harmful applications and 
• Thirdly, monitor traffic to and from employee devices to detect communications with Command and Control (C2) servers and other suspicious traffic.

The simplest way to provide these protections is to deploy a mobile threat defense solution to your employee devices. The right solution will provide the necessary protection while being easy to deploy and manage and avoiding the need to collect employee personal information. 

The post Deceptive Downloads: The Silent Menace of Trojanized Messaging Apps appeared first on Corrata.

As a CISO, Security Architect, Risk Manager or Security Analyst, it’s your job to identify the best way to mitigate information security risk within your organization. Sometimes this will involve implementing a technical solution to protect against a new or growing threat. You will have come to this decision after examining the range of alternative approaches to addressing the threat and, in the case of a technical solution, having assessed multiple vendor offerings. 

But for many, this is the easy part. It’s essentially a technical issue, a question of diligence and expertise, likely conducted with peers who share your deep understanding and engagement with cybersecurity risks and technologies and the tradeoffs involved in any such decision. Now the time comes to bring your proposal to the upper management, perhaps the executive team or the Board. Now you need to articulate in terms that the non-technical will understand why your organization needs to spend time, money and resources on the project, aka – make the business case.

What then is the business case for investing in mobile endpoint security?

Why we need a mobile endpoint security solution now

The first question you must answer is, ‘Why now ?’ In other words, what has changed in the information security environment that makes it urgent to implement mobile endpoint security today? After all, employees have been using smartphones since the advent of the iPhone.

The reason why mobile endpoint security is a business priority today is straightforward. The move to cloud means that mobile users now have access to the same business systems that are available on traditional laptops and desktops. In the past, laptops and desktops had access to a much wider range of applications because they were joined to the corporate network either directly or through a VPN. Today that distinction is disappearing: all devices access cloud or SaaS applications on the same basis. 

This gives us our first argument for the need for mobile endpoint security:

“More and more of our business applications will be accessible directly from our employees’ phones and tablets:

– We are now using the Microsoft 365 suite, including Outlook, Teams, OneDrive, Word and Excel, all of which are accessible from employee mobiles.

– In the last two years, the organization has adopted a wide range of SaaS applications.

– We expect that the number of SaaS applications used by the business will continue to increase.”

Parity of protection

Your senior management is very aware that the organization has a range of security solutions in place to protect traditional endpoints. What they may not appreciate is that these solutions do not operate in the mobile environment. Web content is not filtered, mobile phishing messages are not blocked, and phones are not scanned for malware infection. 

This leads us to the second argument in support of mobile endpoint security – parity of protection:

“While we have an endpoint security solution deployed on desktops and laptops, we don’t have an equivalent protection on employee mobile devices. This means we have no protection against malicious content, phishing over sms and other messaging applications, and mobile malware.“

Mobile Devices are not invulnerable

85% of mobile phishing attacks are outside email. SMS, WhatsApp, and other messaging, social and collaboration platforms are all being targeted with increasingly sophisticated phishing attacks.

Based on data from the hundreds of organizations using Corrata, we know that most employees receive a mobile phishing message at least once a month. We also know that one in five devices have poor security configuration, making them susceptible to malware infection. And one third, access websites with weak encryption leaving employees exposed to data loss. Nothing in your mobile device management system addresses these threats. 

This leads us to the third argument in support of mobile endpoint security – heightened risk:

“There are a range of risks which are not addressed by the built-in security on iOS and Android or by our mobile device management system. These include:

– Targeted phishing attacks sent directly to mobiles over SMS, Whatsapp, Slack and other messaging and collaboration platforms.

– Attacks which bypass our multi-factor authentication by stealing authentication cookies. A successful attack would allow unauthorized access to our business systems over a prolonged period.

– Malicious software which allows attackers to read messages and other content sent to and from our employees’ phones.

– Poor encryption of data in transit leading to unauthorized disclosure of company and customer information sent to and from mobile devices.

– Non-compliance with acceptable use policy which restricts access to inappropriate content

– Failure to keep phone software up-to-date and other poor security configurations.”

How mobile endpoint security helps

You’ve made a strong set of arguments for the need to do something about the mobile security gap. You now need to introduce the solution. This means explaining what a mobile endpoint security solution will do. In doing this, it’s important to remember that your audience will assume it’s like the endpoint security solution with which they’re familiar – this might be a traditional anti-virus solution or a more modern EDR solution. Mobile endpoint security incorporates virus scanning and malware detection and response but also next-generation firewall, web-filtering, and anti-phishing features:

“The mobile endpoint security solution we’re proposing will protect us by doing the following:

• Blocking links to phishing sites, malware download sites, sites which are contrary to our acceptable use policy, and other malicious sites. It provides the equivalent of the web filtering we currently have on our desktops and laptops.
• Detecting any malware present on a device. Any device with malware installed is automatically prevented from accessing our business applications. This is equivalent to the [anti-virus, endpoint protection, or endpoint detection and response] software on our laptops and desktops.
• Preventing any data being sent to or from our phones without proper encryption. This ensures that our data cannot be snooped on by bad actors monitoring WiFi or other networks. This is equivalent to the protection provided by using a VPN.
• Assigning a security score to each device. Employees are prompted to keep their devices up to date, to remove any risky applications, and to correct any poor configurations. Devices with low scores can be automatically prevented from accessing business applications. This is equivalent to features provided by our endpoint protection software on laptops and desktops.”

No negative impact on employees

Having convinced your executive team of the need for a solution and the practical protections it will deliver, your final step is to address two common objections. The first relates to employee acceptance. Your senior managers will be only too aware that employees don’t like being surveilled. They also love their phones and don’t want anything interfering with the smooth functions of their devices. So it is important to be able to reassure your executives that the solution respects employee privacy and does so in a transparent and easy-to-communicate manner.

This means a solution that doesn’t track location, scan images or other content, read messages, or record browsing history.

You should also be able to offer the reassurance that your chosen solution runs unobtrusively in the background without impacting the normal operation of the device. Employees are only required to interact with the app in the rare case that their manual intervention is required to resolve a security issue.

Easy to deploy and needs little ongoing management

The second concern will be around the impact on the, undoubtedly stretched, security operations team. The good news is that mobile endpoint security focuses on preventing attacks: blocking phishing and malware download sites, preventing unencrypted communications, and disabling malware. Alerts and escalation requirements are generally minimal, and mature solutions will integrate with your existing security operations stack. 

The final clincher: quick and easy to deploy (and hence no upfront professional services costs), a single all-inclusive annual fee with no hidden extras.

In conclusion: you should approach your senior management with confidence. Mobile Endpoint Security is a cost-effective, easy to deploy and manage technology which addresses a gap in your defences which, unless addressed, will only get larger.

Best of luck! 

The post Making Your Case appeared first on Corrata.

Last year we reported that poor security configuration on a number of popular websites (including the German tabloid Bild, Spanish banking group Santander, and Irish telecommunications provider Eir) left visitors accessing the websites vulnerable to hacking. The issues we uncovered related to the way in which Transport Layer Security (tls) was implemented on these sites.

Today the vast majority of websites use encryption to ensure that sensitive data exchanges between users and the website remain confidential. This confidentiality depends on the use of an internet protocol known as Transport Layer Security (tls). Https is the implementation of tls used when browsing websites. Its use is traditionally signaled by the appearance of the lock symbol at the top left-hand corner of the browser address bar. A misconfiguration meant that visitors accessing the site with iPhones or iPads used out-of-date tls code or cipher suites, which meant that their communications with the site, though ostensibly secure, were, in fact, vulnerable to interception and manipulation (Interestingly, Google recently announced that it would no longer use the lock symbol – read more here).

Poor Encryption & Practices

You could, of course, argue that in our previously documented cases, at least the data had been encrypted, albeit poorly. More recently, we have uncovered cases of users being asked to submit data to websites without any encryption at all. One such case involving telecommunications provider Eir, is described in detail in this incident report. (Following our disclosure of the vulnerability, Eir promptly resolved the issues). The link to the offending page originated in an account-related email. Not only was the link to an unencrypted page, but the site failed to redirect the user to an encrypted version, potentially allowing a malicious actor to impersonate the Eir site. In addition, the page prompted the user to enter an email address. If this email address is related to a valid Eir account, the response provided details relating to the account in plain text.

Eir are not alone: a number of other high-profile websites and applications display similar weaknesses. 

As we encounter these poor encryption practices, we report the issues to the website or application owners in line with our responsible disclosure policy. This enables those responsible to rectify the problem and safeguard users.

The issues we have uncovered relate to the failure to use encryption on pages where customers are asked to upload personal information. This matters because, in today’s cloud computing era, we all place huge reliance on tls to ensure that our internet communications remain confidential. In fact, we have come to expect this and act accordingly. Google reports, for instance, that 97% of traffic in the US using the Chrome browser is encrypted. 

So today, users would be excused for not double-checking a site to confirm that it is using tls on all data input pages.

Full Protection with Benefits

Corrata does not routinely scan websites looking for poor or absent encryption. The discovery of these incidents is a by-product of the security we provide to our customers. When our mobile security product is installed on a device, it continuously checks for vulnerabilities, disables malware, and blocks access to phishing sites and insecure communications. Over the last 18 months, we’ve introduced new features which check for poor encryption and identify attempts to upload data without encryption. Our customers can configure Corrata to prevent the transmission of sensitive information over such vulnerable channels, keeping personal and corporate data safe from interception.   

It’s important to grasp that, when data is sent over the internet unencrypted, in ‘plain text’, or poorly encrypted, it’s susceptible to being read and manipulated by anyone else on the network. The era when the vast majority of sensitive organizational data traveled over networks under corporate control has long passed.

In today’s cloud-centric world, security professionals are acutely aware they must build security on the basis that much of their organizations’ information will routinely traverse networks which are fundamentally insecure. The rapid adoption of SaaS and the internet enablement of in-house applications means more and more data is exposed to the risks that these networks present. Given this reality, adopting technology that keeps your data safe regardless of the quality of protection offered by your service providers is critical.

The post Popular Websites Failing To Protect Data Uploaded By Customers appeared first on Corrata.