Cyber Threats To Mobile Messenger Apps From Identity Cloning

Abstract

People enjoy connecting to the Internet outside of their homes and offices, due to technological innovations and the convenience. With smartphones and other mobile devices giving us the ability to conduct everyday activities such as mobile banking, online shopping, and social networking, cyber criminals are constantly looking to take advantage of insecure wireless networks, third party applications, and texting to your personal information, steal your identity, or read personal e-mails and work documents. Such cyber threats become very high, in particular, with Android apps since they are structurally easy to rebuild, to modify or inject arbitrary code. When an adversary has victim's credential files in a local device, this vulnerability becomes more solemn. While the adversary can bypass all applied security techniques and forge an identity completely, he can do everything that victim can. If a mobile messenger app was selected as an attack model, the adversary is able to not only view chat history and timeline records of a specific user but to also receive or send messages in real time. In this paper, we analyze the security weak points of representative Android message apps and prove this is realistic threat in cyber defense. We then propose alternative solutions against this attack.