A new report has highlighted the threat malicious apps pose to people’s data and money.
The National Cyber Security Centre found that hundreds of thousands of people may have been left exposed by fraudulent apps containing malicious malware created by cyber criminals, plus poorly developed apps which can be compromised by hackers exploiting weaknesses in software.
It said that while millions of people use apps every day to shop, bank and make video calls, there are few rules governing the security of the technology or the online stores where they are sold.
To provide better protection for consumers, the government is launching a call for views from the tech industry on enhanced security and privacy requirements for firms running app stores and developers making apps.
Under new proposals, app stores for smartphones, game consoles, TVs and other smart devices could be asked to commit to a new code of practice setting out baseline security and privacy requirements. The government said this would be the first such measure in the world.
Developers and store operators making apps available to UK users would be covered. This includes Apple, Google, Amazon, Huawei, Microsoft and Samsung.
The proposed code would require stores to have a vulnerability reporting process for each app so flaws can be found and fixed quicker. They would need to share more security and privacy information in an accessible way including why an app needs access to users’ contacts and location.
Cyber Security Minister Julia Lopez said: “Apps on our smartphones and tablets have improved our lives immensely – making it easier to bank and shop online and stay connected with friends.
“But no app should put our money and data at risk. That’s why the Government is taking action to ensure app stores and developers raise their security standards and better protect UK consumers in the digital age.”
The NCSC report found all types of app stores face similar cyber threats and the most prominent problem is malware: corrupted software which can steal data and money and mislead users.
For example, last year some Android phone users downloaded apps which contained the Triada and Escobar malware on various third-party app stores. This resulted in cyber criminals remotely taking control of people’s phones and stealing their data and money by signing them up for premium subscription services without the individual’s knowledge.
The NCSC report concluded that the government’s proposed code of practice will have a positive impact and reduce the chances of malicious apps reaching consumers across different devices.
NCSC Technical Director Ian Levy said: “Our devices and the apps that make them useful are increasingly essential to people and businesses and app stores have a responsibility to protect users and maintain their trust.
“Our threat report shows there is more for app stores to do, with cyber criminals currently using weaknesses in app stores on all types of connected devices to cause harm.
“I support the proposed Code of Practice, which demonstrates the UK’s continued intent to fix systemic cybersecurity issues.”
The code follows a government review of app stores launched in December 2020 which found some developers are not following best practice in developing apps, while well-known app stores do not share clear security requirements with developers.