By Jan Sysmans, Mobile App Security Evangelist, Appdome
Whether verifying the location for a streaming subscription or seeking assurances on banking transactions, ensuring the accuracy of mobile device location is essential in today’s mobile environment, especially in a mobile-first economy like India. Simply put, without reliable location data, mobile brands won’t be able to ensure that their mobile applications operate securely and legally. This is particularly pertinent to India, where the Future Crime Research Foundation found that nearly three in four cyber crimes recorded between 2020 and last year involved fraud.
Not only does this jeopardise user privacy and raises the ire of regulators, it also hampers anti-fraud measures. Compliance with geographic regulations needs to be integrated into the business model of mobile brands to ensure the integrity of in-app transactions, transaction traceability, and other “Know Your Customer” (KYC) requirements. This will enable them to offer new services and personalised offers while meeting regulatory standards.
Further, with the proliferation of dating apps, e-wallets and other banking apps that use personal information, geo-location compliance is central to identity verification and ensuring users are where they say they are. This is immensely important to user privacy and safety – especially with catfishing, stalking, fake accounts or other campaigns to steal money or extract personal information from victims.
For businesses and mobile apps that need to ensure accurate location information, the reliance on data provided by the mobile device is a major hurdle. That’s because, despite billions of dollars spent by the mobile OS and device industry, bad actors are not short of tools to manipulate location information. From fake GPS apps to unauthorised VPNs and SIM swapping schemes, to name a few, mobile app brands have their work cut out for them.
Clearly, brands and developers require a better way to ensure the authenticity of location data. Instead of relying on overlay networks of geolocation with complex SDKs and third-party network connections to apps, brands should trust the OS/device maker. Leaving behind this complexity allows the focus to be shifted to in-app compromises. However, this pivot rests on having a greater array of signals not only for location but also other potential attacks against mobile apps, to get a unified picture of mobile app security – which is not available from geo compliance point products.
A robust, unified geo compliance solution can:
Stop GPS spoofing – Signals or sensors can be manipulated to provide false location data, compromising app functionalities or impacting app monetisation. Detecting this hinges on the ability to scan for and respond to installed hooks to ensure users’ mobile apps remain safe against GPS spoofing.
Block fake GPS apps – Through fake GPS apps, attackers can manipulate location data by setting the location provider outside the control of the authentic location provider. This allows them to engage in location spoofing, license control bypass, and evasion of geo-fencing requirements, which may be tied to compliance requirements or critical to the app’s business model. However, a unified geo compliance solution offers the power to block the use of fake GPS apps, ensuring the accuracy of location-based services.
Halt unauthorised use of VPNs – Unified geo compliance solutions can detect the use of untrusted VPNs on the app, so when traffic is rerouted, app makers can respond in compliance with regulations, enforce geo-restrictions, prevent piracy, and meet KYC requirements.
Detect intricate teleportation attacks – A geo compliance solution that enhances visibility, adds an additional layer of defense. For instance, abnormal patterns in GPS data, such as the device appearing to travel between improbable locations – think Mumbai to Silicon Valley within minutes – will raise alarms. Likewise, it also enables mismatches in location telemetry to be identified.
Spot banned locations – While alternative apps stores and location circumvention devices make it difficult to enforce restrictions in specific geographies, a robust geo compliance solution enables whitelists or blacklists. Brands can then realise a superior and more cost-effective approach to solve geolocation challenges as well as provide additional defenses and central monitoring visibility of threats and attacks in production apps.
With threat actors becoming more sophisticated, it is high time that organisations leverage a unified geo-compliance solution. This will equip them to empower intelligent automation, raise visibility, and save costs by eliminating complexity, which all amounts to greater chances of raising cyber resilience.
