Security concerns related to Pokémon Go are nothing new – but in addition to existing problems regarding user privacy, the game could also leave its players vulnerable to malware, a new blog post by data protection software firm Proofpoint warns.
The company recently conducted a study of security vulnerabilities related to Pokémon Go, and discovered at least three malicious versions of Pokémon Go in U.S. app stores and more than 150 fraudulent social media accounts related to the game, according to the Sept. 7 post.
Proofpoint emphasized that neither developer Niantic, which has warned users against downloading add-on map apps that plunder their servers for data, nor Pokémon Go’s 500 million-strong user base, are to blame for its discoveries.
“Pokémon Go serves as a ready example of the ways in which cyber attackers will use popular phenomena to go after new targets,” Proofpoint staff wrote. “Cyber criminals are bringing a full suite of attacks to the table with Pokémon Go, from compromised apps to fraudulent social media sites and phishing social posts that lead to more mobile malware – the list goes on.”
The security risks uncovered by Proofpoint could affect not only Pokémon Go players, but many of the businesses employing them, since the company also found that 4.5 per cent of the devices across the organizations it surveyed had Pokémon Go installed, including a small number (four per cent) that were running early versions of the game with no patch for its well-publicized Google permissions issues.
And while the malicious versions of Pokémon Go are a legitimate concern, Proofpoint’s discoveries on social media were arguably more frightening: its researchers found 543 social media accounts related to Pokémon Go across Facebook, Twitter, and Tumblr – and of these, 167, or more than 30 per cent, were fraudulent:
- 44 had links to download files claiming to be support material such as game guides, maps showing Pokémon locations or even Pokémon Go itself;
- 79 were imposter accounts;
- 21 promised “free giveaways.”
But even these accounts are only the tip of the iceberg when it comes to the risks, scams, and malware that users face as they search for rare Pokémon locations, power-ups, or tips for capturing obstinate orange-banded Pokémon whenever they find them, Proofpoint wrote, noting that the malicious software associated with them can affect both mobile and desktop platforms.
“While even the developers of the app initially struggled with excessive permissions on Google accounts, the real challenges now are for organizations potentially exposed to malware and risky apps widely distributed through social and mobile channels,” the company wrote. “Individuals as well must exercise caution as they interact with wider communities related to Pokémon Go, as the potential threats peripherally associated with this app are diverse and numerous.”
For example, the fraudulent Facebook page below links users to a download of the Downware Trojan, while the second leads them to download Android APKs
Naturally enough, the company recommends using its own Mobile Defense software to protect users against this malware, whether it comes from app stores, social networks – or Pokémon Go.
