Slashdot Mirror
Android iBanking Malware Still Fetches $5,000
itwbennett (1594911) writes "Symantec and RSA published details on their blogs on Tuesday about the iBanking Android program, which is being used by two Eastern European cybercrime groups to intercept one-time SMS passcodes used for logging into bank accounts. IBanking's source code was leaked in February, which should have caused its price to drop. But its developer has continued to develop iBanking and provide support, and the malware is still commanding $5,000 per copy, one of the highest prices seen for a type of malware, according to research from Symantec."
IBanking sells for around $5,000 or for a cut of the proceeds from theft it facilitates, Symantec wrote.
Like all these stories, $5,000 may be the "sticker" or asking price. How many sold at this price or at any price is the important metric.
I've archived a download of the software here
"First they came for the slanderers and i said nothing."
I cannot speak for this special case, since I lack the detailed info, but in general, those 5k bucks usually give you more than just the program. Such groups usually sell the whole package, including servers, server software, malware and for a little more money also a spam service to carpet bomb mail addresses with the malware spam.
In other words, you needn't be in any way apt with computers to commit "cybercrimes" anymore. You can get the "for dummies" package, including detailed step by step instructions how to use it.
Why those groups don't simply do it themselves and sell it instead? First, it's more profitable. And second, it's legal (for them at least, might be different in your country) to sell the software, but not to use it.
I don't know why, but it does start to remind me of drug cartels.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I've always thought tying accounts to your phone, via SMS or Phone number was a really dumb idea. Especially when the pervasive attitude is for apps to collect as much information about you as possible and read text messages. Combined with the fact that phone numbers are moved and traded all the time from person to person... Just a bad idea overall in my opinion.
Hello,
The ITWorld article didn't mention it, so here's a link to the actual write-up on the bot, which is actually called Android/Spy.Agent.AF: Facebook Webinject Leads to iBanking Mobile Bot.
Regards,
Aryeh Goretsky
Dexter is a good dog.
According to the article, the victim has to install an app from a pop-up. If the user leaves "Unknown sources" turned off, the user can't get infected. I imagine that most people in the western world who turn on "Unknown sources" are users of third-party marketplaces that require "Unknown sources", such as Amazon Appstore or F-Droid. In order to get infected, you have to 1. turn on "Unknown sources", 2. forget to turn it off after you're done installing or updating apps from a third-party marketplace, and 3. install an apk file linked from a pop-up (source: the featured article by Symantec). If you're dumb enough to do #3 on your phone, you're dumb enough to do the same thing on your desktop, even if it does run GNU/Linux.
It's a social engineering exploit to get people to install an executable from a pop-up advertisement. OS X has exactly the same vulnerability unless you set Gatekeeper to "Mac App Store only".
Dolphin Browser shit (it was reporting sites you visit to their ad server) affected both Android and iOS, however:
1) Media only talked about it affecting Android
2) It were actually Android users, who checked and caught it