Slashdot Mirror
Android Banking Trojan Masquerades As Flash Player, Circumvents 2FA
A newly found Android trojan is targeting customers of large banks in Australia, New Zealand and Turkey. The banking malware, flagged as Android/Spy.Agent.SI by ESET security firm, disguises itself as Flash Player and spreads via unofficial app stores. It can steal login credentials of users from 20 mobile banking apps, and can also mimic login screens of popular services such as PayPal, eBay, Skype, WhatsApp and several Google services. The Android trojan is able to intercept SMS communications, which in turn, allows it to circumvent the two-factor authentication.
How can an app actually intercept SMS? Is this common on the Android platform, that apps can intercept that kind of deep system stuff?
8 of 13 people found this answer helpful. Did you?
Where can I get this?
My thought exactly.... they had a lucky escape and only installed a banking trojan!
Devices have been 'pwned' before but it seems to be escalating, as malware used to just do 1 or 2 related malicious things (ad redirects/BHOs/ad banner replacements etc.).
I'm waiting for ransomware to hit mobile. "Oh you want to make phone calls? $20 to unlock that functionality. Browse the web? $20. Use apps? $20. Once you talk to your bank for 3 hours and get your money back, send the bitcoins to this address." It'll be cleverly priced at less than the cost of a replacement phone (maybe first determining the phone model) or the price of having it serviced by the manufacturer, or insurance deductible.
Other mobile ransomware might present itself as a message from your carrier: "Hey you're overdue. We're shutting off stuff until you pay up; click here to set up payment." and sure enough their data/voice/SMS are cut off aside from the 'convenient payment app'. It will probably be timed to activate at the beginning/end of the month, like when a bill would be due. They don't have to receive the money directly, the malware can fill up some 'legit' account (Xbox FIFA cards or whatever) in the background using the payment info, which the ransomers then access and drain.
I have a feeling Google tacitly allows Android's design to be pwnable, so that the Play store vetting is the only thing stopping your device from getting malware; discouraging use of 3rd party stores/piracy increases sales on their store (and thus them getting a cut) an amount probably greater than zero. The question is, is the bad publicity of malware bad enough to drive enough people to Apple that they lose more Play store sales than they gain?
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
"Android trojan .. disguises itself as Flash Player and spreads via unofficial app stores"
It would be a real story if this Android 'banking trojan silently installed itself without the end user taking action. This kind of non-story belongs over on the Microsoft Register.
Does it play Flash or not?
Rome taught me patience and assiduous application to detail. Virtues which temper the boldness of great, general views.
Actually *NOT* playing flash (even more so flash ads) would be a *positive* feature.
Almost redeeming its trojan-ness.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"spreads via unofficial app stores"
So... if you use the official Play store you're not going to be exposed to this?
What exactly are the benefits of using an "unofficial app store"? Pirated apps? Apps the Play store won't carry? Because all I've seen about the "unofficial" ones is they seem to be a major source of malware.
Why are those that we trust with our finances allowing funds to be transferred without live, in person, face to face interaction? It's not like none of us could go to the local branch verifying our identity right? Money is all about trust after all.
Time is what keeps everything from happening all at once.
Android
XPrivacy does exactly this, but AFIAK, it doesn't work well with Android 5 or newer. There are a lot of applications which ask for everything. For example, the Cracked app used to demand access to the GPS, even though all it just did was be a shell for Web content.
Another app that fetches everything is Yik Yak. It goes through the phone to find any individual IDs it can, so it can permanently tie an "anonymous" ID to the phone and the person.
Location data isn't too hard to fake. Enable mock locations... done. However, stuff like slurping contacts, SMS records, advert IDs, and other items, needs something like XPrivacy, DonkeyGuard, or something decent like that.
Yet another reason why Adobe Flash should die a much faster death.
"Imagination is more important than knowledge" - Einstein
It's not really two-factor if one of them comes from the same machine being used for access.
"The banking malware ... disguises itself as Flash Player..."
That's funny, usually it's the other way around.
Just cruising through this digital world at 33 1/3 rpm...
"Android trojan .. disguises itself as Flash Player and spreads via unofficial app stores"
It would be a real story if this Android 'banking trojan silently installed itself without the end user taking action. This kind of non-story belongs over on the Microsoft Register.
This is the Iphone defence.
Yep, this is exactly the excuse that Iphone users use to dismiss security issues bought on by jail breaking and Cydia.
Getting the user to install malicious software has always been and will always remain the most effective way of spreading it. Doesn't matter what the platform is and in the end, there is only so much you can do to protect stupid people from themselves.
Calling someone a "hater" only means you can not rationally rebut their argument.
Ladies and gentleman ... The above is a classic example of someone who either has no idea what they are talking about, or someone who is intentionally spreading misinformation. Rest assured that "SMS + Password" is indeed 2 factor authentication, regardless of which system is used to enter the password / secret.
The AC seems to think that physical possession of the smartphone somehow magically conveys the other factor (the password.) Clearly it doesn't.* The first factor is the possession of the phone (something you posses). The second is the entering of a secret (something you know). Since possession of the phone doesn't automagically help an attacker know the secret, the fact that I happen to use my phone to enter the secret rather than a different computer system is entirely immaterial.
* This clearly assumes that the smartphone owner doesn't choose to "Save Password" for the respective content / service provider(s).
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
FTFY
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
That isn't true. See also. . No need to reply ... Apology accepted.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
You are an idiot who doesn't have any idea what he is talking about. That would be bad enough on its own, but I just got done explaining to you why you are a clueless idiot. The fact that you can't figure it out even after it has been explained to you is pathetic. Let me try to explain it to you again. Dear moron: The phone is something you have. The password is something you know. When taken as an aggregate that's two factor auth. Period. Your belief that it matters haw the second factor was communicated is a direct indication of your complete lack of understanding of computer security. Off you go now rank amateur.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun