Slashdot Mirror
Android Trojan Steals Money From PayPal Accounts Even With 2FA On (welivesecurity.com)
ESET researchers have discovered a new Android Trojan using a novel Accessibility-abusing technique that targets the official PayPal app, and is capable of bypassing PayPal's two-factor authentication. A report elaborates: At the time of writing, the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores. After being launched, the malicious app terminates without offering any functionality and hides its icon. This video, courtesy of ESET, demonstrates the process in practice.
PayPal still sends you codes by SMS, so of course any software on your phone that can intercept SMS messages can read them. They don't seem to support U2F at all.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Who needs PayPal, anyway?
Canceled years ago because they made yet another change to their terms and conditions and and all the embedded documents in the EULA after a few days or whatever.
I actually read them - once.
In a nutshell it states, 'we're gonna fuck the seller and then the buyer but we, PayPal will never take a hit. Fuck you ; pay me! Got a problem with that? Come to California, use our arbitration firm and Fuck you!'
2FA has always been just an excuse for them to get people to surrender their phone numbers and other private information.
Phone numbers are less likely to change and can more or less uniquely identify a person. Sell phone number information to 3rd parties and those 3rd parties can easily identify other services that you use and create profiles on you.
It’s twice the same factor! Just with one a bit disguised.
While the point of 2-factor is to have two DIFFERENT factors.
I have yet to see a mainstream service that used actual two-factor auth. Let alone 3-factor, how it should be.
Seriously, it's been obvious for years that PayPal was adding risk to transactions and that those victimized had little or no recourse.
For this alone, I hope Elon Musk and Peter Thiel both get terminal cancer.
There is a very easy fix for this but hardly anyone ever tries it. Check the FAQ on the android app deployment tutorial. Itâ(TM)s very easy. Something like filling in all the optional xml attributes in the manifest.
Now it really sucks that I cannot use my iDevice to play game ROMs emulate PC's or have my own programming language so I can use my phone as a personal computer with a tiny screen.
However the apps for the device, I download for the most part usually work well, and are not malware.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
This symptom happens a lot in android with apps designed for previous versions. Google changes something in the core activity/intent lifecycle and apps break for apparently no reason.
If one is going to develop for Android then they have to take that into consideration because it's on YOU in the end.
I WAS a Developer on the OS/2 for Windows team in the early 90s and I KNOW what it's like to have shit break on you ...because. But it was on us - regardless of what IBM Marketing said.
Also, if the Android team is making such changes like that where app developers can't keep up for whatever reason, I'd put much of the blame on the Android team.
Never the less, the pointing fingers bullshit doesn't do anything for the consumers who are the victims. Their only choice is to say, "fuck Android anything. If I want a smartphone, I guess it's Apple and re-mortgaging my house to buy a phone."
Jesus Christ, I almost miss the days of $3,000 IBM PCs running DOS.
I'd say, "get off my lawn" but I'm in a home and it's banana pudding and pizza day and there's Matlock marathon on!
Still better than iPhone which steals all your money at purchase
The same is true for Android. The apps I download for my Android device, for the most part usually work well and are not malware. I think we're just seeing the effect of Android's 88% market share vs iOS's 12%. Even if there's the same amount of malware for each OS, it has 7x the impact on Android so there are 7x as many news stories about it. And malware authors get 7x the return on investment attacking Android than they do iOS, so even if all other things are equal they're more likely to target it.
Obscurity is not security.
These exploits almost always require extra steps to get the offending app installed.
"At the time of writing, the malware is masquerading as a battery optimization tool, and is distributed via third-party app stores."
Keep the Classic Slashdot.
First Problem: "At the time of writing, the malware is [...] distributed via third-party app stores." I searched Google Play and confirmed it's not listed. Your average user doesn't even know third-party app stores exist.
Second Problem: "[The malware sends a request that] is presented to the user as being from the innocuous-sounding 'Enable statistics' service." The screen states that the service will "Observe your actions: Receive notifications when you're interacting with an app" and "Retrieve window content: Inspect the content of a window you're interacting with." Do the authors know the definition of the word innocuous? Because those permissions do not seem to fit the standard definition. At a minimum, it reads like spyware.
Third Problem: The "PayPal" alert that appears is identified in the notification as "Optimization Android," not "PayPal." If you're wandering around third-party Android app stores, you should be knowledgeable enough to recognize this. I don't wander around third-party Android app stores, but if I receive a notification I'm not expecting, I *always* check the source at the top of the notification.
So, if I manage to download a "battery optimization" app from somewhere other than the Google Play store and then enable what reads like spyware and have PayPal installed and decide that it's completely okay/normal for PayPal to coincidentally alert me to confirm my account right after agreeing to spyware privileges, I'm at risk.
Also, it seems like this is not just a PayPal issue, but a "user giving too many privileges to an app" issue since TFA shows the malware's phishing screen overlays for Gmail, Google Play, WhatsApp, Viber, and Skype. And, given how the malware works, it seems that it could be applied to any installed app, so are they targeting PayPayl simply because of the number of installs and not because of any inherent flaws in PayPal's app?
This habit slashdot has of blaming the OS for the actions of 1. the user and 2. the software authors who steal your details is stupid and biased.
This is a trojan, not an 'android trojan'. It's not part of android, it's not related specifically to android, nor does anyone distributing android provide it packaged with android. The same trojan running on ios or windows mobile or blackberry or hell palmos would do the same thing. If it's running on the device receiving the second factor then it's bypassing 2FA fullstop.
Or "his" pleasure if you count the number of sick faggots on Slashdot.
Not this shit again. SMS is not 2FA. And even if it were, in this case it is run on the same device as app that needs to be authenticated.
There has yet to be a widespread iOS malware infection in the wild.
Now it really sucks that I cannot use my iDevice to play game ROMs emulate PC's or have my own programming language so I can use my phone as a personal computer with a tiny screen. However the apps for the device, I download for the most part usually work well, and are not malware.
Then don't start Settings apps, select System, select About phone, scroll down, tap the build number 5x, go back, select Developer Options, toggle it on, scroll down and check "Allow from unknown source", read the scary warning dialog that warns you about malware, and select "okay" in spite of that.
Here's a solution, don't use Pay Pal.
Now it really sucks that I cannot use my iDevice to play game ROMs emulate PC's or have my own programming language so I can use my phone as a personal computer with a tiny screen.
However the apps for the device, I download for the most part usually work well, and are not malware.
I'm not sure how much fun you would have getting an iPhone or iPad (or Android equivalent) to emulate a PC (or play game ROMs without a decent control-set); but as far as developing your own language, you are absolutely free to fire up XCode and start writing that language. You just can't publish it in the iOS App Store.
A limitation I will gladly trade for NOT having to worry about articles like this one two or three times per week, most every week...
Which is kinda what you ended up saying, right?
However the apps for the device, I download for the most part usually work well, and are not malware.
And you can get all those same protections by not willfully and manually enabling secondary sources as required for 3rd party app stores.
You can be safe if you're not a complete idiot, but we should never develop devices exclusively for the protection of complete idiots in the way Apple does.
And your point? Is it "If you try really hard, you can make your own iPhone stop working well"?
And your point? Is it "If you try really hard, you can make your own iPhone stop working well"?
That refers to an Android phone. If you do all that and get malware on your Android phone, you deserve it.
That refers to an Android phone. If you do all that and get malware on your Android phone, you deserve it.
HALT! These steps are the gateway to alternative other app stores when you want to avoid the malware that is GOOGLE's constant tracking. I use F-Droid and had to follow the steps --which cannot really be reversed because of the problem later on this paragraph. Others use the Amazon store and must do so too. Just cloning a trusty local APK that you are hoarding and KNOW is fine (or using an App store to do the downloading for you --same problem) fails the installation process and IIRC Google's OS itself leads you on the way to correct that: follow the "computer, disable all Holodeck safeties" steps that were described.
What looks like a willing shot in the foot to you and iOS users becomes a less deliberate choice and more of an only resort if you are managing your own installs.
The title is erroneous, in order to work, that mimics user generated mouse-events, the end-user has to first install the app, then enable the app when launching paypal.
Sounds a lot like " She was asking for it by wearing that short skirt."
Don't fight for your country, if your country does not fight for you.
This stupidity won't stop until businesses give up this "SMS as 2FA" nonsense and use GPG-style public key cryptography for authentication.
Sounds a lot like " She was asking for it by wearing that short skirt."
Sounds like your mind is wandering to other topics.