Android banking Trojan steals both authenticating factors
Posted on 16.03.2012
The Zeus and SpyEye banking Trojans have recently been fitted with a new module that targets Android users that use their device as an added authentication method when accessing their bank accounts online.

But in order to effect a successful attack against the user, both his PC and Android device have to be compromised with malware, so malware authors have decided to cut the effort in two and make a fake app that will get both authentication factors in one fell swoop.

"The malicious application targets specific well-known financial entities posing as a Token Generator application. In fact, when the application is installed, the malware uses the logo and colors of the bank in the icon of the application, making it appear more credible to the user," warns McAfee researcher Carlos Castillo.

Once the app is executed, it displays an HTML/JavaScript web page that poses as the token generator (the look depends on the targeted bank):


In order for the app to "work", the victim must first enter first factor of authentication - if he doesn't the app will return an error. A correct entry and a click on the "Generate" button will return a fake token and simultaneously sends the entered password and other information to a specific cell phone number and to one of the control servers specified in a list in the fake app's configuration file.

When the control server returns an SMS containing the user’s mTAN (Mobile Transaction Number), it is intercepted by the app and sent to the default control server.

"As soon as the initial registration is done, the malicious application creates a scheduled system event to program the execution of itself at some point in the future," explains Castillo.

"When this happens, a background service starts that creates and executes a thread which listens for commands sent from control servers. These commands update most of the configuration settings–the server list, the catch/delete list and phone number used to receive the stolen mTANs, and the initial password."

He also notes that the app steals the list of the victim's contacts, and paves the way for future downloads of malicious apps.






Spotlight

Operation Pawn Storm: Varied targets and attack vectors, next-level spear-phishing tactics

Posted on 23 October 2014.  |  Targets of the spear phishing emails included staff at the Ministry of Defense in France, in the Vatican Embassy in Iraq, military officials from a number of countries, and more.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Oct 24th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //