Android banking Trojan steals both authenticating factors
The Zeus and SpyEye banking Trojans have recently been fitted with a new module that targets Android users that use their device as an added authentication method when accessing their bank accounts online.
But in order to effect a successful attack against the user, both his PC and Android device have to be compromised with malware, so malware authors have decided to cut the effort in two and make a fake app that will get both authentication factors in one fell swoop.
“The malicious application targets specific well-known financial entities posing as a Token Generator application. In fact, when the application is installed, the malware uses the logo and colors of the bank in the icon of the application, making it appear more credible to the user,” warns McAfee researcher Carlos Castillo.
Once the app is executed, it displays an HTML/JavaScript web page that poses as the token generator (the look depends on the targeted bank):
In order for the app to “work”, the victim must first enter first factor of authentication – if he doesn’t the app will return an error. A correct entry and a click on the “Generate” button will return a fake token and simultaneously sends the entered password and other information to a specific cell phone number and to one of the control servers specified in a list in the fake app’s configuration file.
When the control server returns an SMS containing the user’s mTAN (Mobile Transaction Number), it is intercepted by the app and sent to the default control server.
“As soon as the initial registration is done, the malicious application creates a scheduled system event to program the execution of itself at some point in the future,” explains Castillo.
“When this happens, a background service starts that creates and executes a thread which listens for commands sent from control servers. These commands update most of the configuration settings-the server list, the catch/delete list and phone number used to receive the stolen mTANs, and the initial password.”
He also notes that the app steals the list of the victim’s contacts, and paves the way for future downloads of malicious apps.