Feeds

ZeuS attacks mobiles in bank SMS bypass scam

Flicks two fingers to two factor authentication

The Power of One eBook: Top reasons to choose HP BladeSystem

Security researchers have warned that cybercrooks might be able to compromise online bank accounts even in cases where banks use SMS messages to authorise transactions.

The approach relies on first compromising a targeted user's computer using a variant of the ZeuS banking Trojan before infecting the same user's smartphone. Thereafter it would be possible to initiate a transaction and authorise it following the receipt of an SMS message to a second compromised device.

The so-called ZeuS Mitmo (man-in-the-mobile) attack is explained in a blog post by David Barroso, of S21sec e-crime. The approach first relies on tricking a user into getting infected by Zeus on the desktop, perhaps via use of a targeted email that points to a booby-trapped website or contains an infected attachment. Thereafter a user's login credentials are captured next time the mark logs into an online banking site.

The malware then generates a fake dialog box that attempts to trick the victim into disclosing the number and manufacturer of his or her mobile phone. This phone would then be sent a fake security certificate, which is actually a malicious banking Trojan tailored to the target's smartphone (this can be either Symbian or BlackBerry).

This malicious mobile application then monitors all incoming SMS as well as installing a backdoor to receive commands via SMS, from a designated command and control number, which can be altered. Samples of a malicious application for Nokia that works alongside Zeus to carry out the attack are analysed by S21sec here.

The approach is plausible if a little convoluted but the added complexity may be worth it in targeted attacks, perhaps against organisations or wealthy individuals whose banks use SMS notification for two factor authentication of transactions.

Luis Corrons, technical director of PandaLabs confirmed that the malware behind the attack is real and not just a theoretical risk. Victims trying to deny making a disputed transaction where SMS confirmation has been applied are liable to be in for all sorts of trouble, a factor that makes the attack particular insidious. ®

Designing a Defense for Mobile Applications

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.