Cloned Android Banking App Hides Phishing Scheme

by Michael Mimoso

Cloned mobile applications, such as the legions of Flappy Bird knock-offs that surfaced once the popular game was removed from Google Play and the Apple App Store, are an increasingly popular malware vehicle for attackers.

The risks range from loading programs that dial premium numbers at the user’s expense, to others that spy on messages or steal data stored on the device.

Mobile security company Lookout this week reported on a cloned banking app targeting users of a popular Israeli bank. The app, a clone of Mizrahi Bank’s legitimate Android application, has since been removed from Google Play.

“The authors put a wrapper around the bank’s legitimate app and redistributed it on the Google Play store, pretending to be the financial institution,” said Meghan Kelly of Lookout.

Strangely enough, the app targets the banking customer’s credentials as expected, but only the user ID.

“Indeed, those who built the malware inserted a comment into the code dictating that only the user ID be taken, not the passwords,” Kelly said.

Likely, the attackers are collecting user names in order to phish customers of this particular bank later on for their credentials or authentication tokens, though it’s not clear why they didn’t do so with the mobile app.

“Once a victim opens the app, the malware loads the login form, which is an in-app html page that has been changed to siphon off the victim’s user ID’s as they enter their credentials. It’s effectively a phishing attack,” Kelly said. “Once the user ID is stored the app returns a message to the user saying that the login failed and to, instead, reinstall the legitimate banking app from the Play Store.”

Lookout points out that most banking malware is confined to Europe and Asia with some samples even trying to pass themselves off as Google Play, sending notifications to users’ devices luring them to rogue banking apps.

“Unfortunately, with an app that sneaks into the Google Play store, it’s hard to use traditional means to protect yourself,” Kelly said. “For example, looking to see if this is a developer you trust, or making sure your phone has ‘Unknown sources’ is unchecked to prevent dropped or drive-by-download app installs.”

Android banking Trojans such as Svpeng are much more direct and dangerous than this one. The Trojan, studied by Kaspersky Lab researchers, spreads via SMS spam and tailors its messaging based on the device’s language setting. It targets U.S., German, Belarusian and Ukranian victims. In November, Kaspersky researchers reported that a new feature was added to Svpeng where devices infected with the Trojan are presented with a phishing window upon launching their banking application in an attempt to steal credential, which are sent to a command server.

The Trojan also has a payment card component where it layers a phishing window over Google Play prompting the user to enter a credit card or bank card number, including expiration date and security code.

Earlier this year, Svpeng was modified with a ransomware component demanding $500 for illicit activity with the mobile device. That was short lived, Kaspersky researcher Roman Unuchek said recently. A new version of the Trojan began chasing victims in the United States with a new ransomware component tailored around victims in the U.S.

“We managed to identify seven modifications of the new Svpeng, and all of them include a Cryptor class reference, but none of them makes any attempt to use it,” Unuchek said. “It could mean that in the future the cybercriminals will use the Trojan to encrypt user data and demand a ransom to decrypt it.”

Source:  http://threatpost.com/cloned-android-banking-app-hides-phishing-scheme/106867

SMS Worm Selfmite Makes an Entry, and an Exit

By Ionut Ilascu



A new strain of Android malware has been discovered recently propagating through short text messages to different contacts in the list of the victim’s infected smartphone.

Unlike other forms of malware, this one, called Selfmite, is not after banking credentials or any other type of sensitive information.

Its purpose is to download on the victim’s device a copy of Mobogenie, which is a legitimate app for managing and installing mobile apps, as well as multimedia content.

This sort of activity led researchers at AdaptiveMobile to the conclusion that Selfmite is part of a software affiliation scheme which brings the cybercriminals new cash for each install of a specific app.

AdaptiveMobile says that the distribution process of the malware begins with the potential victim receiving a short text message from a known contact inviting them to click on a link.

The address actually leads to the Selfmite worm, which is served as an app named The Self-Timer. As soon as launched, the worm checks the list of contacts and picks 20 of them to distribute to through SMS.

Since it has the name and the phone number, it can customize the message sent to the next potential victim so as not to raise suspicions. The message reads: “Dear [NAME], Look the Self-time, http://goo.gl/******,” and the infection cycle starts again.

It proceeds to direct the victim to the advertising platform address where the Mobogenie download is served only after making sure that the infection is perpetuated.

After the Mobogenie version is installed, it sends some device parameters to a certain URL in order to confirm the installation, and thus, the scammers rake in the profit.

The number of downloads for Mobogenie on Google Play is between 50 millions and 100 millions, which shows that it is a popular app among Android users.

However, there are no signs that the developers of the app are involved in this scheme. Moreover, the developers updated its description with an apologetic message towards those users that have been affected by this campaign.

The company representative also says that they have identified a technical issue with one of the promotional partners and a fix is on the way.

“Although we have never intentionally distributed spam advertisements to our users, we would like to take this opportunity to apologise to all of you for any inconvenience this spam may have caused. Having now identified a technical issue with one of our promotional partners, we are currently trying our best to fix this problem as soon as possible,” the post says.

According to AdaptiveMobile, North America appears to be the most affected region and the company has already blocked the spread to its customers. Google has also been contacted and it has disabled the shortened links used in the scam, as well as Mobogenie, to block the ID responsible for such activity.

Source:  http://news.softpedia.com/news/SMS-Worm-Selfmite-Makes-an-Entry-and-an-Exit-448657.shtml