Vulnerability In Fully Patched Android Phones Under Active Attack By Bank Thieves

'A vulnerability in millions of fully patched Android phones is being
actively exploited by malware that's designed to drain the bank
accounts of infected users, researchers said on Monday. The
vulnerability allows malicious apps to masquerade as legitimate apps
that targets have already installed and come to trust, researchers
from security firm Promon reported in a post. Running under the guise
of trusted apps already installed, the malicious apps can then request
permissions to carry out sensitive tasks, such as recording audio or
video, taking photos, reading text messages or phishing login
credentials. Targets who click yes to the request are then
compromised.

Researchers with Lookout, a mobile security provider and a Promon
partner, reported last week that they found 36 apps exploiting the
spoofing vulnerability. The malicious apps included variants of the
BankBot banking trojan. BankBot has been active since 2017, and apps
from the malware family have been caught repeatedly infiltrating the
Google Play Market. The vulnerability is most serious in versions 6
through 10, which account for about 80% of Android phones worldwide.
Attacks against those versions allow malicious apps to ask for
permissions while posing as legitimate apps. There's no limit to the
permissions these malicious apps can seek. Access to text messages,
photos, the microphone, camera, and GPS are some of the permissions
that are possible. A user's only defense is to click "no" to the
requests.

"The vulnerability is found in a function known as TaskAffinity, a
multitasking feature that allows apps to assume the identity of other
apps or tasks running in the multitasking environment," reports Ars
Technica. While Google has removed the [unnamed] malicious apps from
its Play Store, according to Promon, the vulnerability is still
unfixed in all versions of Android.

"Promon is calling the vulnerability 'StrandHogg,' an old Norse term
for the Viking tactic of raiding coastal areas to plunder and hold
people for ransom," the report adds. "Promon researchers said they
identified StrandHogg after learning from an unnamed Eastern European
security company for financial institutions that several banks in the
Czech Republic reported money disappearing from customer accounts."'

-- source: https://it.slashdot.org/story/19/12/02/230254

Cheers, Peter
-- 
Peter Reutemann
Dept. of Computer Science
University of Waikato, NZ
+64 (7) 858-5174
http://www.cms.waikato.ac.nz/~fracpete/
http://www.data-mining.co.nz/
_______________________________________________
wlug mailing list -- [email protected] | To unsubscribe send an email to [email protected]
Unsubscribe: https://list.waikato.ac.nz/postorius/lists/wlug.list.waikato.ac.nz