Updated Android.Bankosy malware steals passwords sent through voice calls

Around a year and a half ago, Symantec warned about the personal data stealing malware Android.Bankosy. Now the Trojan has been updated so it can steal passwords delivered via voice call-based two-factor authorization systems.

  
Such 2FA systems are is often used by banks to communicate one-time passcodes to people. While these have usually been delivered via SMS, voice call delivery is becoming increasingly common. Malware makers are keen not to miss out on data stealing opportunities, and the Android.Bankosy introduces a call-forwarding feature that sends 2FA calls to a C&C server so the code can be intercepted and exploited.
  

The malware enables call-forwarding on an infected phone, and is also able to enable silent mode to avoid alerting a victim about incoming calls. A successful attack is dependent on a victim's basic login credentials having already been stolen, but the malware represents a worrying new development in breaking through banking security.

Detailing how Android.Bankosy works, Symantec's Dinesh Venkatesan says:

Once the malware is installed on the victim's device, it opens a back door, collects a list of system-specific information, and sends it to the command and control (C&C) server to register the device and then get a unique identifier for the infected device. If the registration is successful, it uses the received unique identifier to further communicate with the C&C server and receive commands.

Most of the commands supported by the malware are common and trivial for typical back door or financial Trojans, such as intercepting incoming SMS, deleting SMS messages, wiping the data, etc. Out of these multiple commands, the most relevant for Android.Bankosy is call_forwarding; when this command is received by the malware from the C&C server, it executes a payload to enable call forwarding.

 

Full details of the malware is available from Symantec.

 

Photo credit: Mmaxer / Shutterstock

~ Mark Wilson

Read More

Hackers of Apple, Facebook seen as independent group seeking money

A man types on a computer keyboard in Warsaw in this February 28, 2013 illustration file photo. 

 

 

 

 

 

 

 

 Reuters/Kacper Pempel/Files

 
A hacking group best known for breaking into top-tier technology companies Apple Inc, Facebook Inc and Twitter Inc more than two years ago is now believed to be one of a handful of highly skilled independent gangs pursuing corporate secrets for profit.
 
According to new research from the largest U.S. security software vendor, Symantec Corp, the group appears to be among the few that display significant talent without backing from a national government. The group stays below the radar with a small number of carefully targeted attacks.
 
“They are very focused, wanting everything valuable from the top companies of the world,” said Vikram Thakur, a Symantec senior manager. “The only way they could use it, in our opinion, is through some financial market or by selling it.”
 
Thakur said Symantec and other security companies such as FireEye Inc were tracking less than a half dozen such groups, including one called FIN4.
 
FIN4 has less technical skill but uses knowledge of the investment banking world and strong social engineering, or trickery, to harvest email credentials and discover material financial information. The U.S. Securities and Exchange Commission is investigating some FIN4 breaches at large, publicly traded companies.[ID:nL1N0Z31G0] 
 
Symantec said its group, which it calls Morpho, dropped out of sight for months after press accounts of the Silicon Valley breaches in early 2013 shine a light on their techniques, which included use of a previously unknown "zero-day" flaw in Oracle’s Java platform.
 
Morpho also used a “watering hole” approach, infecting websites that were likely to attract employees of its targets as visitors. In the best-known case, a website frequented by iPhone developers was infected.
 
Some had suspected China or another country in the Silicon Valley attacks. Some of the companies breached, including Apple, said they found no evidence of data being stolen.
 
In a paper being released Wednesday, Symantec said Morpho came back from its absence to breach a small number of additional technology companies. It has also gone after the pharmaceutical industry and airlines, typically hitting multiple competitors in a sector and infecting a very few machines, usually in the research departments. 
 
Morpho has breached about 49 organizations that Symantec knows about since 2012, with the number penetrated each year rising to 14 by 2015. The United States, Europe and Canada have the most victims. 
 
Thakur said his team thinks the group might have about 10 members around the world, with some fluent in English and one or more perhaps having worked at an intelligence agency. They could be offering themselves for hire or could be breaking into companies on speculation and trying to sell the information or trade shares based on it. 
 
Among the team’s greatest strengths is its operational security, as it uses multiple proxies to disguise its location, employs heavy encryption where it stores digital loot, and strikes within a day or two of entry before wiping its tracks.
 
A break in Symantec’s research came when a regular backup was made of a targeted machine during a 12-hour window when some of Morpho’s custom-made navigation tools were still in use. Symantec then looked for where the same tools had been employed. 
 
Thakur said law enforcement agencies in the United States and Europe had been apprised of Symantec's findings. An FBI spokesman did not respond to a request for comment, nor did Twitter and Facebook. An Apple spokesman declined to discuss the research.              
 
~ Joseph Menn

Read More

Facebook Android App Found Collecting Phone Numbers Without User Consent

Next update to fix the issue

Faced with allegations of complicity in the furtive Prism surveillance program earlier this month, Facebook strongly denied being part of any such program and vowed to keep “fighting aggressively to keep your information safe and secure.” Well, its Android app tells a different story.
 
The latest version of Symantec’s Norton Mobile Security tool came out on Wednesday and got down to work straight away, flagging the Facebook app as being a privacy risk. According to the security company, the new Mobile Insight technology contained in the security app caught the Facebook Android app calling home to send the user’s phone number. What’s more alarming is the fact that this is something the app does right off the bat, without even waiting for the user to log in.
 
“The first time you launch the Facebook application, even before logging in, your phone number will be sent over the Internet to Facebook servers,” Symantec said in a blog post. “You do not need to provide your phone number, log in, initiate a specific action, or even need a Facebook account for this to happen.”
 
On being confronted on the issue by Symantec, Facebook promised to fix the issue in the next update (already in beta, thankfully). Further, it denied using or processing the phone numbers in anyway, adding that they have now been deleted from its servers.
 
~ Pulkit Chandna 

Read More