iSA_LOGO_FINAL-new-3 (1)
Categories
Uncategorized

Taxi Trojans are on the way: Beware of Banking Apps

Add Your Heading Text Here

Share it:
 
 
The Faketoken Trojan has existed for a long time, and it has been upgraded for many years. Our experts named the current version “Faketoken.q,” and by now it has learned a significant number of tricks.
 
After getting onto a smartphone (judging by the malware icon, Faketoken infiltrates smartphones through bulk SMS messages with a prompt to download some picture) and installing the necessary modules, the Trojan hides its shortcut icon and starts background monitoring of everything that happens in the system.
 
First, the Trojan is interested in the user’s calls. As soon as it detects a call, it starts recording. When the call is finished, Faketoken sends the recording to the criminal’s server. Second, the Trojan also checks which apps the smartphone’s owner uses.
 
When Faketoken detects the launch of an app whose interface it can simulate, the Trojan immediately overlays the app with its own screen. To achieve that, it uses a standard Android feature that supports showing screen overlays on top of all other apps. A whole bunch of legitimate apps, such as messengers, window managers, and so on, use this feature.
 
Actually, Faketoken.q is after a huge variety of apps that have one thing in common: in them, a request to enter payment data looks normal enough not to arouse suspicion. Among the attacked apps are a number of mobile banking apps, Android Pay, the Google Play Store, apps for booking flights and hotel rooms, and apps for paying traffic tickets — as well as apps for booking taxis.
 
Below you can find several pieces of advice on how to protect yourself against Faketoken and similar mobile Trojans that steal card numbers and intercept SMS messages with one-time passwords used to confirm payments.
 
  • It is imperative that you go into Android’s settings and prohibit the installation of apps from unknown sources. To block installation from unknown sources, go to Settings -> Security and uncheck Unknown sources.
  •         Always pay attention to what access permissions an app requests during installation, even if you downloaded it from Google Play (there might be Trojans in the official app store as well).
  •        It is a good idea to protect your smartphone by installing antivirus, which can find infections hiding in an app such as basic Kaspersky Internet Security for Android,  

source: Kaspersky Lab.

  • Growth through innovation/creativity:
    Rather than be constrained by ideas for new products, services and new markets coming from just a few people, a Thinking Corporation can tap into the employees.
  • Increased profits:
    The corporation will experience an increase in profits due to savings in operating costs as well as sales from new products, services and ventures.
  • Higher business values:
    The link between profits and business value means that the moment a corporation creates a new sustainable level of profit, the business value is adjusted accordingly.
  • Lower staff turnover:
    This, combined with the culture that must exist for innovation and creativity to flourish, means that new employees will be attracted to the organization.
Categories
Apps Mobile Phones

10 Faqs About Android Application Security.

Add Your Heading Text Here

Share it:

Today our cybersecurity team reveals 10 common questions bothering android developers interested in securing their android applications.


Q1: How can i protect my android app from software pirates? I mean how can i obfuscate my source code?
Ans: You can choose to use DexGuard or DashO to make it difficult for software pirates, reverse engineers or intruders to pirate your source code.


Q2: I heard you can also use ProGuard to obfuscate source code?
Ans: Yes! But it is not effective. Practically not effective.


Q3: Do you think it is quite safer to save users data on their own device?
Ans: Yes and No. Yes- It is quite safer to save non-sensitive data on users devices. No- It is not safe to save sensitive data on users’ devices even if you intend to protect using strong encryption.


Q4: I heard hackers can intercept data in transit using a proxy such as Burpsuite?
Ans: Yes. They can intercept data in transit.


Q5: So is there any defense mechanism against this form of attack?
Ans: Yes. Ensure that the same validation method implemented on the client side is exactly implemented on the server-side.


Q6: Although I have implemented HTTPS to protect data in transit, i find it difficult to stop “csrf” attacks?
Ans: Okay. You can create tokens for each registered or authenticated user. In addition, ensure that tokens are available temporarily and re-created after a specific period.


Q7: Yes. I have done that but hackers still by-pass csrf protection.
Ans: Ensure that csrf tokens are validated at the server-side. Also make tokens random.


Q8: I want my android app to share data with other app but with some form of restriction. How can I achieve that?
Ans: Okay. You can use content provider which allows apps to share data with other apps. Moreover, with content provider, you can specify read and write permissions. Thus, some apps may have read and write permissions whilst others may have read -only permissions or write-only permissions


Q9: Could I also save data in shared_pref file? I heard it is not safe to do so.
Ans: It is safe to do so when data is not sensitive. It is not safe to do so when data is sensitive. So move all users’ data such as password, userid, and account number to your web server.


Q10: Is it advisable to hire android security researchers or pentesters to audit my apps?
Ans: Yes. We recommend you to do so.
Although these are other common faqs related to android security, at least, you can rely on some of our answers to make your android app secure.

#ISA_informs  #ISA_ltd