Android 'spoofing' bug helps targets bank accounts

guest · Dec 2, 2019

Android 'spoofing' bug helps targets bank accounts
December 2, 2019
https://www.bbc.co.uk/news/technology-50605455

The bug lets attackers create fake login screens that can be inserted into legitimate apps to harvest data.
Called Strandhogg, the vulnerability can be used to trick users into thinking they are using a legitimate app but are actually clicking on an overlay created by the attackers.

"We'd never seen this behaviour before," said Mr Hansen.
Promon worked with US security firm Lookout to scan apps in Android's Play store to see if any were being abused via the Strandhogg bug.

They found that 60 separate financial institutions were being targeted via apps that sought to exploit the loophole. Lookout said it found criminals used variants of a well-known malicious money-stealing app known as bankbot.
In a statement, Google said: "We appreciate the researchers' work, and have suspended the potentially harmful apps they identified."

It added: "Additionally, we're continuing to investigate in order to improve Google Play Protect's ability to protect users against similar issues."
Click to expand...

Promon: The StrandHogg vulnerability

guest · May 26, 2020

A new Android bug, Strandhogg 2.0, lets malware pose as real apps and steal user data
May 26, 2020
https://techcrunch.com/2020/05/26/strandhogg-malicious-apps-android/

Security researchers have found a major vulnerability in almost every version of Android, which lets malware imitate legitimate apps to steal app passwords and other sensitive data.

The vulnerability, dubbed Strandhogg 2.0 (named after the Norse term for a hostile takeover) affects all devices running Android 9.0 and earlier. It’s the “evil twin” to an earlier bug of the same name, according to Norwegian security firm Promon, which discovered both vulnerabilities six months apart. Strandhogg 2.0 works by tricking a victim into thinking they’re entering their passwords on a legitimate app while instead interacting with a malicious overlay.

The bug is said to be more dangerous than its predecessor because it’s “nearly undetectable,” Tom Lysemose Hansen, founder and chief technology officer at Promon, told TechCrunch.
The good news is that Promon said it has no evidence that hackers have used the bug in active hacking campaigns.
Click to expand...

The caveat is that there are “no good ways” to detect an attack. Fearing the bug could still be abused by hackers, Promon delayed releasing details of the bug until Google could fix the “critical”-rated vulnerability.

A spokesperson for Google told TechCrunch that the company also saw no evidence of active exploitation. “We appreciate the work of the researchers, and have released a fix for the issue they identified.” The spokesperson said Google Play Protect, an app screening service built-in to Android devices, blocks apps that exploit the Strandhogg 2.0 vulnerability.
Click to expand...

Procmon: StrandHogg 2.0 - The ‘evil twin’

New Android Vulnerability Even More Dangerous, With Attacks More Difficult to Detect Than Predecessor
Click to expand...

Log in or Sign up

Android 'spoofing' bug helps targets bank accounts

guest Guest

guest Guest

Log in or Sign up

Android 'spoofing' bug helps targets bank accounts

guest Guest

guest Guest

Useful Searches