SMS stealing apps uploaded to Google Play by Carberp banking malware gang

The apps were designed to steal mobile transaction authentication numbers from Russian online banking users, Kaspersky Lab says

Several malicious Android apps designed to steal mobile transaction authentication numbers (mTANs) sent by banks to their customers over SMS (Short Message Service) were found on Google Play by researchers from antivirus vendor Kaspersky Lab.

The apps were created by a gang that uses a variant of the Carberp banking malware to target the customers of several Russian banks, Denis Maslennikov, a senior malware analyst at Kaspersky, said Friday in a blog post.

Many banks use mTANs as a security mechanism to prevent cybercriminals from transferring money from compromised online banking accounts. When a transaction is initiated from an online banking account, the bank sends an unique code called an mTAN via SMS to the account owner's phone number. The account owner has to input that code back into the online banking website in order for the transaction to be authorized.

In order to defeat this type of defense, cybercriminals created malicious mobile apps that automatically hide SMS messages received from numbers associated with the targeted banks and silently upload the messages back to their servers. Victims are tricked into downloading and installing these apps on their phones via rogue messages displayed when visiting their bank's website from an infected computer.

SMS stealing apps have previously been used together with the Zeus and SpyEye banking Trojan programs and are known as Zeus-in-the-Mobile (ZitMo) and SpyEye-in-the-Mobile (SpitMo) components. However, this is the first time a rogue mobile component designed specifically for the Carberp malware has been found, Maslennikov said.

Unlike Zeus and SpyEye, the Carberp Trojan program is primarily used to target online banking customers from Russia and other Russian-speaking countries like Ukraine, Belarus or Kazakhstan.

According to a report in July from antivirus vendor ESET, Russian authorities arrested the people behind the three largest Carberp operations. However, the malware continues to be used by other gangs and is being sold on the underground market for prices between US$5,000 and $40,000, depending on the version and its features.

"This is the first time we've seen mobile malicious components from a Carberp gang," Aleksandr Matrosov, senior malware researcher at antivirus vendor ESET, said Friday via email. "Mobile components are used only by one Carberp group, but we can't disclose more details at the present."

The new Carberp-in-the-Mobile (CitMo) apps found on Google Play masqueraded as mobile applications from Sberbank and Alfa-Bank, two of Russia's largest banks, and VKontakte, the most popular online social networking service in Russia, Maslennikov said. Kaspersky contacted Google on Wednesday and all CitMo variants were deleted from the market by Thursday, he said.

However, the fact that cybercriminals managed to upload these apps to Google Play in the first place raises questions about the efficiency of the app market's anti-malware defenses, such as the Bouncer anti-malware scanner announced by Google earlier this year.

"It seems that it's not that hard to bypass Google Play's defenses because malware continues to appear there regularly," Maslennikov said via email.

Bogdan Botezatu, a senior e-threat analyst at antivirus vendor Bitdefender, believes that it might be hard for Google's Bouncer to detect ZitMo, SpitMo or CitMo components because they are functionally similar to some legitimate applications.

"The mobile version of the Trojan is only responsible with hijacking the received SMS and forwarding its contents to a different recipient, and this behavior is also found in legitimate applications, such as SMS management apps or even applications that allow the user to remotely control their devices via SMS in the event they get stolen or lost," he said via email. "SMS interception is a feature that is well documented on forums, along with sample code. If the same sample code is used both in malicious and legit applications, it would be even harder to detect and block."

The ability to use Google Play to distribute SMS stealing apps offers advantages to cybercriminals, Botezatu said. First of all, some user devices are configured to only install apps obtained from Google Play. Also, users are generally less suspicious of apps downloaded via Google Play and pay less attention to their permissions because they expect the applications to be what their descriptions claim they are, he said.

Tags: security, mobile security, scams, eset, spyware, fraud, kaspersky lab, bitdefender, malware

Fake-police ransomware reaches Australia

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Web Security and Control

Protect your users on the web

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.