Banking malware found on Android Marketplace

An application for smartphones running the Google Android operating system has been reported to steal users’ banking information.

 

According to a blog post from the First Tech Credit Union, an app developer called 09Droid created applications which posed as a shell for mobile banking applications, and in the process phished personal information about the users’s bank accounts. The information would, presumably, have been usen for the purposes of identity theft.

 

SophosLabs has not yet seen a sample of the malware, which has now been removed from the Android Marketplace, and First Tech Credit Union is at pains to point out to its customers that it does not currently have an app for the Android phone.

 

A number of other financial institutions have also published warnings regarding the Android applications. For instance, here’s a similar warning about the Android app that was published on the website of Travis Credit Union, and this is what the credit union posted on its official Facebook page:

Although malware has previously emerged for jailbroken iPhones (such as the infamous Rick-rolling Ikee worm) the malicious applications have not made it onto users’ iPhones via Apple’s highly guarded AppStore.

 

The Android marketplace, however, is not as closely monitored as Apple’s equivalent, and adopts a more “anything goes” philosophy. This, combined with the current buzz around new phones running Android such as the Motorola Droid and the Google Nexus One, may make the platform more attractive to cybercriminals in future.

 

As more and more users inevitably take advantage of smartphones to access their bank accounts in the future, the temptation for hackers to exploit systems may become greater.

 

by Graham Cluley, Sophos

 

Could Hotmail Password Theft be Due to a Trojan?

 

A security researcher has claimed that some of the passwords stolen from Hotmail, Gmail and other webmail services were the result of a data theft trojan rather than a phishing attack.

 

Originally 10,000 Hotmail passwords were leaked onto the pastebin website, posted by an anonymous user. Later on, Google confirmed Gmail had been targeted as well.

 

Although Microsoft and Google have both said that the passwords were taken as a result of phishing, ScanSafe security researcher Mary Landesman said there was no way that the companies could have been totally sure of this.

 

Speaking to IT PRO she said: “No offence to, and I don’t mean to undermine either Microsoft and Google, but certainly neither one of them can actually definitively either.”

 

“I think they came out with phishing as the most likely explanation in their minds without having really gone over the lists in great detail,” she added.

 

Landesman said that there were a lot of indicators in the password lists that are consistent with data theft rather than phishing.

 

“It doesn’t mean that 100 per cent of the list was derived from either source [phishing or trojan], more likely a combination of sources,” she said.

 

The researcher said that one tell-tale sign of a possible trojan was that 1,369 of the account records appeared more than once and as some as many as five times.

 

“Phishing scams do not typically vet the usernames and passwords when they receive them,” she said.

 

“The fact that there actually seems to be failed login attempts is much more indicative of a keylogger or some sort of trojan capture.”

 

She also said on her blog post that previous lists of known phished accounts generally saw some victims left nonsensical messages as they realised that they were being phished, but this list had no such entries.

 

She said that although ‘123456′ did appear in the list as a password, it still only appeared 63 times out of the 10,000 records, and by and large most of the users had respectable passwords, so were potentially less likely to fall for a phishing scam.

 

Microsoft and Google had not responded to our request for comment on Landesman’s remarks at the time of publication.

 

 

By Asavin Wattanajantra from itpro.co.uk