The Cybercriminal Approach to Mobile Fraud: Now They’re Getting Serious
•Download as PPTX, PDF•
2 likes•1,275 views
Mobile devices have been targeted by cybercriminals for over seven years now. However, in 2014 things got serious. Cybercriminals realized that a major portion of eCommerce and online banking is moving to the mobile space, and with that companies are giving clients more options for larger transactions, and actions that were previously only performed on PCs. New PC grade malware appeared on mobile devices, some old PC tricks were transformed for mobile, and new mobile specific threats emerged. In this session we will analyze these threats using multiple customer case studies and Trusteer’s security team research data. We also take a look at the latest mobile threats, threats in development and mitigation tactics.
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Similar to The Cybercriminal Approach to Mobile Fraud: Now They’re Getting Serious
Similar to The Cybercriminal Approach to Mobile Fraud: Now They’re Getting Serious (20)
More from IBM Security
More from IBM Security (20)
Recently uploaded
Recently uploaded (20)
The Cybercriminal Approach to Mobile Fraud: Now They’re Getting Serious
- 1. © 2015 IBM Corporation The Cyberciminal Approach to Mobile Fraud: Now They’re Getting Serious SSA-1721 Ori Bach Sr. Fraud Prevention Strategist
- 2. Today’s Agenda • Different Perspectives • Current State of Mobile Based Financial Threats • Mobile Security Challenge • Looking at Future Threats
- 4. The User’s Perspective 3 Are you saying that I can do my banking while on the go? Sign me up!!!
- 5. Mobile Banking Services Are a Competitive Advantage Mobile banking is the most important deciding factor when switching banks (32%) More important than fees (24%) or branch location (21%) or services (21%)… a survey of mobile banking customers in the U.S. 1 Mobile banking channel development is the #1 technology priority of N.A. retail banks (2013) #1 Channel The mobile payments market will eventually eclipse $1 trillion by 2017 $1tn 43% of 18-20 year olds have used a mobile banking app in the past 12 months 29% Cash-based retail payments in the U.S. have fallen from 36% in 2002 to 29% in 2012 $ Of customers won't mobile bank because of security fears 19% 90%Of mobile banking app users use the app to check account balances or recent transactions
- 6. Security is a Growing Concern 5 Source: Consumers and Mobile Financial Services 2013, Federal Reserve Board
- 7. The Financial Services Industry Perspective 6 My customers can interact with me while on the go? Sign me up!!!
- 8. • mBanking Usage Leads mPayments Source: US Federal Reserve March , 2014 Mobile Banking and Payment Growth • Mobile Payments – Global annual shipments of NFC enabled phones are set to rise from 275million units in 2013 to 1.2billion units in 2018. Source: NFC World, February 2014 – By 2017, the total value of global offline transactions facilitated by mobile devices will reach about $1.5 trillion, up from $120 billion in 2012 Source: Business Insider, June 2013 Source: Monitise, The Mobile Money Landscape, Vol. 1 2014
- 9. Security Is Front and Center
- 10. The Cybercriminal Perspective 10 Source: Consumers and Mobile Financial Services 2013, Federal Reserve Board Are you saying that I can do my banking while on the go? Sign me up!!!
- 11. The Criminal’s Perspective: Game On! 11
- 12. The Majority of Financial Apps Have Been Hacked • Majority of top 100 paid Android and iOS Apps are available as hacked versions on third-party sites • …as are many financial service, retail, and healthcare apps • (State of Mobile App Security, Arxan, 2015) • "Chinese App Store Offers Pirated iOS Apps Without the Need to Jailbreak” (Extreme Tech, 2013) http://www-03.ibm.com/software/products/en/arxan-application-protection
- 13. Mobile Attacks
- 14. Server-side Device ID is not effective for mobile devices Mobile devices share many identical attributes Mobile devices have the same attributes: OS, browser, fonts etc.. Cybercriminals can easily trick traditional device ID systems Cybercriminals Love Mobile Anonymity 14 Account takeover via a criminal mobile device is on the rise
- 15. 15 Old “Friends” Crash the Party
- 17. Mobile Phishing / SMishing 19
- 18. SMS Spamming 20
- 20. Fake Apps 23 Over 80,000 users have granted the apps permission to run on their browser, despite the warning the games will receive full access to a player’s web activity
- 21. The Challenge: Vulnerable Devices 24
- 22. The Ease of Getting Infected Malware to the Official Stores 25
- 25. A Mobile Malware Underground is Developing 29
- 28. Underground Services 32 User Name + Password OTP SMS Credentials OTP SMS TOR C&C
- 29. App Latching (Bundeling) Source: Dancho Danchev
- 34. Cybercriminals Are Finding Ways Into the Walled Garden 39
- 35. The Challenge: Vulnerable Devices 40
- 36. Mobile AVs Started Popping Up 41
- 37. The Criminal’s Perspective: We Know This Game! 42
- 39. Future Threats
- 40. Mobile Threats – New Vectors We have seen Classic threats migrate to mobile: Phishing, Ransomware, Overlay Mobile specific threats such as fake Apps We are bound to see Mobile specific exploit kits Bundling frameworks and services (perhaps automated) Device takeover malware for mobile NFC, ApplePay – new targets
- 41. New Tech – New Challenges • New technology challenges: • Wearable tech • IoT (Internet of Things) • Will ransomware be applied to IoT? • A car lockdown? • A house blackout? • A pacemaker threat?
- 42. Users Will Always Make Mistakes
- 43. Remember – Security is in YOUR Hands
- 44. Notices and Disclaimers Copyright © 2015 by International Business Machines Corporation (IBM). No part of this document may be reproduced or transmitted in any form without written permission from IBM. U.S. Government Users Restricted Rights - Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM. Information in these presentations (including information relating to products that have not yet been announced by IBM) has been reviewed for accuracy as of the date of initial publication and could include unintentional technical or typographical errors. IBM shall have no responsibility to update this information. THIS DOCUMENT IS DISTRIBUTED "AS IS" WITHOUT ANY WARRANTY, EITHER EXPRESS OR IMPLIED. IN NO EVENT SHALL IBM BE LIABLE FOR ANY DAMAGE ARISING FROM THE USE OF THIS INFORMATION, INCLUDING BUT NOT LIMITED TO, LOSS OF DATA, BUSINESS INTERRUPTION, LOSS OF PROFIT OR LOSS OF OPPORTUNITY. IBM products and services are warranted according to the terms and conditions of the agreements under which they are provided. Any statements regarding IBM's future direction, intent or product plans are subject to change or withdrawal without notice. Performance data contained herein was generally obtained in a controlled, isolated environments. Customer examples are presented as illustrations of how those customers have used IBM products and the results they may have achieved. Actual performance, cost, savings or other results in other operating environments may vary. References in this document to IBM products, programs, or services does not imply that IBM intends to make such products, programs or services available in all countries in which IBM operates or does business. Workshops, sessions and associated materials may have been prepared by independent session speakers, and do not necessarily reflect the views of IBM. All materials and discussions are provided for informational purposes only, and are neither intended to, nor shall constitute legal or other guidance or advice to any individual participant or their specific situation. It is the customer’s responsibility to insure its own compliance with legal requirements and to obtain advice of competent legal counsel as to the identification and interpretation of any relevant laws and regulatory requirements that may affect the customer’s business and any actions the customer may need to take to comply with such laws. IBM does not provide legal advice or represent or warrant that its services or products will ensure that the customer is in compliance with any law.
- 45. Notices and Disclaimers (con’t) Information concerning non-IBM products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products in connection with this publication and cannot confirm the accuracy of performance, compatibility or any other claims related to non-IBM products. Questions on the capabilities of non-IBM products should be addressed to the suppliers of those products. IBM does not warrant the quality of any third-party products, or the ability of any such third-party products to interoperate with IBM’s products. IBM EXPRESSLY DISCLAIMS ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. The provision of the information contained herein is not intended to, and does not, grant any right or license under any IBM patents, copyrights, trademarks or other intellectual property right. • IBM, the IBM logo, ibm.com, Bluemix, Blueworks Live, CICS, Clearcase, DOORS®, Enterprise Document Management System™, Global Business Services ®, Global Technology Services ®, Information on Demand, ILOG, Maximo®, MQIntegrator®, MQSeries®, Netcool®, OMEGAMON, OpenPower, PureAnalytics™, PureApplication®, pureCluster™, PureCoverage®, PureData®, PureExperience®, PureFlex®, pureQuery®, pureScale®, PureSystems®, QRadar®, Rational®, Rhapsody®, SoDA, SPSS, StoredIQ, Tivoli®, Trusteer®, urban{code}®, Watson, WebSphere®, Worklight®, X-Force® and System z® Z/OS, are trademarks of International Business Machines Corporation, registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at: www.ibm.com/legal/copytrade.shtml.
- 46. Thank You Your Feedback is Important! Access the InterConnect 2015 Conference CONNECT Attendee Portal to complete your session surveys from your smartphone, laptop or conference kiosk.
Editor's Notes
- Source of main quote: 1 – Alix partners Sources & Original Stats: 1. 70% of customers are willing to provide their banks with more personal information in exchange for context aware products - EY global consumer banking survey 2012 2. According to a study, 21% of mobile users have used mobile banking in the past 12 months and 11% of those who haven’t used mobile banking yet, will do so in next 12 months. Source: Federal Reserve Study 2012 43% of 18-20 year olds have used a mobile banking app in the past 12 months http://www.federalreserve.gov/econresdata/mobile-devices/2012-current-use-mobile-banking-payments.htm 3. Mobile banking channel development is the #1 technology priority of North American retail banks, followed by multichannel delivery and self-service technologies. Published date: 10/25/2013 Source: Celent 6. The mobile payments market will eventually eclipse $1 trillion by 2017 Published date: 12/24/2013 Source: IDC 7. 43.5% of 18-29 year olds have used mobile banking in the past 12 months (Mar 2012), Federal Reserve Cash-based retail payments in the U.S. have fallen from 36% in 2002 to 29% in 2012 (source: McKinsey, 2012). Mobile devices are a collection of sensors http://www.iab.net/about_the_iab/recent_press_releases/press_release_archive/press_release/pr-041113_mobilemoney
- “If a multi-purpose device (e.g. mobile phone or tablet) is used as the ownership element (e.g. to receive or generate a one-time password or initiate a drop call mechanism), does the PSP apply measures to mitigate the risk of it being used to initiate a fraudulent internet payment at the same time (e.g. via viruses/internet attacks)?”
- Mobile Threats At the start of the new year, the total number of samples in our mobile malware “zoo” reached 36,699, with 95 percent of that arriving in 2012. In all of 2011 we gathered only 792 samples. Will 2013 display a similar amazing climb? We’ve watched the growth of mobile malware almost double in each of the last two quarters. Some researchers cite higher figures of new mobile malware, with predictions of up to one million binaries by the end of this year. But these numbers may include all files bundled in malicious Android apps and families that repackage APK files. At McAfee Labs, we count only unique malware families and variants and not, for example, common ad libraries and other redundant malicious files.
- Fraudsters are leveraging a weakness in device ID systems. When looking at mobile device form the server, all device have a very similar set of attributes. So it is hard to distinguish a customer and a fraudster device. Cybercriminals steal credentials from a victim’s PC via malware or phishing and then use this information to commit account takeover via the mobile channel by leveraging the lack of device identification capabilities Correlated attacks – Malware/Phishing on the PC and access via mobile Evade traditional risk engines’ weak device ID + device spoofing / application re-install SIM Swap attacks
- Criminals looking to steal your customers credentials will: Look for security vulnerabilities -> App Scan will detect security vulnerabilities Hack the App – Arxan will prevent reverse engineering and hacking of the app Deploy malware on jailbroken / Rooted devices - > Mobile SDK wil detect high risk devices and malware Eavesdropping via an unsecure connection – Mobile SDK will detect the unsecure connection
- Control panel of Imeesgae spamming software
- On YYY an official android market app intended to play morning and evenings prayers in Arabic, has been flagged by ant-virus vendors as infected by the PC Trojan Ramnit. Ramnit only effects windows environments and the infected version has been since removed from the market. While no real harm was done in this specific instance, the fact remains that an infected app made it to official market. Trusteer has tracked down source to an infection on the developers PC .
- The mobile threat landscape included 3 primary risk vectors: Vulnerable and compromised customer mobile devices: The mobile device itself is also a target. Users often jailbreak/root their device which breaks the security model and allow mobile malware and rogue apps to infect the device and control critical functions like SMS which is used for transaction authentication. Other risk factors include dated operating systems versions, unsecure wi-fi and pharming attacks that direct users to fake sites. account takeover from the criminal’s mobile device: criminals use mobile devices to access victim’s account through mobile browser. One of the key challenges is creating a unique device ID for each mobile device as most mobile devices look alike when accessing online banking web sites via the native mobile browser. Legacy device ID solutions that sit on the web site have a difficult time uniquely detecting criminal devices. Furthermore, proxies used by criminals are skewing detection of the geographic location of the device based on IP address. Cross channel credential theft: a big enable for take over is stolen credentials through phishing or malware – on the online channel. To identify account takeover from a mobile device it is essential to see the full fraud life cycle and not have “silo” view of the mobile channel only.
- The Yanbian Gang and its Organizational Structure This cybercriminal group operates from the Yanbian Prefecture in Jilin, China, located north of the North Korean border, thus the name “Yanbian Gang.” And just like any cybercriminal groups that have several members who play specific roles to launch high-impact attacks, the Yanbian Gang comprises of four major players or groups—the organizer, translators, cowboys, and malware creators. Organizer: As the ‘founding father,’ his duties include scouting for and recruiting members. All members directly communicate with him thus making him an indispensable member. Translators: They localize threats. In this case, the translators used Korean for their specially crafted text messages as well as the malicious file’s user interface (UI). Cowboys: They are responsible for collecting the proceeds from successful attacks and giving them to the organizer. They usually reside in the same countries as their intended victims. They also use black or fridge cards, which are bank cards to evade law enforcement. Based on our information, Chinese hackers trade black or fridge cards via QQ Chat groups. Interested buyers can purchase such cards for around US$725 or KRW800,000 each Malware creators: The malicious app developers, in this case, are probably the most important members of the gang, as the success of an attack largely depends on how effective their creations are. Hacker groups can be seen publicly recruiting malware co-creators in bulletin board systems (BBSs) or chat groups.