BankBot is Android-targeting malware using fake overlay screens to mimic existing banking apps to fool users and steal credentials. The newest BankBot variants target over 150 legitimate apps from banks based in 27 different countries. BankBot has evolved to intelligently target users based on geography, apps, and advanced Two-Factor Authentication in order to mislead users.

1. 0All Rights Reserved © 2017
ZL1022817
JT Keating
Vice President of Product Strategy

2. 1All Rights Reserved © 2017
BankBot

3. 2All Rights Reserved © 2017
BankBot
M o b i l e T h r e a t s A r e R e a l …
Phase 1
Phase 3
Phase 2

4. 3All Rights Reserved © 2017
User Installs Utility App Containing BankBot1

5. 4All Rights Reserved © 2017
2

6. 5All Rights Reserved © 2017
3 BankBot Receives Template from C&C

7. 6All Rights Reserved © 2017
3 BankBot Receives Template from C&C

8. 7All Rights Reserved © 2017
4 BankBot Monitors For Target App Launch

9. 8All Rights Reserved © 2017
5 BankBot Displays Fake Overlay

10. 9All Rights Reserved © 2017
6 User Provides Credentials to BankBot

11. 10All Rights Reserved © 2017
7 Unique Variation for UAE Banks
• Before it shows the overlay page, BankBot requests
the user’s phone number.
• The C&C server sends a pin code to the victim.
• After entering the pin, the victim is instructed to
input bank details (two times, to make sure the
attacker has valid credentials).

12. D, N & A are Not Created Equally
Device Attacks
THE Sole
Objective for
Persistent
Foothold
Network Attacks
The Primary
Mechanism for
Targeted Attacks
Application Attacks
Untargeted,
Advertising &
Fraud Threats

13. 12All Rights Reserved © 2017
BankBot Can Do Even More…
• Sending and intercepting SMS messages
• Making calls
• Tracking infected devices
• Stealing contacts

14. 13All Rights Reserved © 2017
Manually Analyzing Apps is Futile
M o b i l e T h r e a t s A r e R e a l …
Source: Statista, Zimperium
0
500000
1000000
1500000
2000000
2500000
3000000
3500000
4000000
4500000
Sep-17
Oct-17
Nov-17
Dec-17
Jan-18
Feb-18
Mar-18
Apr-18
May-18
Jun-18
Jul-18
Aug-18
Sep-18
Oct-18
Nov-18
Dec-18
Jan-19
Feb-19
Mar-19
Apr-19
May-19
Apps Needing
Analysis
App Research
Capacity
AppsinAppStore

15. z9™ detection engine uses machine learning to provide real-time, on-device
protection against both known and unknown threats
Network Attacks Application AttacksDevice Attacks
PATENTED DETECTION ENGINE

16. 15All Rights Reserved © 2017
Zimperium MTD Platform
Enterprise Dashboard, Forensics, Administration
Advanced App Analysis: Threat, Risk & Privacy
Detect and prevent threats to Mobile Devices
Generate Self-Protecting Mobile Apps Via an SDK

17. 16All Rights Reserved © 2017
zIAP™ – World class In-App Protection
All the DNA detection capabilities of z9 to detect:
❯ Standard use cases, e.g., jailbreak detection
❯ Sophisticated attacks that let hackers:
❯ Steal data
❯ Log keystrokes
❯ Hijack network connections
❯ Read your app’s memory and files
❯ Jeopardize privacy

18. 17All Rights Reserved © 2017
Thwarting BankBot
Embedded in an app that is
attacked by malware including
BankBot, zIAP detects the threat
and can immediately terminate
the session and/or flag the
account for high fraud risk.

19. 18All Rights Reserved © 2017