Today, smartphones are ubiquitous, and mobile banking became an essential component of digital banking. With higher usage, however, mobile banking also turned into an attractive target for the cyber-criminals. The advanced attacks are tailor-made for mobile banking and often use the weaknesses in fragile mobile operating systems (more often on Android than on iOS). As a result, banks need to look for new security solutions to proactively stop these attacks. Our experts will guide you through the necessary components of modern mobile banking so that your mobile banking is secure (and so that you tick all the boxes at the compliance checklist for PSD2). - The real world attacks on mobile banking today. - Essential components of mobile banking security. - Mobile banking and compliance with PSD2.

1. How to Secure the
Mobile Banking
Petr Dvořák
petr@wultra.com
Guide for 2019

2. "Power to be you in
the digital world
We help banks build secure digital channels faster

3. Secure
Communication
Malware
Protection
Behavioral
Authentication
Fraud Detection
System
Customer
Acquisition
Authentication
Authorization
360°
Security for
Digital
Banking

6. 2014

8. "Strong crypto
solves every
problem of the
universe.

9. … except not really…

10. QRecorder malware (September 2018) steals ~80-100k EUR.

11. Malware Techniques
Accessibility Features
System Alert Window
SMS Messages
Permissions Misuse Foreground Override Evasion Techniques
Task Affinity
Task Reparenting
Task Hijacking
Code Obfuscation
Uninstall Prevention
Device Reset

12. … it's an isolated case…

14. Numbers from the Czech
Republic (Q1/2019)
4major malware
attacks in Q1
€100k
highest single
client loss
€500k
total cost impact
estimates in Q1

15. 2019

16. Attacker The Bank
✖
Malware
Phishing
MITM
…

17. Attacker The Bank
✓
"Our Solution"

18. Attacker The Bank
"Our Solution"
Attacker
✖

20. "Building walls
around the mobile
app to cover the
perimeter.

21. 4Critical Building Blocks

22. Good Old Strong Crypto.
Access control and transaction
signing. Resurfaced as "strong
customer authentication" (SCA)
under PSD2.
Note: Compliance requirement for PSD2, see
the entire Chapter 2 in RTS.
Cryptographic Protection

23. Mobile App Shielding
Runtime Application Self-Protection.
To mitigate issues of potentially
insecure mobile operating systems
even on rooted or jailbroken devices.
Note: Compliance improvement for PSD2, see
RTS, Chapter 2, Article 9, Paragraphs 2 and 3.

24. Protection Against Mobile Malware
Antivirus for Mobile Banking.
To detect and eliminate apps that may
be potentially harmful to mobile
banking or customer account.
Note: Compliance improvement for PSD2, see
RTS, Chapter 1, Article 2, Paragraph 2d.

25. Anti-Fraud System
Cross-channel Fraud Detection
To stop transactions that are to
untrusted accounts, do not match
behavioral patterns or are otherwise
"out of normal".
Note: Compliance improvement for PSD2, see
RTS articles related to transaction monitoring
and risk analysis.

26. Cryptographic
Protection
Mobile App
Shielding
Protection Against
Mobile Malware
Cross-Channel
Anti-Fraud System
Four Critical Building Blocks for Mobile
Banking Security
1 2 3 4

27. How many of these does your mobile
app have?

28. Thank you!
Petr Dvořák
petr@wultra.com