Malware News Android Banking Trojan with 10K Installs Can Bypass Two-Factor Authentication

[silversurfer]

Content source

https://news.softpedia.com/news/android-banking-trojan-with-10k-installs-can-bypass-two-factor-authentication-522909.shtml

In a detailed report published on his blog, security researcher Lukas Stefanko detailed how a banking Trojan posing as a legitimate phone call recording application steals bankings information from compromised Android devices.

The infected app was installed on more than 10,000 Android devices, and it managed to steal banking credentials even though SMS two-factor authentication was enabled on the test device with the help of Android's accessibility services.

According to ESET's mobile security researcher, the QRecorder Android app was initially a malware-free application but, in a subsequent release, the developer decided to include the banking Trojan to make some quick money.

 

[jasonX]

Thanks for the information. All the more that we should all be careful and use proper security apps. Will rely on Eset Banking

 

[Entreri]

This is why I never bank using smartphones...these banking apps ask you to save your password too, lol!

What if someone steals your phone? Most of these Android phones are elementary to get into.

 

[Quassar]

This is why I never bank using smartphones...these banking apps ask you to save your password too, lol!

What if someone steals your phone? Most of these Android phones are elementary to get into.

Me too, exacly that why smartphone security is more sux than even windows....

 

[Al-Faqir]

One should use a dedicated device for banking where possible.

 

[Ink]

This is why I never bank using smartphones...these banking apps ask you to save your password too, lol!

What if someone steals your phone? Most of these Android phones are elementary to get into.

None of the Banking Apps I have used allow to Save Login Credentials, they either require a long PIN or Fingerprint.

If that option is available, do not use it.

It's your responsibility to take the necessary precautions (Anti-Theft enabled, a non-guessable 6+ digit PIN, Biometric (Fingerprint, Iris). But if your phone does get lost or get stolen, then you should be able to remotely locate, activate siren or wipe the device before it's put into Airplane mode or Turned off.

One should use a dedicated device for banking where possible.

It's never a good idea to use a Shared PC for Internet Banking, or a Shared device for Mobile Banking. You should just use Telephone Banking instead, @Entreri