Attacks/Breaches
8/6/2013
02:52 PM
Dark Reading
Dark Reading
Quick Hits
50%
50%

Android Trojan Banking App Targets Master Key Vulnerability

Sluggish Android updates put users at risk. Could rising public awareness of the flaw lead carriers and device makers to patch more quickly?

Security researchers have spotted a legitimate banking app for Android smartphones and tablets that has been "trojanized" using the so-called master key vulnerability. That flaw, which affects all versions of Android prior to version 4.2.2, can be used by attackers to inject malicious code into a digitally signed, legitimate Android app.

In this case, attackers have been offering a trojanized update for a legitimate online banking app distributed by South Korea's NH Nonghyup Bank. The Android app is used by up to 10 million people.

Running the malicious app triggers a screen asking users to enter their account details. "Should the user comply, their information would be sent to a remote malicious server controlled by the cybercriminal," said Peter Yan, a Trend Micro mobile security engineer, in a blog post. In other words, people who fall for the attack would be likely targets for cybercriminals trying to drain their bank accounts

... Read full story on InformationWeek

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
8/27/2013 | 6:01:59 AM
re: Android Trojan Banking App Targets Master Key Vulnerability
Mathew I really enjoyed reading your article. I have to tell you, while working on my capstone project, which is an
Android application, I consulted various how-to's posted online. While looking
at them, I noticed a huge amount of security flaws. I created a list of some of
the most common errors that I found, and a section on how to properly remediate
them. I wrote this article that is mainly focused on Android development, but
it applies to other categories as well, hope to enjoy it: http://blog.securityinnovation...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

CVE-2015-0885
Published: 2015-02-27
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.