1. Win the Cyberwar on Mobile Banking and Payments
Jeff Fu
Bangcle Security – SecNeo Ltd.

2. You Probably Already Know About
Mobile Banking Threats
But you might not know there’s an entire illegal industry dedicated to mobile banking.
Do you know what keys Cybercriminals have?
How they steal money from Android App?

3. 2013 Malware Threats on Mobile
2013:
143,211 New malwares
3,905,502 Malicious installation packages
For the 259 new malware families on Q3, 2013
In total:
Approximately 10,000,000 unique
malicious installation packages

4. Malware Threats on Android
2013
Malware Threats on Android
2013
Android remains a prime target for malicious attacks % of all malware detected in 2013 targeted this platform, confirming both the popularity of this mobile OS and the vulnerability of its architecture.

5. Malware Target Mobile Banking
2013
Malware Target Mobile Banking
2013
2013 The number of mobile banking malware
The cyber industry of mobile malware is becoming more focused on making profits more effectively.
I.e., mobile phishing, theft of credit card information, money transfers from bank cards to mobile phones and from phones to the criminals’ e-wallets.
2013 was marked by a rapid rise in the number of Android banking Trojans.

6. The Geography of Mobile Threats
2013
Country
% of all attacked unique users 1
Russia
40.34% 2
India
7.90% 3
Vietnam
3.96% 4
Ukraine
3.84% 5
United Kingdom
3.42% 6
Germany
3.20% 7
Kazakhstan
2.88% 8
USA
2.13% 9
Malaysia
2.12% 10
Iran
2.01%
Countries where users face the greatest risk of mobile malware infection (the percentage of all attacked unique users)

7. Mobile Banking Virus-Svpeng
Svpeng detected by Kaspersky as Trojan-SMS.AndroidOS.Svpeng.A
Collects phone information
Steals voice call SMS messages
Steals money from the victim’s bank account
Steals logins and passwords to online banking accounts
Steals bank card information (the number, the expiry date, CVC2/CVV2) ,

8. My App Is Already Safe Enough
My app is good designed, I considered all the potential risks. My app is good programed by senior engineers. My app is completely tested, all the bug is fixed. My app is published to the Google Market. My customers installed the official released Apps.
Yes, I believe you have done
all what you can do
But your App is still in danger

9. Tampering and Reverse-engineering Attacks
Attack Method
Solution
Bypass Integrity protection and verification No
Steal source code and security logic
Repacking the App and conducting fraud
Repacking the App and inserting malware code
Bypass the local security control
Move security control to server side
Get the symmetric encryption password and decryption local data
Use asymmetric encryption

10. Dynamic Injection and Hijack Attack
Attack Method
Solution
Dynamic memory injection attack to modify transaction information No
Dynamic components hook attack get account ID, password
UI hijack attack to get user input
Keyboard hijack attack to get user input
MAN-IN-THE-MOBILE attack
MAN-IN-THE-MIDDLE attack

11. Dynamic injection Demo
Hacker injected the payment components
Hacker intercepted the transaction data before it is encrypted
Hacker modified the account ID and user name
The money is transferred to hacker’s account
Hacker tamper the invoice message or SMS and changed them back to original transaction account and user name

12. Root Cause for All These Attacks
Integrity protection failure of Mobile Banking App is the root cause for the most attacks.
Static integrity protection failure
Dynamic integrity protection failure
We need to make sure:
The App used by the customers is not tamped and repacked
The App is always running the same as designed
The information in the App can not be accessed and modified
All the security logic can not be bypassed

13. Financial App Protection
The leading App Security Provider in the world
2013
In past 3 years, Bangcle provides services to:
100+ Financial and e-Payment Apps
500+ Business App developers
Our security products covered more than 300,000,000 smart devices
Financial App
Integrity Protection
Financial App
Runtime Protection
Financial App
Data Protection

14. Join our Workshop
Enable Enterprise-grade Security into your Mobile Apps
Schedule: March 19, 4:00 PM ~ 4:45 PM
Join us to get more detail information about Bangcle Mobile Banking Security Solution

15. Visit our Booth Number - F01

16. Thanks