Mobile Viruses in Man-in-the-Mobile Vs Multi-Factor authentications

By YGN Ethical Hacker Group -
Smart phones are drawing attackers' attentions especially for monetary gains. Viruses are targeting mobile platforms to compromise multi-factor authentication. Zeus is one of them.

we imagine a rough scenario how a mobile virus can compromise currently used assuming foolproof multi-factor authentication nowadays' banking industry use .
  1. USER Logins to FAKE BANKING SITE inspired by PHISHING Attack
  2. FAKE BANKING SITE asks USER to enter ONE TIME Device token to login to Actual Banking Site
  3. LOGIN SUCCESSFUL
  4. FAKE BANKING SITE Adds new Payee
  5. ACTUAL Banking Site asks ONE-TIME Device Token
  6. FAKE BANKING SITE asks USER to enter ONE TIME token to login to Actual Banking Site by showing UNSUCCESSFUL Login
  7. FAKE BANKING SITE submits ONE-TIME Device Token to ACTUAL Banking Site
  8. ACTUAL Banking Site sends ONE-TIME Authentication Token to USER's Mobile
  9. FAKE BANKING SITE Asks ZEUS VIRUS to silently Submit Token in SMS to Actual Banking Site
  10. FAKE BANKING SITE submits ONE-TIME Authentication Token to ACTUAL Banking Site
  11. ADDING PAYEE SUCCESSFUL
  12. FAKE BANKING SITE Transfers User's Money to New Payee
  13. ACTUAL Banking Site asks ONE-TIME Device Token
  14. FAKE BANKING SITE asks USER to enter ONE TIME token to login to Actual Banking Site by showing UNSUCCESSFUL Login
  15. FAKE BANKING SITE submits ONE-TIME Device Token to ACTUAL Banking Site
  16. ACTUAL Banking Site sends ONE-TIME Authentication Token to USER's Mobile
  17. FAKE BANKING SITE Asks ZEUS VIRUS to silently Submit Token in SMS to Actual Banking Site
  18. FAKE BANKING SITE submits ONE-TIME Authentication Token to ACTUAL Banking Site
  19. MONEY TRANSFER SUCCESSFUL





Comments

Post a Comment

Popular posts from this blog

Bypassing referrer check with no script involved

By YGN Ethical Hacker Group -
No more to use scripting approach like https://github.com/knu/noreferrer This useful meta tag helps for CSRF POC preparation when you come across an application that checks referrer header: <meta name="referrer" content="no-referrer"> https://caniuse.com/#feat=referrer-policy
Read more

Jumping out of Touch Screen Kiosks

By YGN Ethical Hacker Group -
Image
Background: Nowadays, the use of large touch screen kiosks has been prevalent.  They are to replace tradition paper-based brochures and to provide more interactive means to consumers. In restaurants, you can see a variety of food menu that can be accessible in large touch screen LCD monitor.  In your local Telcos, you can see a variety of mobile and Internet subscriptions plans.   Behind these touch screen menus are running standalone or browser-mode Adobe Flash applications which are second-to-none for interactivity and scalablity and ease of update. Data could be pulled from somewhere round their centralized web severs. Weakness: Jumping out We cannot use  iKat  at first as we do not have access to any keyboard facility. However, the trick is no-brainer. Do long press on any locations and relieve.  You should see the usual Flash context menu like: Touch "Global Settings".  A web browser window will pop up and redirect to the Adobe ...
Read more