FBI warns hackers are targeting mobile banking apps | Hacker News Reader

FBI warns hackers are targeting mobile banking apps

thehill.com

43 pointselorant46 comments

> In order to combat these threats, the FBI recommended that Americans only download banking apps from official app stores or from banking websites.

I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from.

Agreed. Otherwise, modern mobile OSs are pretty tough to penetrate. iOS in particular.

I pretty much exclusively use my iPhone for financial services specifically because it's so much less insecure than even the best desktop OS.

It's been a lifesaver to reduce my IT time taken to clear family computers of malware since getting them iPads.

> iOS in particular

False [1,2]. For a while iOS was hanging in there because persistence was difficult, but not anymore.

Banking on your phone, unless it is a segregated account with limited funds, is a seriously bad idea.

[1] https://www.wired.com/story/android-zero-day-more-than-ios-z...

[2] https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply...

Your links fail to support the point that banking on your phone is a "seriously bad idea".

It supports the conclusion that iOS is not the security miracle people sometimes claim it is.

If your device can be persistently compromised and you use it for general purpose browsing/email, it follows that using it to manage your money is a seriously bad idea.

I haven’t heard of anyone persistently compromising iOS for quite a long time. Regardless, your links do point towards iOS having issues with security, but they still don’t support the claim that you shouldn’t use it for online banking. The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars and nobody is going to leverage on of those to part you from a couple thousand dollars–it just wouldn’t make sense. Those kinds of vulnerabilities are almost exclusively aimed at individuals or small groups of people for generally political motivations.

> The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars

I linked an article that says the opposite.

> I haven’t heard of anyone persistently compromising iOS for quite a long time

a thread from a few weeks ago: https://news.ycombinator.com/item?id=23287364

> nobody is going to leverage on of those to part you from a couple thousand dollars

If the cost of countering the threat is using a $40 Raspberry Pi to do your banking, what's the problem?

>using a $40 Raspberry Pi to do your banking

So exploits for iOS have recently been published whereas Linux and Firefox have warm and fuzzy associations, so clearly Linux and Firefox will work better than iOS in this case. Is that your argument?

(I mention Firefox because all of the online banking arrangements I know of rely on iOS, Android or a web browser.)

The point I'm trying to make is that compartmentalizing things is good, because compromise happens. Don't bank where you browse and email.

OK, good point.

More likely getting a spoofed email suggesting they download the Bank's latest-and-greatest app by clicking the link.

As someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in

> who would download their banking apps from hax0rs.rus

Having empathy with users that don't act perfectly skeptical 100% of the time and who don't read all of the text (like none of us read 100% of the EULAs every time we click the "accept terms" button/checkbox) will allow us to build systems which are more robust to the occasional distracted user, overlooked typo, user who doesn't know how o mentally parse a URL to identify the domain, etc.

Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores. It's ridiculously easy not to accidentally download an iOS app from a 3rd party app store, because they simply aren't possible without jailbreak / install developer cert.

> Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app store

I think most (myself included) are just advocating for Apple to allow side-loading. They can keep their app store intact. See https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper for more about an ongoing case

You mean installing apps via your less-safe computer?

Browsers used to allow any software to side-load extensions and you know how that went: They all moved to store-only installs because all kinds of software were able to affect the browsers.

Same way for side-loading apps to your phone. Sure it’s more difficult than just tapping something on the web, but it doesn’t mean it’s safe for the end user.

Please don't use the term all browsers when referring to Chrome. A situation like Ad Nauseum and Chrome would never arise on Firefox.

How about the bank's own website? I trust that more than any "app store" (which is, after all, run by a third-party) for downloading its app.

The problem there is phishing. If you trust the bank's site but you don't realize that you aren't on the bank's site then you're screwed. Sure, this doesn't apply to you; it only applies to 90% of humanity.

I'm not sure why this is being downvoted.

Return navigating to the bank website by bookmark on the OS/browser is great. Via link from SMS/Email... not so much.

The state of URL readability on mobile platforms is terrible, people fall for phishing all the time it’s easy to blame the users but it’s a solution to the problem.

Phishing via email, texts and ads in apps heck even Google at times had phishing URLs come up in search results, CDNs being compromised and transport attacks (e.g. hotspots) make distribution over browsers a problem.

AppStores allow you at least in theory to validate an app not only to be the app that you want to download but also that the app does what the developer claims it does, it also facilitates distribution segmentation by region and device (especially important for Android) and automatic updates.

Not sure about you but I’ll trust the Apple AppStore more than any given bank website simply by being familiar with the security teams and practices in FAANG vs commercial banking.

How about urgent app security update email from

Customerprotection@Yourbank.com

Probably even my tech/developer etc friends some might click that update.

Who'd input the credit card on a random website that has suspicious discounts? Who'd give his SSN through the phone to someone saying the bank is calling to verify some details? Who'd believe an email saying that it's the bank and you need to update your app ASAP by clicking on this link or you'll lose access to your account?

They (or we) are not stupid, they just don't know better and we should try to shield them from these risks as much as possible.

Look up “boa login”, tap ad, YOUR PHONE HAS A VIRUS, tap to install. Suddenly you have a bank app on your phone.

You’re welcome.

This happens more often than you’d think. It’s even easier when you get targeted attacks via sms saying approximately the same thing. People don’t look at the URL bar.

The user might have downloaded an APK from a phishing website, or received an APK by e-mail claiming to be from their bank.

>I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from.

I'm guessing the people that believe the hax0rs.rus version believes something like, 'get extra money on each deposit with our hacked version' or 'don't like bank fees?? Try the hax0rs.rus version to avoid those pesky bank fees'.

But more realistically, I imagine it's people clicking fraudulent links disguised as legitimate looking things from their bank. As apparent as things like that may seem to people who understand the web, it's not always obvious to people who haven't spent a million hours on the internet.

Most people eventually learn to pick up a sense about what's legit and not on the web, but it really does take a long time. I'm sure at some point over all your years of computing and interneting you've probably downloaded at least one shady application or clicked one sketchy link by mistake, I know I have, and if you haven't I commend you honestly.

I used to be quite annoyed with 2FA (although I understood the value)... and was particularly annoyed when one of my banks made 2FA mandatory.

Begrudgingly shlupping myself to the other room to locate my phone and get a texted code...

But, after receiving 3 different password reset emails in a short period for different services, I decided to enable 2FA for everything that supports it. Where possible, choosing the Time Based 2FA instead of texting codes (just in case I lose my phone or something).

With the right mindset (and paranoia), I'm coming around to viewing this inconvenience as necessary, and wish more services supported it.

The kind that Google and Microsoft (and maybe others) do is pretty great. You get a push notification on your phone and just tap "Yes", and you're in. Of course, you should still have a fallback like OTP for when your phone is not internet-connected, but it feels really seamless and is a very minor inconvenience.

If you have 1Password it makes software-based 2FA so easy that you'll barely notice it's on. Though I haven't been able to find a single US bank that supports software 2FA.

Does 1Pass support 2FA or otherwise handle it? I have been using 1Pass for years, but use a different app for my MFA.

Yep. If you have the desktop app installed, look for Two-Factor Authentication under Watchtower and it'll tell you all the sites that can use it. It's easy to set up too, it can scan a QR code on your screen. Some people believe that it's more secure to not mix your password manager with your 2FA though, since it's not "true 2FA".

You could also look at Bitwarden. I'm not affiliated, but it's an amazing password manager (desktop app, mobile apps, browser extensions). Even better, it's fully open source; you can even run your own server to keep out a third-party being your (encrypted) sync server. I've been using it for a couple of years now, and have never had a single problem. Free for personal use of almost everything… an upgrade to include the two-factor auth you're looking for is a very cheap $10/year.

I got a little U2F token that I leave plugged into my laptop and set it up on everything that supports it. It's really nice because you don't have to stop and hunt down a code, or a phone or app, just tap the side and it lets you in. I just wish more sites supported it.

In terms of both UX and authentication strength it's infinitely better than SMS/email/TOTP 2FA in every way. (My understanding is most alternatives, including SMS and google auth type TOTP, are still vulnerable to MitM attacks whereas U2F tokens solve that too).

Banking shouldn't be done from your phone IMO. It should be done from a secure location (your home) on a computer you can trust (not Windows). I don't get the rationale for requiring to do bank ops so often that you need to do them on a phone. Protect yourself.

I agree, but I would take this a step further. A lot of security breaches happen with social engineering. So, if someone can call or text you, they might convince you to give away your banking information or sensitive personal details. For me that means I destroyed my smartphone and no longer speak to my family, certainly not with an insecure operating system that I didn’t write myself.

Your phone is a much harder target than your general purpose computer.

My bank recently switched to 2FA but only allows authentication via SMS when logging in. I wish they didn't do that considering how relatively easy it is to sim-hijack those things.

What is this virus trojan that waits until you download a legit banking app and swaps the icon?

I see "the banking trojan then overlays the app" which isn't swapping the icon. Overlay malware is well known on Android, e.g. https://securityintelligence.com/posts/new-android-banking-t... https://github.com/geeksonsecurity/android-overlay-malware-e...

This is why I'll never access banking data through an app or mobile browser. All it takes is the right zero day and millions of people are compromised. Coupled with the general crappiness of Zelle and you can kiss your money goodbye.

Desktop browsers are hardly invulnerable to zero days.

Yeah, but you can keep a separate computer exclusively for finance, medical, etc.

A Raspberry Pi 3 is like $40.

You shouldn't be doing banking on the same device you use for generic browsing and email.

It's really strange to me that the security community isn't proselytizing "security through compartmentalization".

99% of people will never follow that advice.

If someone can access my email, they can probably reset my password and get the 2fa codes, no? Not sure what a separate computer would gain me if a break in either is the end of the line.

> If someone can access my email, they can probably reset my password and get the 2fa codes, no?

No? 2FA exists precisely to prevent that sort of attack model.

Most banks think 2fa means they email you a code. At least the ones I've used, I've yet to find one that implemented an actual hardware key or even totp.

Reply on news.ycombinator.com