It was a case of getting out of the frying pan and into the fire as users who turned to digital payments to stay safe during the Covid-19 pandemic ended up falling victim to banking malware.
Kaspersky global research and analysis team director Vitaly Kamluk says analysis of “threat data” revealed a parallel between customers going cashless and the use of Trojans to steal banking credentials.
Like its Greek namesake, the Trojan malware is snuck into a victim’s computer disguised as a harmless program.
Once inside, it stays unnoticed while reading passwords, recording keyboard strokes or opening the door for further malware that can even take the entire computer hostage, according to the cybersecurity firm.
Kamluk says a Trojan can even be used to capture one-time passwords (OTPs) for online banking transactions and hijack a live online banking session from a legitimate user.
Trojans have existed for over a decade, becoming infamous in Asia Pacific countries that spearheaded digital payments, including South Korea, China and Japan, back in 2011 to 2012.
The Trojan trend died down in 2013, according to Kaspersky, but made a resurgence in developing countries in 2019.
“Banking Trojans were not the biggest concern of many countries in Asia Pacific until 2019 when an outbreak of infections appeared in multiple countries at once,” says Kamluk.
The trend peaked in Asia Pacific early last year, he says, with cases increasing by up to 250% compared with the lull from 2013 to 2017.
“In several countries, including Malaysia and Vietnam, a high number of cases continue to be reported, staying above 2019 levels.
“From then on there was no looking back,” he says, adding that banking Trojans pose a significant threat to financial organisations and individuals as adoption of digital payments rises.
Trojan war
As of October this year, the Philippines was the hardest hit by banking Trojans, accounting for 22.26% of unique users attacked in Asia Pacific, followed by Bangladesh (12.91%) and Cambodia (7.16%).
Malaysia ranked 11th, recording 3.12% of the attacks, while neighbours Indonesia accounted for 6.84% and Singapore only for 0.25%.
Based on an analysis of around 300 publicly reported financial sector incidents since 2007, threat actors have been categorised into several main groups: criminal groups seeking personal gains mainly by hacking payment processing systems and ATM networks; state-sponsored actors compromising other nations’ financial systems; and insiders stealing corporate info or client data.
Certain attacks were conducted by multiple types of groups and in some cases the identity of perpetrators could not be established.
“The proportion of the unknown has grown over time, which is an alarming trend.
“With the growth of the number of attacks, financial institutions are becoming less and less capable of identifying who attacked them,” Kamluk says, adding that unidentified threat actors were behind 60% of the attacks in 2020, a figure that’s expected to rise up to 75% this year.
The Financial Services Information Sharing and Analysis Centre (FS-ISAC), a global cyber intelligence sharing community for financial services, also found banking Trojans to be among the top cybersecurity threats to financial institutions in Asia Pacific in addition to ransomware and supply chain attacks.
“As digitalisation of financial services across Asia Pacific takes place at record speed, firms should be aware of the accompanying pitfalls and take steps to mitigate them,” says FS-ISAC managing director Christophe Barel.
The organisation’s 2021 Cyber Trends And Threats Review also found a lack of cybersecurity talents to keep up with the pace of digital expansion, which may expose more financial institutions to emergent threats.
To combat new and existing dangers, says Barel, it’s essential for institutions to share intelligence on tools and techniques employed by cybercriminals, including methods to defend against them.
Mobile mayhem
Finnish tech company Nokia Corp also discovered a similar trend – hackers going after personal banking credentials and credit card information as the world saw a surge in mobile banking due to increased smartphone usage.
Its Threat Intelligence Report 2021 – based on network traffic data from more than 200 million devices globally – discovered an 80% year-on-year increase in the number of new banking Trojans in the first half of the year that steal SMSes containing OTPs.
“As of early 2021, there were 5.22 billion unique mobile users worldwide, and nearly 80% of them had used their mobile device for online purchases.
“These numbers have paved the way for a new type of threat with the potential to affect individuals directly,” reveals the report.
Banking malware has been mainly used to target Android smartphones due to the operating system’s ubiquity and use of open standards.
According to web traffic analysis service Stat Counter, as of July 2021, Android commands 72.21% of the market, followed by Apple’s iOS (26.92%). All other mobile operating systems made up just 0.81%.
Nokia explains that banking Trojans can even create an overlay to capture information that a user inputs, say, while on the bank login screen.
One of the notorious banking Trojans attacking Android smartphones this year is FluBot which is disguised as a delivery tracking app.
Victims are sent an SMS purportedly from major package delivery companies, requiring them to install a tracking app which is actually the FluBot.
Other malware on the rise are TeaBot, which masquerades as a video app, and BlackRock which gets installed through an app update via third-party app stores.
Despite the dangers, Kaspersky Asia Pacific managing director Chris Connell points out that electronic payments have helped enhance the economic and social well-being of billions of people during the pandemic.
Also, Asia Pacific has remained the leader in the payments industry over the past 10 years, generating US$630bil (RM2.65 trillion) last year alone.
“The surging demand for digital payments has transformed the way we transact both online and offline.
“Businesses are now digitalising their operations to capture additional revenue through digital payments which consumers are heavily reliant on due to the ease and convenience,” he says.
Staying safe
Connell notes that a large number of people had reservations prior to using mobile banking or payment apps for the first time.
Concerns cited include losing money online (48%), storing their financial data on the Cloud (41%) and not trusting the platforms’ security measures (35%).
Many also find the technology too troublesome as it requires managing passwords and security questions (26%), while 25% confessed that their personal devices were not secure enough.
“It is a welcome finding that the public is aware of the risks that comes with online transactions and because of this, developers and providers of mobile payment applications should now look into the cybersecurity gaps in each stage of the payment process, and implement security features or even take a secure-by-design approach to fully gain the trust of future and existing digital payment adopters,” says Connell.
His advice to users new to digital payments include being cautious of fake communications, especially when handing over sensitive information.
He also reminds them to never share their passwords or OTPs.
Where possible, he urges users to use their own computer or Internet connection when making online payments, he says.
“Like how you would only make purchases from trusted stores when shopping physically, translate that to making payments online – you never know if public computers have spyware recording everything you type,” he explains.
Meanwhile, Kamluk advises users to switch to stronger, more complex passwords and to set up two-factor authentication which adds another layer of security.
Two-factor authentication requires an additional form of verification apart from passwords.
This can take the form of security questions, biometric authentication like a fingerprint or facial scan, and OTP.
However, there are challenges associated with the use of SMS-based two-factor authentication, he says.
The use of SMS can be unreliable, as password-bearing messages can be intercepted by a Trojan lurking in a smartphone, or through a basic flaw in the SS7 protocol used to transmit messages, says Kamluk.
SS7, which stands for signalling system No. 7, is a set of protocols that allow phone networks to exchange the information needed for passing calls and text messages between each other, as well as to regulate billing.
It would be advisable to use authenticator apps which are entirely self-contained, he says, with the SMS option used only as a last resort to minimise exposure to attacks.
According to Kamluk, even biometrics are not infallible – while it’s easy to implement and hard to alter, the biometric data is still a form of digital data and if hackers can access it, the data can be misappropriated for nefarious purposes.
“Think Mission Impossible in which spies use voice recordings and printouts of someone’s fingerprint to get access into the mainframe,” he says.
It’s also essential to ensure that the user is more thorough in keeping their software updated regularly, paying attention to security software alerts in particular.
Otherwise users could miss out on patches that could have stopped malware that has been discovered by cybersecurity firms and software developers.
He points out that corporations also need to do more to beef up their security, including running cybersecurity drills and hiring reliable vendors to assist the in-house IT department to defend the company’s digital assets.
Companies have to keep abreast of current cybercrime trends and attacks to avoid falling for the same traps, he says, adding that staff must also be motivated to report suspicious findings.
Already a subscriber? Log in
Get 20% OFF The Star Digital Access
Cancel anytime. Ad-free. Unlimited access with perks.
