6 ms·
FBI warns hackers are targeting mobile banking apps
- deepspace 6y ago> In order to combat these threats, the FBI recommended that Americans only download banking apps from official app stores or from banking websites. I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from.
- hcurtiss 6y agoAgreed. Otherwise, modern mobile OSs are pretty tough to penetrate. iOS in particular.
- _bxg1 6y agoI pretty much exclusively use my iPhone for financial services specifically because it's so much less insecure than even the best desktop OS.
- thephyber 6y agoIt's been a lifesaver to reduce my IT time taken to clear family computers of malware since getting them iPads.
- rmrfstar 6y ago> iOS in particular False [1,2]. For a while iOS was hanging in there because persistence was difficult, but not anymore. Banking on your phone, unless it is a segregated account with limited funds, is a seriously bad idea. [1] https://www.wired.com/story/android-zero-day-more-than-ios-zerodium/ https://www.wired.com/story/android-zero-day-more-than-ios-z... [2] https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply/ https://www.cyberscoop.com/ios-zero-day-zerodium-high-supply...
- saagarjha 6y agoYour links fail to support the point that banking on your phone is a "seriously bad idea".
- rmrfstar 6y agoIt supports the conclusion that iOS is not the security miracle people sometimes claim it is. If your device can be persistently compromised and you use it for general purpose browsing/email, it follows that using it to manage your money is a seriously bad idea.
- saagarjha 6y agoI haven’t heard of anyone persistently compromising iOS for quite a long time. Regardless, your links do point towards iOS having issues with security, but they still don’t support the claim that you shouldn’t use it for online banking. The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars and nobody is going to leverage on of those to part you from a couple thousand dollars–it just wouldn’t make sense. Those kinds of vulnerabilities are almost exclusively aimed at individuals or small groups of people for generally political motivations.
- rmrfstar 6y ago> The fact is that an exploit chain of that caliber would still require hundreds of thousands of dollars I linked an article that says the opposite. > I haven’t heard of anyone persistently compromising iOS for quite a long time a thread from a few weeks ago: https://news.ycombinator.com/item?id=23287364 https://news.ycombinator.com/item?id=23287364 > nobody is going to leverage on of those to part you from a couple thousand dollars If the cost of countering the threat is using a $40 Raspberry Pi to do your banking, what's the problem?
- frank2 6y ago>using a $40 Raspberry Pi to do your banking So exploits for iOS have recently been published whereas Linux and Firefox have warm and fuzzy associations, so clearly Linux and Firefox will work better than iOS in this case. Is that your argument? (I mention Firefox because all of the online banking arrangements I know of rely on iOS, Android or a web browser.)
- Alupis 6y agoMore likely getting a spoofed email suggesting they download the Bank's latest-and-greatest app by clicking the link.
- thephyber 6y agoAs someone who works on developing cybersecurity products, it's incredibly unhelpful to disdain users by assuming the worst case as in > who would download their banking apps from hax0rs.rus Having empathy with users that don't act perfectly skeptical 100% of the time and who don't read all of the text (like none of us read 100% of the EULAs every time we click the "accept terms" button/checkbox) will allow us to build systems which are more robust to the occasional distracted user, overlooked typo, user who doesn't know how o mentally parse a URL to identify the domain, etc. Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app stores, which necessarily means that users would have a higher cognitive load of researching which domains are more trusted app stores. It's ridiculously easy not to accidentally download an iOS app from a 3rd party app store, because they simply aren't possible without jailbreak / install developer cert.
- henryfjordan 6y ago> Also, there are plenty of people on HN that advocate for breaking down all of the walled garden app store I think most (myself included) are just advocating for Apple to allow side-loading. They can keep their app store intact. See https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper https://en.wikipedia.org/wiki/Apple_Inc._v._Pepper for more about an ongoing case
- wonderlg 6y agoYou mean installing apps via your less-safe computer? Browsers used to allow any software to side-load extensions and you know how that went: They all moved to store-only installs because all kinds of software were able to affect the browsers. Same way for side-loading apps to your phone. Sure it’s more difficult than just tapping something on the web, but it doesn’t mean it’s safe for the end user.
- Larrikin 6y agoPlease don't use the term all browsers when referring to Chrome. A situation like Ad Nauseum and Chrome would never arise on Firefox.
- flattone 6y agoHow about urgent app security update email from Customerprotection@Yourbank.com Probably even my tech/developer etc friends some might click that update.
- outime 6y agoWho'd input the credit card on a random website that has suspicious discounts? Who'd give his SSN through the phone to someone saying the bank is calling to verify some details? Who'd believe an email saying that it's the bank and you need to update your app ASAP by clicking on this link or you'll lose access to your account? They (or we) are not stupid, they just don't know better and we should try to shield them from these risks as much as possible.
- wonderlg 6y agoLook up “boa login”, tap ad, YOUR PHONE HAS A VIRUS, tap to install. Suddenly you have a bank app on your phone. You’re welcome. This happens more often than you’d think. It’s even easier when you get targeted attacks via sms saying approximately the same thing. People don’t look at the URL bar.
- dheera 6y agoThe user might have downloaded an APK from a phishing website, or received an APK by e-mail claiming to be from their bank.
- grawprog 6y ago>I would like to know who these people are who would download their banking apps from hax0rs.rus rather than, you know, the app store where they get all their other apps from. I'm guessing the people that believe the hax0rs.rus version believes something like, 'get extra money on each deposit with our hacked version' or 'don't like bank fees?? Try the hax0rs.rus version to avoid those pesky bank fees'. But more realistically, I imagine it's people clicking fraudulent links disguised as legitimate looking things from their bank. As apparent as things like that may seem to people who understand the web, it's not always obvious to people who haven't spent a million hours on the internet. Most people eventually learn to pick up a sense about what's legit and not on the web, but it really does take a long time. I'm sure at some point over all your years of computing and interneting you've probably downloaded at least one shady application or clicked one sketchy link by mistake, I know I have, and if you haven't I commend you honestly.
- Alupis 6y agoI used to be quite annoyed with 2FA (although I understood the value)... and was particularly annoyed when one of my banks made 2FA mandatory. Begrudgingly shlupping myself to the other room to locate my phone and get a texted code... But, after receiving 3 different password reset emails in a short period for different services, I decided to enable 2FA for everything that supports it. Where possible, choosing the Time Based 2FA instead of texting codes (just in case I lose my phone or something). With the right mindset (and paranoia), I'm coming around to viewing this inconvenience as necessary, and wish more services supported it.
- snazz 6y agoThe kind that Google and Microsoft (and maybe others) do is pretty great. You get a push notification on your phone and just tap "Yes", and you're in. Of course, you should still have a fallback like OTP for when your phone is not internet-connected, but it feels really seamless and is a very minor inconvenience.
- PascLeRasc 6y agoIf you have 1Password it makes software-based 2FA so easy that you'll barely notice it's on. Though I haven't been able to find a single US bank that supports software 2FA.
- ganstyles 6y agoDoes 1Pass support 2FA or otherwise handle it? I have been using 1Pass for years, but use a different app for my MFA.
- PascLeRasc 6y agoYep. If you have the desktop app installed, look for Two-Factor Authentication under Watchtower and it'll tell you all the sites that can use it. It's easy to set up too, it can scan a QR code on your screen. Some people believe that it's more secure to not mix your password manager with your 2FA though, since it's not "true 2FA".
- 6y ago
- kevin_thibedeau 6y agoThis is why I'll never access banking data through an app or mobile browser. All it takes is the right zero day and millions of people are compromised. Coupled with the general crappiness of Zelle and you can kiss your money goodbye.
- ceejayoz 6y agoDesktop browsers are hardly invulnerable to zero days.
- rmrfstar 6y agoYeah, but you can keep a separate computer exclusively for finance, medical, etc. A Raspberry Pi 3 is like $40. You shouldn't be doing banking on the same device you use for generic browsing and email. It's really strange to me that the security community isn't proselytizing "security through compartmentalization".
- wmf 6y ago99% of people will never follow that advice.
- kadoban 6y agoIf someone can access my email, they can probably reset my password and get the 2fa codes, no? Not sure what a separate computer would gain me if a break in either is the end of the line.
- deleted 6y ago[deleted]
- ceejayoz 6y ago> If someone can access my email, they can probably reset my password and get the 2fa codes, no? No? 2FA exists precisely to prevent that sort of attack model.
- tedunangst 6y agoWhat is this virus trojan that waits until you download a legit banking app and swaps the icon?
- wmf 6y agoI see "the banking trojan then overlays the app" which isn't swapping the icon. Overlay malware is well known on Android, e.g. https://securityintelligence.com/posts/new-android-banking-trojan-targets-spanish-portuguese-speaking-users/ https://securityintelligence.com/posts/new-android-banking-t... https://github.com/geeksonsecurity/android-overlay-malware-example https://github.com/geeksonsecurity/android-overlay-malware-e...
- user764743 6y agoMy bank recently switched to 2FA but only allows authentication via SMS when logging in. I wish they didn't do that considering how relatively easy it is to sim-hijack those things.
- sys_64738 6y agoBanking shouldn't be done from your phone IMO. It should be done from a secure location (your home) on a computer you can trust (not Windows). I don't get the rationale for requiring to do bank ops so often that you need to do them on a phone. Protect yourself.
- dangus 6y agoI agree, but I would take this a step further. A lot of security breaches happen with social engineering. So, if someone can call or text you, they might convince you to give away your banking information or sensitive personal details. For me that means I destroyed my smartphone and no longer speak to my family, certainly not with an insecure operating system that I didn’t write myself.
- closeparen 6y agoYour phone is a much harder target than your general purpose computer.