4 ms·

New Phishing Technique Bypasses Security on iOS and Android to Steal Bank Creds

52 points by LinuxBender 2y ago

Pfhortune 2y ago
PWA as a mechanism for delivering phishing apps is an interesting avenue. I would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question whether they are doing the right thing. The fact that folks did not find it odd that they had to do a particular dance to install the "app" from the "app store" is just... tragic. I do not know what education is like where this campaign seems to have taken place (Czech Republic), but really basic tech literacy should be taught in schools. I know it's tricky to teach someone to be tech literate with a moving target like evolving tech, but we should be _trying_.
- szundi 2y ago
  This so-called basic tech literacy is obsolete in some years. We just don’t get it how can people be so disinterested in how things work.
- mxuribe 2y ago
  Tech literacy even in this day and age isn't equally distributed everywhere. Also, i wonder if this is a generational thing...Because a couple decades ago, there was a generation (or at least a percentage of the generation) that learned through pain that installing unknown apps on a desktop became a risky potentially harmful thing to do. Then the Web came along and that generation being more savvy on the desktop side had to learn that websites (even without "installing something on the desktop) also come with risks and problems...and now we have a likely younger generation who never lived through the dangers of installing stuff on a device....they've known web stuff and app stores...and have grown to somewhat trust app stores...so they lack the understanding of risks associated with "installing stuff". I have only personal data to substantiate my theory...so i'm just talking out of my pocket. :-)
- rollcat 2y ago
  > basic tech literacy should be taught in schools You're blaming the victim. Technology is too complex and continues changing too fast. I'm a software engineer and I couldn't tell you what half the processes on my machine are supposed to be doing, and even if I did that wouldn't help spot even a trivial piece of malware. Last time I attended school, smartphones didn't even exist yet. That's fair; sometimes there's a fundamental shift in how we do things. But meanwhile Google alone launched and killed how many chat/video call apps? Unfortunately you have to keep installing these every now and then, because that's somehow still an unsolved problem. Security is simplicity, if a system is complex then it's easy to confuse the user into doing the insecure thing.
  - Pfhortune 2y ago
    Fair. Though I still think we need a tech equivalent of "look both ways before crossing the street." Though as I type this and think it through... Cars aren't trying to deliberately camouflage themselves as harmless parts of the environment, which is the logical equivalent to this particular case.
    - rollcat 2y ago
      And cities designed for humans (as opposed to cars) take a lot of care to slow down (or entirely divert) the traffic in places where there are a lot of humans, make crossings safer, provide decent public transport, keep cyclists safe, etc. In my current city (Vienna), I still tend to look both ways out of habit, but in many places (like my neighbourhood) I actually feel safe crossing without actively looking.
- ignoramous 2y ago
  > would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question The og article by ESET Security [0] specifically talks about (Android/Chrome-supported) WebAPKs essentially bypassing the usual "untrusted sources" warning, and that even the App Info screen shows Play Store as the origin source for all installed WebAPKs. > tricky to teach someone to be tech literate with a moving target Not fool proof, but given the IoCs, think it might be best to block all but top 50k domains by default. Or, inform users if a domain they've never previously visited asks them to enter anything via clipboard or keyboard. [0] https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pwish-for-phishing-in-pwa-applications/ https://www.welivesecurity.com/en/eset-research/be-careful-w... / https://archive.md/29SKK https://archive.md/29SKK (hat-tip u/ChrisArchitect)
- mook 2y ago
  I'm not sure tech literacy can be taught, but mostly because of the constant treadmill of changing UIs. Things that used to be safe are not anymore, because people (Chrome in this case) keeps trying to make things "easier", damn the consequences.
ChrisArchitect 2y ago
Source: https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pwish-for-phishing-in-pwa-applications/ https://www.welivesecurity.com/en/eset-research/be-careful-w...
coolspot 2y ago
That is why we can’t have nice things. Apple will surely point to this situation as a justification for the AppStore.
- dzhiurgis 2y ago
  Maybe PWAs shouldn't set icon and name should be a hardcoded url user can't change
  - Pfhortune 2y ago
    Android at least does show a little browser badge on PWAs. (Or is this a feature of certain launchers? I'm not sure). iOS should do the same, once Apple is done pretending PWAs don't exist.
CatWChainsaw 2y ago
This reinforces my decision to never do my banking on my phone.
- dzhiurgis 2y ago
  More like be wary of false security that App Store instilled
  - CatWChainsaw 2y ago
    Or, like, both.
isodev 2y ago
Why is this a "new" technique? The "this looks like your bank/legitimate app/website" scheme has been around for a very long time.
- lxgr 2y ago
  "But I'm not on a website, I'm in my banks app! I know because I got there by clicking on my bank's icon on my home screen!"
lxgr 2y ago
> WebAPKs, which can be considered upgraded PWAs, appear like regular native apps and their installation does not trigger any warnings on Android devices, even if the user has not allowed installation from third-party sources. This seems to be a mischaracterization/misunderstanding of what WebAPKs are. As far as I understand, they're merely an implementation detail of how Chrome on Android makes PWAs feel "more native": https://web.dev/articles/webapks#frequently_asked_questions https://web.dev/articles/webapks#frequently_asked_questions In other words, any installed PWA gets a corresponding WebAPK, and there's no actual vetting by the Play Store involved. I don't really understand the point of that, and there seem to be significant security downsides (via user confusion, as demonstrated here), but I don't know the details, and there's probably a technical reason why Google did it this way.

52 points by LinuxBender 2y ago

PWA as a mechanism for delivering phishing apps is an interesting avenue. I would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question whether they are doing the right thing. The fact that folks did not find it odd that they had to do a particular dance to install the "app" from the "app store" is just... tragic. I do not know what education is like where this campaign seems to have taken place (Czech Republic), but really basic tech literacy should be taught in schools. I know it's tricky to teach someone to be tech literate with a moving target like evolving tech, but we should be _trying_.

szundi 2y ago
This so-called basic tech literacy is obsolete in some years. We just don’t get it how can people be so disinterested in how things work.
mxuribe 2y ago
Tech literacy even in this day and age isn't equally distributed everywhere. Also, i wonder if this is a generational thing...Because a couple decades ago, there was a generation (or at least a percentage of the generation) that learned through pain that installing unknown apps on a desktop became a risky potentially harmful thing to do. Then the Web came along and that generation being more savvy on the desktop side had to learn that websites (even without "installing something on the desktop) also come with risks and problems...and now we have a likely younger generation who never lived through the dangers of installing stuff on a device....they've known web stuff and app stores...and have grown to somewhat trust app stores...so they lack the understanding of risks associated with "installing stuff". I have only personal data to substantiate my theory...so i'm just talking out of my pocket. :-)
rollcat 2y ago
> basic tech literacy should be taught in schools You're blaming the victim. Technology is too complex and continues changing too fast. I'm a software engineer and I couldn't tell you what half the processes on my machine are supposed to be doing, and even if I did that wouldn't help spot even a trivial piece of malware. Last time I attended school, smartphones didn't even exist yet. That's fair; sometimes there's a fundamental shift in how we do things. But meanwhile Google alone launched and killed how many chat/video call apps? Unfortunately you have to keep installing these every now and then, because that's somehow still an unsolved problem. Security is simplicity, if a system is complex then it's easy to confuse the user into doing the insecure thing.
- Pfhortune 2y ago
  Fair. Though I still think we need a tech equivalent of "look both ways before crossing the street." Though as I type this and think it through... Cars aren't trying to deliberately camouflage themselves as harmless parts of the environment, which is the logical equivalent to this particular case.
  - rollcat 2y ago
    And cities designed for humans (as opposed to cars) take a lot of care to slow down (or entirely divert) the traffic in places where there are a lot of humans, make crossings safer, provide decent public transport, keep cyclists safe, etc. In my current city (Vienna), I still tend to look both ways out of habit, but in many places (like my neighbourhood) I actually feel safe crossing without actively looking.
ignoramous 2y ago
> would have thought the hoops Android/iOS make you jump through to add a PWA would be enough to make people question The og article by ESET Security [0] specifically talks about (Android/Chrome-supported) WebAPKs essentially bypassing the usual "untrusted sources" warning, and that even the App Info screen shows Play Store as the origin source for all installed WebAPKs. > tricky to teach someone to be tech literate with a moving target Not fool proof, but given the IoCs, think it might be best to block all but top 50k domains by default. Or, inform users if a domain they've never previously visited asks them to enter anything via clipboard or keyboard. [0] https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pwish-for-phishing-in-pwa-applications/ https://www.welivesecurity.com/en/eset-research/be-careful-w... / https://archive.md/29SKK https://archive.md/29SKK (hat-tip u/ChrisArchitect)
mook 2y ago
I'm not sure tech literacy can be taught, but mostly because of the constant treadmill of changing UIs. Things that used to be safe are not anymore, because people (Chrome in this case) keeps trying to make things "easier", damn the consequences.

ChrisArchitect 2y ago

Source: https://www.welivesecurity.com/en/eset-research/be-careful-what-you-pwish-for-phishing-in-pwa-applications/ https://www.welivesecurity.com/en/eset-research/be-careful-w...

coolspot 2y ago

That is why we can’t have nice things. Apple will surely point to this situation as a justification for the AppStore.

dzhiurgis 2y ago
Maybe PWAs shouldn't set icon and name should be a hardcoded url user can't change
- Pfhortune 2y ago
  Android at least does show a little browser badge on PWAs. (Or is this a feature of certain launchers? I'm not sure). iOS should do the same, once Apple is done pretending PWAs don't exist.

CatWChainsaw 2y ago

This reinforces my decision to never do my banking on my phone.

dzhiurgis 2y ago
More like be wary of false security that App Store instilled
- CatWChainsaw 2y ago
  Or, like, both.

isodev 2y ago

Why is this a "new" technique? The "this looks like your bank/legitimate app/website" scheme has been around for a very long time.

lxgr 2y ago
"But I'm not on a website, I'm in my banks app! I know because I got there by clicking on my bank's icon on my home screen!"

lxgr 2y ago

> WebAPKs, which can be considered upgraded PWAs, appear like regular native apps and their installation does not trigger any warnings on Android devices, even if the user has not allowed installation from third-party sources. This seems to be a mischaracterization/misunderstanding of what WebAPKs are. As far as I understand, they're merely an implementation detail of how Chrome on Android makes PWAs feel "more native": https://web.dev/articles/webapks#frequently_asked_questions https://web.dev/articles/webapks#frequently_asked_questions In other words, any installed PWA gets a corresponding WebAPK, and there's no actual vetting by the Play Store involved. I don't really understand the point of that, and there seem to be significant security downsides (via user confusion, as demonstrated here), but I don't know the details, and there's probably a technical reason why Google did it this way.