Sign in / up

back to article Dangerous Android banking bot leak signals new malware wave

Android users could be hit with a new wave of dangerous banking malware following the leak of source code for a capable Android trojan. Users could be targeted with variants of the malware, known as "GM Bot", that is capable of harvesting usernames and passwords using slick keystroke-capturing website overlays. Since it …

COMMENTS

Post your comment
House rules Send corrections
Add to 'My topics' unstar *
  1. Ru'

    Nice advice at the end, but is this (again) just a case of not installing non-play-store random apps?

    10 0 Reply
    1. Nigel Brown
      Reply Icon

      And possibly keeping away from less than salubrious websites.......

      2 0 Reply
    2. P. Lee
      Reply Icon
      Facepalm

      ... and not doing banking on the same device being used for two-factor authentication?

      That's kinda like running a browser on your RSA token device and being surprised when you get pwned.

      6 0 Reply
    3. Kraggy
      Reply Icon

      Given both Google's and Apple's 'official' stores have had and continue to have malicious apps discovered in them relying on these 'official' sources is clearly little defense.

      3 4 Reply
      1. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Its true that both Apple & Google have had issue on their mobile platforms, however I would not trust

        the security of the latter, or Windows for that matter.

        0 7 Reply
        1. Anonymous Coward
          Reply Icon
          Anonymous Coward

          "or Windows for that matter."

          Windows Mobile has a far far better security record than both Android and IOS.

          2 5 Reply
          1. nijam Silver badge
            Reply Icon

            > Windows Mobile has a far far better security record than both Android and IOS.

            Because you can't actually do anything with it?

            3 3 Reply
            1. Sandtitz Silver badge
              Reply Icon

              @nijam

              Because you can't actually do anything with it?

              You forgot the troll icon kid.

              1 2 Reply
            2. Tom 13
              Reply Icon

              @nijam

              No, it's actually because the market size doesn't yet exceed the minimum required to have a statistically significant sample from which to measure.

              0 0 Reply
        2. Anonymous Coward
          Reply Icon
          Anonymous Coward

          Its true that both Apple & Google have had issue on their mobile platforms, however I would not trust

          the security of the latter.

          0 3 Reply
      2. Chronos
        Reply Icon
        WTF?

        Huh?

        Downvotes, see icon. Relying on GoOgle for your security is probably a bad idea without some careful oversight of what you install. F-Droid is A Thing™ and is more than capable of fulfilling most users' needs with open source goodness, built and verifiable from the source rather than just randomly accepting apks developed by world+dog over which you have zero control.

        Okay, it's a 386 situation...

        2 4 Reply
    4. Anonymous Coward
      Reply Icon
      FAIL

      "Nice advice at the end, but is this (again) just a case of not installing non-play-store random apps?"

      Decades of computing progress and we still see vendor lock-in as the answer to security issues.

      7 0 Reply
    5. Anonymous Coward
      Reply Icon
      Anonymous Coward

      "is this (again) just a case of not installing non-play-store random apps?"

      And not reading any SMSs. Or opening any unknown URLs.

      1 0 Reply
  2. Doctor_Wibble
    Flame

    Update Hansdets, WTF?

    > Users should update their handsets to the latest Android versions

    i.e. buy a new one because yours is over 3 months old and therefore well beyond any manufacturer's 'update window', which I understand is currently 28 days for all manufacturers and OSes, yay for cross-platform standardisation.

    13 0 Reply
    1. Kraggy
      Reply Icon

      Re: Update Hansdets, WTF?

      A tad cynical perhaps but still a very valid point, more so for Android, when I have to use an Android device I have a Nexus, at least the support window from Google is measured in months rather than the weeks I experienced from Samsung with a Note II.

      5 0 Reply
    2. Roland6 Silver badge
      Reply Icon

      Re: Update Hansdets, WTF?

      Re: > Users should update their handsets to the latest Android versions

      I liked the totally vague reference - what does 'latest' actually mean in this context?

      My phones are running the 'latest' version of Android that has been released by the manufacturer and passed fit by the relevant operators, just that these aren't the same 'latest' version as Google are shipping...

      4 0 Reply
      1. scudcraft
        Reply Icon

        Re: Update Hansdets, WTF?

        We all know this by now. Till Google takes control of updates, A. Buy a Nexus, and even after, B. Don't access banking online from a mobile device.

        4 1 Reply
      2. Anonymous Coward
        Reply Icon
        Anonymous Coward

        Re: Update Hansdets, WTF?

        And there in lies the problem, some are not.

        The updates across the Android realm are not consistent, the LG I have as a backup hasn't been updated for over a year.

        My iPhone has, from a major release and a couple of minor releases.

        0 0 Reply
    3. Doctor_Wibble
      Reply Icon
      FAIL

      Re: Update Hansdets, WTF?

      FFS I only just noticed my typo there, too late to correct, completely not my fault at all...

      0 0 Reply
  3. Dan 55 Silver badge

    MWC - rhetorical question

    Is anybody addressing malware this there or is it just more shiney on display?

    1 1 Reply
  4. Anonymous Coward
    FAIL

    Android banking malware infects mobile handsets?

    'The CERT's researchers said of the malware that "... the attacker needs only to infect the Android phone and there is no need for a Windows counterpart."'

    How does the malware infect Android mobile handsets. Besides, what Windows counterpart, Windows doesn't have a decent mobile marketshare.

    0 1 Reply
    1. Anonymous Coward
      Reply Icon
      Anonymous Coward

      Re: Android banking malware infects mobile handsets?

      If you'd read the article you'd have seen that he was talking about PCs, not Windows mobile.

      1 1 Reply
  5. 2StrokeRider
    Holmes

    Reached the point that I pay too much for a smart phone that I use only for calls and GPS, since I don't trust it for anything else. Bought my age'd mother a prepaid flip phone for emergencies a few weeks ago (she's 80, couldn't figure out a smart phone), and I was very tempted to buy myself one as well and dump the $60 a month android bill.

    Yes, I keep cyanogenmod on it and update, still don't trust it. Of course even my favorite linux Mint is no longer safe... :)

    2 0 Reply
    1. Roland6 Silver badge
      Reply Icon

      Perhaps there is a market for Blackberry (pre-android), but more importantly, pre-Android Nokia's that also didn't support over-the-air updates...

      0 0 Reply
  6. Medixstiff

    "Users should update their handsets to the latest Android versions which contain more rigorous security and permission checks"

    I would but Samsung keeps promising me they will and nothings eventuated yet, hence why my Galaxy S3 is being replaced by an LG G5.

    0 0 Reply
  7. Anonymous Coward
    Anonymous Coward

    So guys, where can I get the source-code for GM-BOT Mazar?

    yes, I've checked www.exploit.in (Kiev) and vk.com/ethacking

    0 0 Reply

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Forgotten password ?

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like