The popular security expert Lukas Stefanko from ESET discovered some apps (namedBTCTurk Pro Beta and BtcTurk Pro Beta) impersonating the Turkish cryptocurrency exchange, BtcTurk, in the attempt of stealing login credentials.
In order to steal the 2FA OTPs the apps read the credentials that appear in 2FA notifications from the service, instead of intercepting the SMS messages delivering them,
Stefanko explained that the new increasing interest in Bitcoin is associated with the growth of its price.
“When Google restricted the use of SMS and Call Log permissions in Android apps in March 2019, one of the positive effects was that credential-stealing apps lost the option to abuse these permissions for bypassing SMS-based two-factor authentication (2FA) mechanisms.” wrote the expert.
“We have now discovered malicious apps capable of accessing one-time passwords (OTPs) in SMS 2FA messages without using SMS permissions, circumventing Google’s recent restrictions.”
When the apps are executed for the first time they request ‘notification access’ permission that is used to read the notifications displayed by other apps installed on the device, dismiss those notifications, or click buttons they contain.
Once the permission is granted to the apps, they will display a fake login message asking for the user’s BtcTurk login credentials. Once the users will provide the credentials, the apps display a false error message.
“Opss! Due to the change made in the SMS Verification system, we are temporarily unable to service our mobile application. After the maintenance work, you will be notified via the application. Thank you for your understanding.” reads the message (Translated from Turkish).
In the meantime, the login credentials for the services are sent back to the attacker’s server.
At this point, the rogue apps leverage the notifications access permission to read all incoming notifications and select the ones related to applications of interest. The apps read the notifications associated with apps whose names contain the keywords, gm, yandex, mail, k9, outlook, SMS, and messaging. These notifications are sent to the attacker, who select the ones containing the one-time passwords used in 2FA.
“The displayed content of all notifications from the targeted apps is sent to the attacker’s server. The content can be accessed by the attackers regardless of the settings the victim uses for displaying notifications on the lock screen. The attackers behind this app can also dismiss incoming notifications and set the device’s ringer mode to silent, which can prevent victims from noticing fraudulent transactions happening.” continues the expert.
At this point, it is easy for the attackers to impersonate the victims while attempt to access the services. Any 2FA OTP can be dismissed from the victim’s phone and sent to the attacker, the attacker with this scheme has access to login credentials and OTP and can use them to access the account.
Experts at ESET are warning of the rapid spread of this technique that was recently observed in attacks against users of the Turkish Koineks exchange. ESET believes that the threat actor behind the attacks was the same.
“Just last week, we analyzed a malicious app impersonating the Turkish cryptocurrency exchange Koineks(kudos to @DjoNn35 for bringing that app to our attention). It is of interest that the fake Koineks app uses the same malicious technique to bypass SMS and email-based 2FA but lacks the ability to dismiss and silence notifications.”
“According to our analysis, it was created by the same attacker as the “BTCTurk Pro Beta” app analyzed in this blogpost. This shows that attackers are currently working on tuning this technique to achieve the “next best” results to stealing SMS messages.”
Experts believe that crooks will start using this technique against target in other industries, including banks and financial institutions.
Source: securityaffairs.co
