Mobile banking is an increasingly popular way to stay on top of one’s finances, with the ability to check balances, transfer money and even deposit checks virtually. Unfortunately, the sector is also a rich tapestry of criminal activity, with 11% of mobile banking apps categorized as “suspicious.”
According to research findings from RiskIQ, there’s a notable prevalence of suspicious mobile apps related to banking. The company found that more than 40,000 (or 11%) of the 350,000 apps which reference banking in the world’s top 90 app stores contain malware or suspicious binaries. Roughly half of those (20,000) actually contained trojan malware.
For the survey, RiskIQ inspected the apps by emulating human behavior to detect suspect applications, application tampering and brand impersonation. Apps were labeled suspicious based on whether they contained malware or suspicious binaries identified by a consortium of 70 anti-virus vendors.
Aside from the malware infestations, of the more than 40,000 mobile apps listed as suspicious, 21,076 contained adware, 3,823 contained spyware, 209 contained exploit code and 178 contained malicious JavaScript.
“Mobile banking is now a way of life for most people,” said Elias Manousos, CEO of RiskIQ, in a statement. “It also presents a lucrative opportunity for criminals to commit fraud. One of the easiest ways to steal a victim’s login and other personal information is using malware and apps with excessive permissions.”
And indeed, of the 40,000 suspicious apps, a large number exhibited excessive permissions. In fact 8,672 could capture device logs, 8,408 could record audio, 7,188 could access contacts lists and 4,892 could read SMS messages. Further, thousands could write to contacts lists, disable key guards, read the device’s settings and access location/GPS information. Perhaps most concerningly, 1,148 could install packages.
“These permissions grant the mobile application developer access to the data people store on their mobile phones,” said Peter Zavlaris, in a blog on the findings. “This isn’t always a bad thing, but when a mobile application is compromised, it gives the attacker access to information he or she can use to exploit the user, sometimes even without using any malware at all.”
The malicious mobile apps come in the form of compromised versions of official mobile apps, or of mobile apps wrapped in fake branding. They imitate functionality consistent with a given brand, and have been pre-installed with malware or data-stealing permissions.
“These findings show that criminals are using look-a-like banking apps to distribute malware and capture data on the device in order to commit crimes,” Manousos said. “Policing app stores for malicious apps and taking them down is a never ending battle for banks, and any other brand that uses the mobile channel to interact with customers.”
The news comes as another recent study uncovered an unsettling acceleration in mobile malware development. 2014 saw the continued emergence of a pattern of regional adaptation for mobile malware, along with the rise of fresh mobile threat tactics and an increase in threat sophistication. There was also an astounding 75% jump in Android malware over the course of the year.