“Mobile emulator farms” used to steal millions from US and EU banks
1–10 of 26 posts
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#2Device ID
> "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones"
SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs"
GPS > "spoofed GPS locations the device was known to use."
If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day vulnerabilities). The only solution might be to ban certain phone models (usually the cheap ones...)
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#3Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs" GPS > "spoofed GPS locations the device was known to use." If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day…
Issue their own hardware tokens to customers? A FIDO NFC key can be pretty cheap, though I guess the really low-end phones might not have NFC.
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#4In the US at least, the bank is responsible for losses right? At what point do they begin to secure all this? I have a number of accounts and not one is true 2FA: only one is SMS, the rest are user/password only.
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#5In the US at least, the bank is responsible for losses right? At what point do they begin to secure all this? I have a number of accounts and not one is true 2FA: only one is SMS, the rest are user/password only.
> At what point do they begin to secure all this?
When the cost of fraud handling exceeds that of redoing their security, I guess. It'd have to be a 10x or more factor though, because companies seem to be quite accepting of existing / recurring costs.
That said, my banks have had 2FA for a long time. The one started off 20 years ago with a device where you'd punch in the numbers on screen, it would give you some numbers back. The second version required you to insert your bank card, PIN, and the number on screen, while the website asked for your account number and card number. The third version that I'm using nowadays is pretty much the same, but instead of punching a code it has a camera that scans a color-QR code on screen.
The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays.
Both have mobile apps, and use PIN codes or Face ID for quick access. They know it's a higher risk than their 2FA solutions, so they limit the maximum amount that can be transferred (thus limiting their own damage). The limit has slowly increased over time as their security proved itself. In essence it's like an insurance policy, whose price changes depending on risks and track record.
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#6Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs" GPS > "spoofed GPS locations the device was known to use." If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day…
Yes, off-device 2FA like a yubikey or the stuff I described in another comment. Anything that involves using your bank card and a secret that only you know (like a PIN code), separate from your account details.
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#7Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs" GPS > "spoofed GPS locations the device was known to use." If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day…
Yes, off-device 2FA like a yubikey or the stuff I described in another comment. Anything that involves using your bank card and a secret that only you know (like a PIN code), separate from your account details.
Aren't yubikey require NFC or USB OTG? My phone support neither. Is expensive phones the only solution? If so then my blacklist solution still stands.
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#8Nobody cares.
They just jack up the rates.
Kindof like welfare for the crooks.
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#9Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs" GPS > "spoofed GPS locations the device was known to use." If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day…
Yet another example of why SMS shouldn't be used for 2FA ever.
Besides the fact that Sim-swap attacks are still super common, if they've compromised the Android devices themselves (as is implied in the article) then they could grab the Device ID that way and potentially add some SMS-forwarding malware perhaps?
Re: “Mobile emulator farms” used to steal millions from US and EU banks
#10I’m guessing this is an Android only issue. A commenter on the Ars article said they didn’t see any device ids with iPhone sounding names.