Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Mobile emulator farms” used to steal millions from US and EU banks

arstechnica.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#11

Post by wlesieutre »

yonixw wrote: post #7
Cthulhu_ wrote: post #6

Earlier quoted context omitted.

Yes, off-device 2FA like a yubikey or the stuff I described in another comment. Anything that involves using your bank card and a secret that only you know (like a PIN code), separate from your account details.

Aren't yubikey require NFC or USB OTG? My phone support neither. Is expensive phones the only solution? If so then my blacklist solution still stands.

There are dedicated hardware tokens that don't require any particular support on your phone, you copy the number just like if you were using an app to generate TOTP codes except it's on a little LCD screen instead.

https://www.cdw.com/product/RSA-SecurID-SID700-Enterprise-pl...

Phone apps have largely replaced them but for my bank I wouldn't mind having a separate device that's not internet connected.

But they cause other issues, like being one more little device to lose and not providing accessibility features like a phone app does (good luck if you're blind).

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#13

Post by kube-system »

lmm wrote: post #3
yonixw wrote: post #2

Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs" GPS > "spoofed GPS locations the device was known to use." If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day…

Issue their own hardware tokens to customers? A FIDO NFC key can be pretty cheap, though I guess the really low-end phones might not have NFC.

SMS is mostly popular today because it’s user friendly. I can’t imagine that most users would like carrying around separate hardware tokens.

I would imagine there’s some point at which there’s an equilibrium between fraud costs and customer acquisition/retention costs.

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#14

Post by tushar-r »

Cthulhu_ wrote: post #5
imglorp wrote: post #4

In the US at least, the bank is responsible for losses right? At what point do they begin to secure all this? I have a number of accounts and not one is true 2FA: only one is SMS, the rest are user/password only.

> At what point do they begin to secure all this? When the cost of fraud handling exceeds that of redoing their security, I guess. It'd have to be a 10x or more factor though, because companies seem to be quite accepting of existing / recurring costs. That said, my banks have had 2FA for a long time. The one started off 20 years ago with a device where you'd punch in the numbers on screen, it would give you some numb…

>The other bank used to send printed lists of one-time codes, where the website would say 'type the code at index xyz'. Later they went for SMS-based 2FA, I think they're still on that nowadays.

One of the banks I use in India adds this grid to the back of your debit card. For higher value or non-usual transactions, they both ask for an SMS code and 3 values from the grid, in addition to the password to login to the netbanking site. The app allows you to get in with your fingerprint or a "quick access code", but these other factors kick for many transactions.

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#15

Post by salawat »

This is the folly of assuming a 1:1 binding between person and hardware. When I worked in fintech, I warned risk and our architects that you could not rely on any measuee that didn't take into account SIM swapping or strategic config cloning. No one listened. This despite tge fact that SIM swapping became a hot commodity for people when ID's started to be required for legal purchases from a vendor, and when device ids were getting integrated into fingerprinting.

If you start one to one-ing hardware, you track User-Agents. Not Users. These are not equivalent.

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#16

Post by callesgg »

Tepix wrote: post #12

My bank lets me do online banking with just my phone. How is this secure in view of this? I want proper 2FA!

If any device can be used for banking I don’t see why accessing the bank using the the same device that generates the second factor is a problem. You could just as well use a different device to access the bank.

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#17

Post by ReactiveJelly »

callesgg wrote: post #16
Tepix wrote: post #12

My bank lets me do online banking with just my phone. How is this secure in view of this? I want proper 2FA!

If any device can be used for banking I don’t see why accessing the bank using the the same device that generates the second factor is a problem. You could just as well use a different device to access the bank.

The problem is that TOTP is so weak that it's almost not a second factor.

It's something the computer knows, so it's more like a non-human password than a "Something you have"

That said, most people probably don't even have TOTP, so these farms are probably not targeting them yet?

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#18

Post by abcet »

salawat wrote: post #15

This is the folly of assuming a 1:1 binding between person and hardware. When I worked in fintech, I warned risk and our architects that you could not rely on any measuee that didn't take into account SIM swapping or strategic config cloning. No one listened. This despite tge fact that SIM swapping became a hot commodity for people when ID's started to be required for legal purchases from a vendor, and when device id…

Because it’s multidimensional. Security is one aspect, but the firm exists to generate profit for the shareholders, so the management has to balance these priorities.

The problem is that SMS 2FA is more user friendly.

App based 2FA requires user to download Google Authenticator, copy the key there, copy the resulting number out. It’s a lot of friction. And on top of that users can lose the 2FA key.

SMS is less secure, cloneable, but it reduces friction, which in turn results in more revenue. And without revenue, there will be nothing at all, secure or not.

Re: “Mobile emulator farms” used to steal millions from US and EU banks

#19

Post by vmception »

yonixw wrote: post #2

Device ID > "although in some cases, the fraudsters gave the appearance they were customers who were accessing their accounts from new phones" SMS > "... report doesn’t explain how the crooks managed to steal SMS messages and device IDs" GPS > "spoofed GPS locations the device was known to use." If you can gather all 3, is there any way to stop you? They probably have some hardcore malware (potentially using zero-day…

They probably run a mobile app ad network for a freemium game and know which phone numbers pay the most.

Would explain the preparedness for phone emulation and the thought of it too.

Same regarding GPS, this is really prevalent on darknet market tutorials and services, where you get the ID and credit card of someone (large markets for that called fullz) and then find a compromised windows computer near that residential/billing address (there are whole markets for that called rpc, sorted by bandwidth and location) and then run the credit card but from a computer near where the owner lives, to avoid being flagged.

What happened here seems to be a mixture of those concepts, to address bank accounts without getting flagged.

Post reply on HN