ESET researchers have discovered fake cryptocurrency apps using a previously unseen technique to bypass SMS-based two-factor authentication (2FA), circumventing Google\u2019s recent SMS permissions restrictions. Google restricted the use of SMS and Call Log permissions in Android apps in March 2019 to prevent intrusive apps from abusing them for various illicit purposes. <\/p>\n
The apps, named \u201cBTCTurk Pro Beta,\u201d \u201cBtcTurk Pro Beta\u201d and \u201cBTCTURK PRO\u201d impersonate the Turkish cryptocurrency exchange BtcTurk and phish for login credentials to the service. Instead of intercepting SMS messages to bypass 2FA protection on users\u2019 accounts and transactions, these malicious apps take the one-time password (OTP) from notifications appearing on the compromised device\u2019s display. Besides reading the 2FA notifications, the apps can also dismiss them to prevent victims from noticing fraudulent transactions happening. All three apps were uploaded to Google Play in June 2019 and were quickly taken down following ESET\u2019s notification. <\/p>\n
After the fake BtcTurk apps are installed and launched, they request a permission named Notification access. The apps can then read the notifications displayed by other apps installed on the device, dismiss those notifications, or click buttons they contain. According to ESET\u2019s analysis, the attackers behind these apps specifically target notifications from SMS and email apps.<\/p>\n
\u201cOne of the positive effects of Google\u2019s restrictions from March 2019 was that credential-stealing apps lost the option to abuse these permissions for bypassing SMS-based 2FA mechanisms. However, with the discovery of these fake apps, we have now seen the first malware sidestepping this SMS permission restriction,\u201d said ESET Researcher Luk\u00e1\u0161 \u0160tefanko, author of the research.<\/p>\n
The Notification access permission was introduced in Android\u2019s Jelly Bean 4.3 version, meaning almost all active Android devices are susceptible to this new technique. The fake BtcTurk apps require Android version 5.0 (KitKat) and higher to run; thus, they affect around 90% of Android devices. <\/p>\n
As for the effectiveness in bypassing 2FA, this specific technique does have its limitations \u2013 attackers can only access the text that fits the notification\u2019s text field, and thus, it is not guaranteed that the text will include the OTP. In SMS 2FA, the messages are generally short, and OTPs are likely to fit in the notification message. However, in email 2FA, message length and format are much more varied, potentially impacting accessible data.<\/p>\n
For more details, read the full piece by Luk\u00e1\u0161 \u0160tefanko, \u201cMalware sidesteps Google permissions policy with new 2FA bypass technique,\u201d on \u201cWeLiveSecurity.com.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
ESET researchers have discovered fake cryptocurrency apps using a previously unseen technique to bypass SMS-based two-factor authentication (2FA), circumventing Google\u2019s recent SMS permissions restrictions. Google restricted the use of SMS and Call Log permissions in Android apps in March 2019 to prevent intrusive apps from abusing them for various illicit purposes. The apps, named \u201cBTCTurk […]<\/p>\n","protected":false},"author":2,"featured_media":1618,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"1","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":0,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-11310","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n