{"id":6898,"date":"2016-03-11T10:52:41","date_gmt":"2016-03-11T15:52:41","guid":{"rendered":"https:\/\/kasperskydaily.com\/uk\/?p=6898"},"modified":"2019-11-22T10:11:08","modified_gmt":"2019-11-22T10:11:08","slug":"banking-trojans-bypass-2fa","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/banking-trojans-bypass-2fa\/6898\/","title":{"rendered":"How banking Trojans bypass two-factor authentication"},"content":{"rendered":"

Two-factor authentication via\u00a0SMS is widely used by banks. Of course, this measure works better than a mere password but it\u2019s not impenetrable. Security specialists found<\/a>\u00a0it could be fooled 10 years ago, just when this type of protection was gaining popularity.<\/p>\n

Sadly, so have malware creators. That\u2019s why banking Trojan developers are able to breach one-time SMS passwords with ease. Here is how it works:<\/p>\n

    \n
  1. A user launches legitimate banking app on a smartphone.<\/li>\n
  2. The trojan detects which app is used, and overlays the legitimate interface with a fake version. \u00a0The key here is that the fake screen looks just like the real one.<\/li>\n
  3. The victim enters login and password in the fake app.<\/li>\n
  4. The Trojan sends user\u2019s credentials to criminals. They use these data to login into the user\u2019s banking app.<\/li>\n
  5. Then the culprits request a financial transaction to their account.<\/li>\n
  6. Victim\u2019s phone receives SMS with one-time password.<\/li>\n
  7. The Trojan extracts the password from SMS and sends it to cybercriminals.<\/li>\n
  8. It also hides the SMS from the user. This is why the victim does not know about ongoing operations until they check their banking account and transactions history.<\/li>\n
  9. Criminals use intercepted password to confirm the transaction and receive victim\u2019s money<\/li>\n<\/ol>\n
    \n

    What is two-factor authentication and where should you enable it? http:\/\/t.co\/WSvDc9oSvb<\/a> #passwords<\/a> #privacy<\/a> #security<\/a><\/p>\n

    \u2014 Kaspersky (@kaspersky) June 9, 2014<\/a><\/p><\/blockquote>\n