How to improve mobile banking app security?

Modern business demands that information be accessed quickly, securely, and from anywhere in the world. In parallel, there is an active development of technology; mobile banking apps and payment applications are gradually appearing on our mobile devices. Security concerns due to attacks on mobile banking apps are at an all-time high, and the sophistication and volume of fraudulent attacks are increasing every year. Every user thinks about is mobile banking safe to use.

Based on a 2021 Threat Intelligence report tracking more than 200 million devices worldwide, the number of new banking trojans attacking devices and trying to steal one-time passwords from SMS increased by 80% in the first half of 2021.

In June 2020, the FBI issued a cybersecurity alert, anticipating an increase in attacks on mobile banking customers due to a surge in banking app usage and a decline in in-person branch visits, partly caused by the COVID-19 pandemic. With more bank customers using online banking on their mobile devices and lower barriers to entry for attackers, there is an urgent need for financial institutions to deploy advanced application security to create a secure mobile banking experience for customers and protect their brands.

So let’s take a closer look at online banking applications' security and how we can improve it with Fintech services.

In this article:

Why are banking apps vulnerable?

The mobile banking apps' causes of vulnerabilities can be attributed to one of the following six groups.

1. Insufficient elaboration of security requirements for the application being developed.
2. Design errors. Insufficient control over the implementation of security requirements during development. For example, a poorly designed session management mechanism can allow mobile users in a mobile application to manipulate cookies, thereby bypassing the authentication procedure.
3. Coding errors. Coding errors can be used to change the functionality of an application and perform unintended actions and commands. Implementing attacks becomes possible due to buffer overflows and format string errors, using the time interval between the moment of checking the file access rights and the moment it is used to change the permissions (race conditions). Judging by the publications, coding errors are the most common cause of vulnerabilities.
4. Malicious code. Hatches, logic bombs, and code for organizing a salami attack are typical examples of code implemented by developers for subsequent exploitation.
5. Application deployment errors. Such errors are the result of insufficiently thought out and prepared installation of the application by the customer. They are connected to the fact that the characteristics of the computer infrastructure are not known exactly. Errors such as non-deleted debug personal bank accounts and passwords and application version control errors fall into this category.
6. Insufficient quality control and application testing. It is impossible to get rid of vulnerabilities only at the stage of final testing. Security issues should be included in quality control and application testing programs. Regular testing of the application should be carried out not only on the assumption that the data being processed will have a normal, expected character but also to take into account scenarios of possible attacks.

Beware of these cyberattacks

Finding vulnerabilities in mobile bank apps is not an easy task. Although there are various tools on the market for detecting known vulnerabilities, expert analysis of the application source code remains the most effective way to identify most vulnerabilities. It should be noted that both open-source and commercial vulnerability detection tools are successfully used not only by developers but also by hackers.

1. Banking Trojans

Banking Trojans are the most common mobile cyber threat today, accounting for up to 95% of mobile malware. Over 98% are for the Android platform, which is not surprising. Firstly, it is the most massive (occupies over 80% of the smartphone market). Secondly, it is the only one among the popular platforms that basically allows software installation from unknown sources.

There are three main methods of online banking Trojans:

• They can hide bank SMS with passwords from the user and immediately redirect them to an attacker, who will use them to transfer money to their bank account.
• In the same way, online banking Trojans can operate automatically, from time to time, sending relatively small amounts to the accounts of criminals.
• Or the malware immediately mimics the mobile applications of banks and, after gaining access to the account details for logging into the mobile Internet bank, they do the same.

Recently, universal malware has become popular, capable of downloading updated profiles of banks in different countries: the US, Germany, and the UK.

The "grandfather" of mobile banking Trojans is Zeus, aka Zitmo (Zeus-in-the-mobile), which appeared back in 2010 (and its ancestor for PC, the original Zeus, was created in general in 2006) and managed in the US alone to infect over 3.5 million devices, creating the largest botnet in history.

2. Fake mobile banking apps

A fake mobile banking app is an app that's designed to look like it was made by a real bank but actually helps scammers get access to sensitive data and money of a user. There are two different types of fake banking online apps: phishing apps and apps that thieves use IRL.

Criminals distribute their web and mobile apps in a variety of ways. Sometimes they place them in official stores, which do not always have time to track down fakes in time. But more often, they are promoted in alternative app stores and on different sites. Download links are distributed via third-party app stores, social networks, instant messengers, or e-mail.

If a person downloads a fake app and enters their details, the scammers will gain access to their real online or mobile banking. This application can also turn out to be a virus, with the help of which criminals can also hack the user's other mobile banks. As a result, fraudsters can steal all the money from the financial accounts, as well as take out loans in the name of an unsuspecting client. A person will not only lose his savings but also remain in debt.

3. Man-in-the-middle (MiTM) attacks

The meaning of the ''Man-in-the-middle'' (MiTM) attack is that the attacker ''passes'' the victim's web traffic (perhaps by changing the DNS server settings or the host's file on the victim’s machine) ''through myself." While the victim believes that he works directly, for example, with the bank's website, the traffic passes through the attacker's intermediate node, which thus receives all the data sent by the user (bank’s login credentials, password, PIN, etc.) 

MiTM attacks rely on the manipulation of networks or the creation of malicious networks controlled by cybercriminals. A cybercriminal intercepts the traffic and either pass it through their system, collecting information along the way, or redirects it to another location.

Cybercriminals essentially act as “intermediaries” between the person sending information and the one receiving it, hence the name of the “man in the middle” attack. These attacks are surprisingly common, especially on public Wi-Fi networks. Since public Wi-Fi is often unsecured, you cannot know who monitors or intercepts web traffic, since anyone can log in.

4. Clickjacking

"Clickjacking" — aka "click hijacking," aka "user interface spoofing," aka "iframe overlay" — allows a hacker to perform a click on a site on behalf of a visitor. How do they do it? The attacker creates a page with carefully placed visual elements. A transparent iframe is placed on top. The user temptingly clicks on these elements but is actually unknowingly clicking on an element on another page. The whole trick is transparency so that the "victim" interacts with a user interface element that he simply does not see.

There are many techniques. Here are some examples of how attackers can use various methods to trick a user:

• The attacker creates an invisible iframe (transparent overlay) on top of the malicious page and loads the tool page into this overlay. The malicious page contains a visual element that lures the user into clicking. For example, it could be a graphic element that looks like a video player with a play button in the middle. The user clicks on the play symbol, but because of the overlay, he clicks on a UI element on the tool page.
• The attacker creates a 1×1 pixel frame that moves with the mouse cursor. Due to its size and position, this frame is completely invisible (hidden under the tip of the cursor character). So the user, clicking anywhere, clicks on everything that is loaded and located in this 1 × 1 frame.
• The attacker cuts the snippets and pastes them on the malicious page. So you can insert an iframe of the "Submit" button and arrange everything so that it will look organically on a malicious page.

There are many options, so mobile app owners need to make sure that users and visitors are protected from such a threat.

5. Phishing links in emails

A phishing link is a hyperlink that masks the address of a malicious resource. After clicking on it, the user is redirected to a fraudulent site. If you do not stop the process in time and manage to enter your login and password, card number, PIN code, passport series, and number, or confidential service data into the proposed form, they will be used for criminal purposes.

The phishing link is disguised as a regular hyperlink. At first glance, it may not arouse any suspicion: the hyperlink in the text indicates the address of the real resource, but it leads to an illegal, malicious software or website.

Fraudsters use different tricks in letters:

• A tempting offer or ultimatum. It is easy to evoke emotions and strong feelings (fear, joy, curiosity) in gullible users. Criminals motivate visitors to click with persuasive texts, name calls, false benefits, and even threats. For example, they send a plausible email notification that your account has been hacked and offer to solve the problem by clicking on a link.
• Inspiration to action. For example: “Click on the link to receive a gift”, “Follow the link and pay off the debt”, “Use the link to go to your account and enter the data to restore it.”
• Deception of algorithms. Hackers use images instead of text and add a link to the picture. Previously, email programs allowed such messages to pass through, but modern filters do not allow such spam to pass through.

Here malware and phishing protection software can help. 

6. Physical mobile phone theft

If your smartphone gets swiped, the fallout might extend beyond just losing the device itself. The stakes rise considerably if a thief manages to snag your banking apps, crucial documents, personal photos, and videos, potentially leading to identity theft.

In today's digital landscape, mobile identity theft is a mounting concern. With smartphones being central to online banking, shopping, and social interactions, cybercriminals find it increasingly convenient to pilfer personal and financial data from unsuspecting individuals. Mobile identity theft transpires when someone illicitly accesses a user's personal data stored on their mobile device, including their name, address, social security number, bank account details, and other sensitive information.

The repercussions of mobile identity theft are extensive, causing substantial financial and emotional harm to the victim.

7. “Keylogging” malware

A keylogger stands out as a specialized form of malware adept at shadowing every keystroke, enabling attackers to clandestinely observe users and gain entry to their confidential data, including sensitive details like bank card information and login credentials.

This particular breed of program meticulously records clicks from mobile banking apps and dispatches a log of actions to a remote server, allowing attackers to retrieve all the information inputted by the user. This encompasses passwords, bank card numbers, instant messages, emails, URLs, and more.

Keyloggers, essentially activity-tracking programs, insidiously embed themselves on a computer without the victim's awareness. They most commonly proliferate through phishing and social engineering tactics, sneaking in during the installation of third-party programs, downloading files from hosting services or opening attachments from dubious emails.

Detecting keyloggers poses a challenge due to the meticulous attention given to concealing their presence on the victim's computer during development. Nevertheless, subtle indicators may betray their existence, such as sluggish website loading, cursor freezing, delayed or absent display of entered text, and errors when loading graphics or websites.

There are many options, so bank's app owners need to make sure that users and visitors are protected from such a threat.

How can financial institutions improve app security?

Given the rapid growth of security threats in the mobile banking segment, information security product manufacturers should respond by releasing appropriate products to protect users from fraud. So what can financial institutions do to improve the application's security layer and to answer the users’ questions about are banking apps safe?

1. Two-factor or multi-factor authentication feature

Two-factor authentication (2FA) is an authentication method that requires the user to provide exactly two verification factors in order to gain access to the bank's mobile app. Two-factor and multi-factor authentication provide an extra layer of protection for mobile banking apps against many of the most common types of cyber threats, including those listed below.

• Stolen passwords. As mentioned above, poor password hygiene makes passwords easy to steal. In a two-factor authentication system, a stolen password alone is not enough to hack an account.
• Brute force attacks (password cracking). Computing power is becoming more available, and hackers use it to generate passwords randomly until they crack the code. However, breaking the second factor, in the same way, is impossible.
• Phishing. Phishing remains one of the most common and effective ways to steal user credentials. Two-factor authentication protects against unauthorized access if the username and password are stolen through a phishing attack.
• Social engineering. Clever hackers are increasingly using social media to carry out attacks by tricking users into voluntarily providing their credentials. But without the second factor, the hacker will not be able to access the account.

2. End-to-end encryption

End-to-end encryption is when messages are encrypted on your device and only decrypted on the other person's device. That is, the message travels the entire path from the sender to the recipient in encrypted form, so no one can read it except your interlocutor.

The main advantage of end-to-end encryption is that no one except the recipient can decrypt the transmitted data. It is as if you put them in a box when sending them by mail, which is physically impossible to open — neither to saw, nor to split with a sledgehammer, nor to break open with a master key. And this box can only be opened by the person to whom the message is addressed — not a single letter carrier or thief who managed to get his hands on the package can do this. That is, end-to-end encryption ensures data confidentiality.

If in the physical world, such an invincible box is hardly possible to create, then it is really possible in the world of information. Very cool mathematicians are constantly developing new encryption systems and improving old ones so that they cannot be opened.

The fact that data encrypted with end-to-end encryption cannot be decrypted by anyone except the recipient has another plus: no one can get into the data and change it. Modern ciphers are designed in such a way that if someone changes the encrypted data when decrypted, it will turn into garbage, and it will immediately become clear that something is wrong here.

Subscribe to our news

Subscribe

X

Thank you for Subscription!

3. Biometric data

Biometrics is a secure and convenient way to sign in to mobile apps using data received from your own body. There is no reliable way to determine who is entering the password. The application developer can only determine if the entered password matches the password key in the back end of the system. Biometrics includes an additional trust indicator as it confirms the identity of the person offering the biometric sample for verification. Because the fingerprint, facial recognition, or iris scan is displayed in real time and connected to the user in real time.

4. Conduct digital security training

Train your team to recognize mobile banking apps security issues and avoid different risks of mobile banking, such as risky behavior, phishing detection, and other online security measures. Then, save your skills with unannounced test phishing emails, text messages, etc. They should look in every way like a typical phishing message. Still, if an employee clicks, they are automatically registered in the data security training module. Verizon reports that most mobile phishing attempts involve SMS and social messaging, not email, so it's important to vary the phishing environment as well as the content.

5. Ensure best security practices

Every secure mobile banking app should be designed with security in mind. Make sure your developers are familiar with mobile app security best practices and frameworks such as the OWASP Mobile Top 10. From there, conduct regular automated mobile banking security testing as part of the SDLC, as well as occasional deeper penetration testing. Finally, deploy an additional layer of security, App Shielding, to protect your app at runtime and in potentially hostile (legacy, insecure phone) environments that put your app at risk.

6. Antivirus software

The essence of antivirus for financial organizations is to prevent and eliminate threats associated with viruses, Trojans, and other malicious codes. It is installed in parity on the system, scans and analyzes all incoming and outgoing files, provides continuous protection against threats, and also offers a wide range of additional features and capabilities.

The main advantage of an antivirus for financial institutions is its high efficiency, ensured by the use of modern methods and technologies to combat viruses. It is actively updated, which allows it to be constantly prepared for new and improved threats. In addition, a commercial antivirus has a simple and user-friendly interface, which simplifies its installation and configuration.

7. App updates

Financial institutions can bolster mobile banking apps security by prioritizing timely and regular updates. Implementing a robust system of frequent app updates enables institutions to promptly address any discovered vulnerabilities or security gaps, ensuring that users are protected from potential threats. It is crucial for financial apps to undergo continuous improvement to stay ahead of evolving mobile banking risks.

These updates not only include bug fixes but also incorporate the latest encryption standards and security protocols to fortify the app against emerging threats. Additionally, financial institutions can enhance app security by providing clear communication to users about the importance of keeping their apps up to date and educating them on best security practices.

Regularly auditing and testing the app's security features can further identify and mitigate potential mobile banking risks, creating a more resilient defense against cyber threats.

Tools for mobile banking application security

If you are the owner or developer of a mobile application, you must do everything to ensure the security of your mobile application. There are many tools for finding vulnerabilities. The information below will help you find security weaknesses in your mobile banking app.

1. Ostorlab

Ostorlab will allow you to test the application on Android or iOS and get a detailed report on the results of the test. Upload your application file in the Android Package Kit or iPhone application archive format, and a security report will be ready in a few minutes. It is based on open-source programs such as Androguard and Radare2. I advise you to check your mobile application for free with Ostorlab.

The maximum file size for uploading for verification is 60 MB. However, if your application exceeds 60 MB, you can contact Ostorlab to host the file via an API request.

2. Appvigil

With Appvigil you will receive not only a description of possible threats but also recommendations on how to fix the vulnerability to quickly resolve the problem. No software needs to be installed as everything is handled in the Appvigil cloud.

After you upload the APK or IPA files, a static and dynamic analysis of the application (Android / iOS) is performed, including for the presence of a vulnerability from the OWASP Top 10 list.

3. Quixxi

Quixxi is designed to generate mobile analytics, secure mobile applications, and generate revenue potential. It will take a few minutes to check. Once the scan is complete, you will have a short vulnerability report. If you need a full report, then you need to register on the site. It's free.

4. Akana

Akana is an interactive app analysis tool for Android. Akana checks the application for malicious code and displays details of the results. The check is free, so give it a try and see if your Android app contains malicious code.

5. NVISO

Nviso APKSCAN is another handy online tool to scan your app for malicious code. The results may not be ready immediately, depending on your place in the queue. You can leave your email and be notified when the report is ready. You can check the following data with this tool: disk activity, virus scanning, network traffic, the ability to make a phone call, send SMS, cryptographic activity, and data leakage.

PSD2 regulations

PSD2 is the Directive that regulates financial services in the EU and replaces the 2007 PSD Directive. The document was adopted back in 2015 due to the high pace of digitalization in the banking sector, as well as the need to provide users with better and more modern services, including through mobile applications.

and replaces the 2007 PSD Directive. The document was adopted back in 2015 due to the high pace of digitalization in the banking sector, as well as the need to provide users with better and more modern services, including through mobile applications.

The main goal of PSD2 is to create open banking, where third parties (''Third Party Providers'' or ''TPP'' for short) can access financial information about a bank customer with their direct permission and through a system of enhanced authentication. According to PSD2, such consent can be given both for individual transactions and for TPP's full access to information about the client that is stored in the bank. However, the client must be properly aware of the scope of his consent, and it must be expressly expressed.

In Europe, PSD2 has been in force since January 2018, but the main implementation date was September 14, 2019, when technical standards for user protection began to work.

Participants in the payment services market have been preparing for this date for a long time, as technical standards have introduced rules for enhanced customer authentication and requirements for platforms for open access to banking information. The regulations stipulate that, with the exception of a number of minor transactions, strong user authentication should be performed.

If we mentioned security

How to implement Zero Trust security model: full guide

Have you ever wonder how to make a solid basis for security system in your organization? We have some tips

Let's see

Conclusion

Applications for mobile banking apps are exposed to both well-known old threats and new, not yet fully understood threats. Mobile banking app safety threats create the risk of compromise of critical user data, data theft of funds, and damage to the bank's reputation.

Applications for mobile banking apps are exposed to both well-known old threats and new, not yet fully understood threats. Mobile banking safety threats create the risk of compromise of critical user data, data theft of funds, and damage to the bank's reputation.

Attackers have many ways to carry out attacks. At the same time, the cost of conducting an attack in a real environment can be very low compared to the possible benefits.

Modern security solutions for mobile devices —antiviruses, MDM solutions, etc. — can reduce mobile banking security risks but not solve the whole range of problems. Security should be implemented at the system design stage and be present at all stages of the program life cycle, including the development and implementation stages. It is necessary to carry out code audits, application security analysis, and penetration testing.

If you are looking for a mobile banking development team who are cybersecurity experts and know all the nuances of the security of mobile bank applications — contact us.