EletiofeA Massive Fraud Operation Stole Millions From Online Accounts

A Massive Fraud Operation Stole Millions From Online Accounts

-

- Advertisment -

Researchers from IBM Trusteer say they’ve uncovered a massive fraud operation that used a network of mobile device emulators to drain millions of dollars from online bank accounts in a matter of days.

The scale of the operation was unlike anything the researchers have seen before. In one case, crooks used about 20 emulators to mimic more than 16,000 phones belonging to customers whose mobile bank accounts had been compromised. In a separate case, a single emulator was able to spoof more than 8,100 devices.

The thieves then entered usernames and passwords into banking apps running on the emulators and initiated fraudulent money orders that siphoned funds out of the compromised accounts. Emulators are used by legitimate developers and researchers to test how apps run on a variety of different mobile devices.

To bypass protections banks use to block such attacks, the crooks used device identifiers corresponding to each compromised account holder and spoofed GPS locations the device was known to use. The device IDs were likely obtained from the holders’ hacked devices, although in some cases, the fraudsters gave the appearance that they were customers who were accessing their accounts from new phones. The attackers were also able to bypass multi-factor authentication by accessing SMS messages.

Automating Fraud

“This mobile fraud operation managed to automate the process of accessing accounts, initiating a transaction, receiving and stealing a second factor (SMS in this case), and in many cases using those codes to complete illicit transactions,” IBM Trusteer researchers Shachar Gritzman and Limor Kessem wrote in a post. “The data sources, scripts, and customized applications the gang created flowed in one automated process which provided speed that allowed them to rob millions of dollars from each victimized bank within a matter of days.”

Each time the crooks successfully drained an account, they would retire the spoofed device that accessed the account and replace it with a new device. The attackers also cycled through devices in the event that they were rejected by a bank’s anti fraud system. Over time, IBM Trusteer saw the operators launch distinct attack legs. After one was over, the attackers would shut down the operation, wipe data traces, and begin a new one.

The researchers believe that bank accounts were compromised using either malware or phishing attacks. The IBM Trusteer report doesn’t explain how the crooks managed to steal SMS messages and device IDs. The banks were located in the US and Europe.

To monitor the progress of operations in real time, the crooks intercepted communications between the spoofed devices and the banks’ application servers. The attackers also used logs and screenshots to track the operation over time. As the operation progressed, the researchers saw the attack techniques evolve as the crooks learned from previous mistakes.

The operation raises the usual security advice about using strong passwords, learning how to spot phishing scams, and keeping devices free of malware. It would be nice if banks provided multi factor authentication through a medium other than SMS, but few financial institutions do. People should review their bank statements at least once a month to look for fraudulent transactions.

This story originally appeared on Ars Technica.


More Great WIRED Stories

Latest news

I’ll Love You Till The End Of Time – Adesua Etomi Pens Romantic Birthday Message To Husband, Banky W On His Birthday

Nigerian actress, Adesua Etomi has taken to Instagram to pen a heartfelt note to her husband, Banky W, as...

Tinubu Establishes Presidential Economic Coordination Council

President Bola Ahmed Tinubu has established the Presidential Economic Coordination Council (PECC).He also created the Economic Management Team Emergency...

Sophia Smith becomes NWSL’s highest-paid player with new Thorns extension

Sophia Smith became the latest NWSL star to ink a new deal Wednesday, becoming the league's highest-paid player in...

USWNT’s Midge Purce tears ACL, will miss Olympics and Gotham FC’s NWSL season

Midge Purce, a USWNT player and the reigning NWSL Championship Game MVP, will miss the rest of Gotham FC's...
- Advertisement -

Lionel Messi on retirement talk: ‘If I feel good, I will always try to continue competing’

Lionel Messi will turn 37 in June, but as long as his body feels good, he plans to play...

The Baltimore Bridge Collapse Is About to Get Even Messier

In the early hours of Tuesday morning, the global supply chain and US coastal infrastructure collided in the worst...

Must read

Tinubu Establishes Presidential Economic Coordination Council

President Bola Ahmed Tinubu has established the Presidential Economic...
- Advertisement -

You might also likeRELATED
Recommended to you