Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia

TL;DR

This study investigates how virtualization-based malware like FjordPhantom can bypass security in East and Southeast Asian banking apps, highlighting vulnerabilities and proposing detection and prevention strategies.

Contribution

It provides an empirical analysis of banking app vulnerabilities to virtualization-based malware and evaluates current protective measures in the region.

Findings

FjordPhantom can bypass existing security measures using virtualization techniques.

Many banking apps in the region are susceptible to this malware.

Current protections are often insufficient against virtualization-based attacks.

Abstract

Android banking applications have revolutionized financial management by allowing users to perform various financial activities through mobile devices. However, this convenience has attracted cybercriminals who exploit security vulnerabilities to access sensitive financial data. FjordPhantom, a malware identified by our industry collaborator, uses virtualization and hooking to bypass the detection of malicious accessibility services, allowing it to conduct keylogging, screen scraping, and unauthorized data access. This malware primarily affects banking and finance apps across East and Southeast Asia region where our industry partner's clients are primarily based in. It requires users to be deceived into installing a secondary malicious component and activating a malicious accessibility service. In our study, we conducted an empirical study on the susceptibility of banking apps in the region to FjordPhantom, analyzed the effectiveness of protective measures currently implemented in those apps, and discussed ways to detect and prevent such attacks by identifying and mitigating the vulnerabilities exploited by this malware.