Zeus Banking Trojan Comes to Android Phones

[alexalex]

The Zeus banking Trojan has jumped the bridge to the large

and growing ecosystem of mobile devices powered by

Google's Android operating system, according to security

researchers at Fortinet.

The malware

they obtained looks much like known Android malware

variants. It masquerades as a banking security application

by the firm Trusteer. The malware is intended to thwart

online banking security systems that rely on so-called

out-of-band (OOB) authentication: sending pass codes to

pre-registered cell phones that are required to start an

online banking session......

According to Trusteer CEO Mickey Boodaei, the new Zeus trojan for Android defeats that system, using a man int he middle attack by marrying PC-based Zeus infections with a mobile component.

A user whose PC is infected and who tries to access a bank Web site triggers the Zeus malware, which "asks the user to download an authentication or security component onto their mobile device in order to complete the login process." That security component, disguised as Trusteer's Rapport product, but actually the Zeus mobile variant, gives fraudsters control of both the user's PC and the user's phone. At that point, the Zeus malware can generates a fraudulent transaction on behalf of the user and authenticate it by intercepting the SMS verification message on the phone and forwarding it to the malware on the PC. The mobile Zeus variant then deletes the confirmation message from the user's mobile device so the user will not see it and enters the code on the PC to complete the transaction.

http://threatpost.com/en_us/blogs/zeus-banking-trojan-comes-android-phones-071211