Researchers at Group-IB have discovered a new NFC relay malware family, purpose-built to capture live card data via NFC and forward it in real time to attackers. They dubbed it “WindRelay.”
NFC (Near Field Communication) is wireless technology that allows devices such as smartphones, payment cards, and payment terminals to communicate when they’re very close together. So, instead of stealing your physical bank card, the attackers capture NFC activity on an infected mobile phone and relay it in real time to a criminal-controlled device held against a contactless payment terminal, or an ATM that supports contactless cash withdrawals.
The researchers describe a 13-minute call impersonating a bank, in which a victim was persuaded to install an Android app labelled with the bank’s name. That app was a remote access Trojan (RAT) called SpyNote. SpyNote gave the attacker remote control of the phone and enabled the quiet installation of a second app, WindRelay.
Read more…
Source: Malware Bytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Fortinet Supports INTERPOL-led Cybercrime Operation across the Association of Southeast Asian Nations (ASEAN)
April 24, 2017
Fortinet has partnered with INTERPOL over the past two years to assist in identifying and thwarting cybercrime. Today, INTERPOL announced that a new operation across the ASEAN region, built around threat intelligence provided by Fortinet and other public and private sector security organizations, has resulted in the identification of nearly 9,000 Command and Control (C2) ...
- US Court Sentences Russian Lawmaker’s Son to 27 Years in Jail for Hacking
April 21, 2017
The son of a prominent Russian lawmaker was sentenced on Friday by a US federal court to 27 years in prison after being convicted of stealing millions of US credit card numbers and causing some $170 million in damages to businesses and individuals. This sentence is so far the longest sentence ever imposed in the United ...
- Improved cyber security for General Election after Russian hacking scandal
April 21, 2017
Cyber security chiefs are to give fresh guidance to protect the general election from being disrupted by hackers. Just weeks ago, Ciaran Martin, chief executive of the National Cyber Security Centre, briefed political party bosses on how they can defend their organisations from online attacks. They were given an overview of threats, case studies on recent cyber ...
- Hong Kong to tighten cyber security rules after broker hacks
April 20, 2017
Hong Kong plans to toughen information security rules after a series of embarrassing hacks at the city’s brokers, the securities regulator said on Thursday. The draft rules would likely include requirements for two-step authentication for account log-in and for brokers to notify clients when a transaction had been made, a Hong Kong Securities and Futures Commission ...
- Hackers Dump 1.7 Million Snapchat User Data on Dark Web
April 18, 2017
Anonymous Indian hackers are taking revenge on Snapchat’s CEO and claim to have leaked a database containing the credentials of 1.7 million users. The hackers are particularly upset after Evan Spiegel,Snapchat CEO, reportedly made a rather nasty remark regarding expansion plans. According to claims that emerged last week as an ex-employee filed a lawsuit against the ...
- Hajime worm battles Mirai for control of the Internet of Things
April 18, 2017
A battle is raging for control of Internet of Things (IoT) devices. There are many contenders, but two families stand out: the remains of the Mirai botnet, and a new similar family called Hajime. Hajime was first discovered by researchers in October of last year and, just like Mirai (Linux.Gafgyt), it spreads via unsecured devices that ...