Researchers discovered Cerberus, Android banking Trojan (Malware-as-a-Service), in 2019. This Android malware is rented or auctioned out on underground forums, and is primarily leveraged to target users to steal their financial data, such as credit card details. The operators behind Cerberus made several futile attempts to sell its source code on underground forums, and instead released it for free. The ease at which it is available stirs concern as it increases the threat surface proportionally. The lifespan of popular on-rent Android banking Trojans is usually not more than one or two years (as shown below). Although ransomware-for-hire is not a rare deployment model, previous trends show that once the source code for malware is released, it attracts countermeasures and possibly a new version of the malware itself. [caption id="attachment_8311" align="aligncenter" width="353"] Fig1. Android Trojans and their origin and end date[/caption] Cerberus is usually spread via phishing campaigns and fake SMSs taking advantage of COVID-19, installations from untrusted sources, and using cracked versions of software where users are tricked into installing malware on their smartphones.
Infection and Propagation VectorNot long ago, Cerberus was detected being spread disguised as a Spanish currency converter (called “Calculadora de Moneda”). To avoid initial detection, the app hides its malicious intentions the first few weeks while being available on Google Play store. Later, the code is added to the source code of the currency converter, which is known as a "Dropper Code" among researchers. Then, the application starts deploying malware silently onto users' devices. The application is connected to a command-and-control server (C2), which further has an additional malicious android application package (APK), Cerberus. Now when the malware is executed on the device, it will hide its icon from the application drawer and request for accessibility service privilege as shown below. [caption id="attachment_8312" align="aligncenter" width="288"] Fig2. Permission Access[/caption] Once the user grants the requested privilege, Cerberus abuses it by allowing itself additional permissions without any user interaction. It also disables Play Protect (Google's pre-installed antivirus solution) to prevent the app’s discovery and deletion in the future. Then, the Trojan registers the infected device in the botnet and waits for commands from the C2 server while getting ready to perform overlay attacks. Examples of phishing overlays are as shown below in fig 3. [caption id="attachment_8313" align="aligncenter" width="624"] Fig3. The credentials stealers (first 2 screenshots) and credit card grabbers (last screenshot)[/caption]
Characteristics and CapabilitiesThe malware implements banking Trojan capabilities such as the use of overlay attacks, the ability to intercept SMSs, and obtain access to contact lists. It enables the attacker with the following capabilities as well:
- Capture screenshots
- Record audio
- Record keylogs
- Send, receive, and delete SMSs
- Steal contact lists
- Forward calls
- Collect device information
- Track device location
- Steal account credentials
- Disable Play Protect
- Download additional apps and payloads
- Remove apps from the infected device
- Push notifications
- Lock device’s screen
Indicators of Compromise
- Cerberus is now open source, it is accessible to anyone and therefore poses a major security challenge.
- The leak of PII information can lead to identity theft.
- Confidential docs/ chats leaked to the public can cost the reputation of an individual or organization.
- Users might lose trust over the application owing to safety reasons, leading to a declining revenue for the company
- Once the device is infected it can be used as a Bot to perform DDoS attacks, leading to inaccessibility of services.
- Social engineering techniques are carried out on people. The malware operators obtain access to the victim’s details, which are then used to scam them.
- Block the installation of programs from unknown sources in the Android’s settings.
- Do not follow links in text messages, especially if the message seems suspicious.
- Do not give accessibility permissions to any app that requests them unnecessarily.
- Download applications from trusted sources.
- User awareness about such attacks.
- Use spam filters and antivirus programs to detect and filter bad emails.
- Do regular backup of the data.
- Use firewalls, antivirus, or anti-malware software.
- Use strong passwords.