Risks of illegal abuse of mobile banking signatures in nearly 20 banks and 20 risks

Risks of illegal abuse of mobile banking signatures in nearly 20 banks and 20 risks

Recently, Baidu security lab found that a digital certificate signature (signature information 1) was used by mobile clients of many banks when extracting genuine information from mobile banking. At the same time, several individual developer applications also use the certificate signature. This abuse of digital signatures poses a great security risk.

 

Figure 1. Signature Information

 

After Mining and analysis, the researchers found that a total of 23 mobile banking clients of different banks currently use this signature:

The mobile client applications of different banks are outsourced to a third-party company.

 

In the application market, a total of six personal-developed applications are found to use the digital certificate signature at the same time:

These six mobile phone clients are the same developer and assume that the individual developer should be an employee of a "third-party company, the employee "accidentally" signed personal small applications with the company's digital certificate and published them to different application markets.

 

No malicious behavior has been detected using this certificate. However, there are still the following huge security risks:

 

1. The Android mobile client applications of different banks all use the same certificate signature.

In the Android system, the role of a certificate is to establish a trust relationship between an application and its developers, which is actually the owner of the application and an important part of the Android security mechanism. Although these bank clients are developed by a company, they should belong to different banks, so they should not use the same signature.

 

2. The bank's Android mobile client uses the certificate signature of a third-party outsourcing company.

Banking applications, as an application closely related to people's property, should pay more attention to application security. As an Android Application closely related to application security, each bank should create its own signature certificate and strictly manage the certificate. Even if the client is developed by another company, when the application signature is finally released, each bank should use its own unique Certificate for signature. However, the current situation is that the applications of multiple banks actually use the certificates of the same outsourcing company, and this certificate is the public certificate of the company from the current analysis, there is no independence or confidentiality.

 

3. The Certificate Management of third-party outsourcing companies is missing. Such an important certificate is used by an individual to issue a personal application.

Some rules and permissions that can be used by applications that use the same signature in the Android system. Once such an important signature certificate is used by individual developers to create malicious programs, this will bring great harm to users who use these genuine client applications, especially the banking applications. The current situation is that 20 banking mobile clients use the same certificate. Once the certificate is stolen, malicious developers will endanger the security of user funds for at least 20 banking mobile clients, the scope of hazards is extremely large.

 

Currently, this vulnerability has been submitted to the wooyun vulnerability platform:

Http://www.wooyun.org/bugs/wooyun-2014-067027
Bank of China's mobile phone bank successfully paid, but "User signature verification error", bank customer service can not get through, good garbage

I saw on ICBC's online banking page today that the mobile banking has been canceled. You can call the 95588 online banking service to ask
 
Online Banking is called online banking. What should I do with mobile banking?

When I play with my cell phone in class, my deskmate says don't play. I said I don't play with you on my cell phone. If there is one kind of attack, I can't beat me if I'm under six years old! I finally know why I am single: I do not like me, I do not know. Drink green source changruntea, click it, and the chest is gone. If it wasn't enough, I really wanted to show myself that I was a p, but I liked to put myself into a B. Whenever it is difficult, I will read the Tibetan scriptures: "Why are you?" is translated into English: All money go my home. In addition to being beautiful, nail polish also has a benefit. When bored, it can be scratched to make a cell phone a walkie talkie. It's not my lust, but I cannot find the direction of tolerance. I am so comfortable to see people who are not pleasing to the eye. After so many years, is it easy for my parents to make me so fat? I will not lose weight and will never lose weight. Select my husband's standards: even if I lose my face, I have the courage to take me out. Even if I have a plastic surgery, I can find it again. Summer is coming, but my body is not ready yet. A woman must have her own house so that she can say, "you get out of here ." The life of food is like a train. To sum up, visit ------ eat, visit ---- eat, visit --- Eat, eat... Thank you for stealing me and letting me know that he is a human-model dog. What should I do if an online bank is called online banking... It is said that two male and one female are walking down the street. All three of them will feel like they are a light bulb during the Tomb Sweeping Festival. Some of them are not dead, but they want to add them to the grave. The three most touching words in the world are not "I love you", but "you are thin" who told me that Nokia can smash walnuts, and now the screen is black. Tomb Sweeping Day should go back to your school to sweep the grave, because it has buried your youth and exposed your complaints to the sun every day, in my mood, I will not lose calcium. I spent my heart on you. Losing money is the biggest challenge. What is losing love! Rich Rolls-Royce, no money, no labor, no fatigue, single eyelid, smart, double eyelid beautiful, I am a single pair. If it cannot be amazing, it's ugly! If someone else eats two mouthfuls of food, they will be full. If I am full, I can eat two mouthfuls of food. You asked me if I have any religious beliefs. I said, "Narcissism is not counted ?" Another season for women to conquer men with stockings ~ Show me your face. If you are on a color palette, you will be on a sunny day. According to the weather, you should have crashed .... Good man, when quarreling with his daughter-in-law, is holding a desperate mentality. God, I will never call you again. You are not good at your granddaughter. The first thing to wake up every day is to want to go to bed. A man never regrets getting married, but regrets not marrying another woman. Don't always ask me why I am so short because I am afraid of height. The next time another guy sneers at you. You should go back to him: You have fine legs, and you have little legs to say that I am arrogant. I just refuse to deal with animals. "I don't care about appearance." I really want to beat him with a brick. Please go straight to the topic and challenge my blacklist with your ignorance. Not all milk is called trunsu, but not all I call him pig. Only now can I find that my childhood streaking is so bold that I think it looks pretty good. Why is it that failure is not terrible, the terrible thing is that you believe that there are so many brains in the world, but you have become one of the best in the world, so many poor people in the world, why should you count as one of me.