Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia

summary

Video file (mp4)

The gist

The gist: This study conducts an empirical penetration testing of banking and finance applications in East and Southeast Asia to evaluate their susceptibility to FjordPhantom, a malware that uses

In short

The study empirically tested banking apps across seven East and Southeast Asian countries for susceptibility to FjordPhantom malware, which uses virtualization to bypass security checks. Findings show significant vulnerabilities, with up to 75% in Singapore. The research highlights the need for better defenses against accessibility abuse in mobile banking applications.

Key concepts

FjordPhantom
This is a specific piece of malware that targets banking and finance apps in East and Southeast Asia. It uses advanced techniques like virtualization and hooking to trick security systems into ignoring its malicious activities, allowing it to steal data.
Virtualization-based Attack
FjordPhantom employs virtualization to create a deceptive environment for the banking app. This technique allows the malware to run in a way that bypasses standard detection methods designed to spot malicious accessibility services, enabling actions like keylogging and screen scraping.
Accessibility Service Detection
This refers to the security mechanisms apps use on Android devices to monitor and block unauthorized access by other applications. FjordPhantom specifically targets these checks, using virtualization to hide its presence from these monitoring systems.

Terminology used across episodes

This episode discusses

The paper

Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia · Read on arXiv

Singapore Management University · MIE-SPPU Institute of Higher Education, Qatar

Android banking applications have revolutionized financial management by allowing users to perform various financial activities through mobile devices. However, this convenience has attracted cybercriminals who exploit security vulnerabilities to access sensitive financial data. FjordPhantom, a malware identified by our industry collaborator, uses virtualization and hooking to bypass the detection of malicious accessibility services, allowing it to conduct keylogging, screen scraping, and unauthorized data access. This malware primarily affects banking and finance apps across East and Southeast Asia region where our industry partner's clients are primarily based in. It requires users to be deceived into installing a secondary malicious component and activating a malicious accessibility service. In our study, we conducted an empirical study on the susceptibility of banking apps in the region to FjordPhantom, analyzed the effectiveness of protective measures currently implemented in those apps, and discussed ways to detect and prevent such attacks by identifying and mitigating the vulnerabilities exploited by this malware.

DOI: 10.1109/APSEC66846.2025.00111

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: Today's paper: "Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia".

Elias: The gist: This study conducts an empirical penetration testing of banking and finance applications in East and Southeast Asia to evaluate their susceptibility to FjordPhantom,

Nadia: First, who's behind it and why it matters.

Paper summary: Nadia: So, wrapping up this look at the "Virtualization-based Penetration Testing Study for Detecting Accessibility Abuse Vulnerabilities in Banking Apps in East and Southeast Asia", the authors are pointing out a few key things about where we stand right now.

Elias: They're essentially showing that over two hundred twenty-five million Android users in East and Southeast Asia could potentially be subject to FjordPhantom, which really highlights the need for much stronger security practices in mobile banking applications across that area.

Priya: What this study means for someone just listening is that it shows how developers can use penetration testing and hardening measures to bridge the gap between what attackers are doing and what the apps are actually protected against.

Nadia: The paper emphasizes applying concepts like hardening measures directly in a practical way to stop attacks, which is important for moving security from theoretical ideas to real application.

Elias: It’s about understanding how this malware works at a low level—using virtualization and hooking—so developers can build defenses that specifically counter those mechanisms.

Priya: The implication here is that we need more focused research on the implementation details of those hardening measures and remote attestation solutions to see if they actually hold up against these kinds of accessibility abuse attacks.

Conclusion: Nadia: So, we've looked at how FjordPhantom uses virtualization to sneak past security checks in banking apps across East and Southeast Asia, right?

Elias: Yeah, that's a lot of layering there with the virtualization and hooking stuff.

Priya: And what this study really boils down to is mapping out exactly where these vulnerabilities are most common geographically.

Nadia: It shows that many of those banking apps have serious holes because they aren't checking for these accessibility service bypasses properly.

Elias: The authors found a huge vulnerability rate, around forty-three percent across all the apps they tested in that region.

Priya: But the numbers vary wildly; Singapore is hit way harder, at seventy-five percent vulnerability there compared to Japan or Korea.

Nadia: That variation tells us that the security hardening isn't uniform across those different countries.

Elias: And what they found was that anti-VM stuff is definitely the most common thing developers are doing to stop this kind of attack.

Priya: It's interesting because seventy-eight percent of apps with anti-disassembly measures were actually resistant, even when FjordPhantom didn't need to change the code itself.

Nadia: That suggests some existing protections are doing a decent job at stopping this specific type of evasion technique.

Elias: But it also shows that developers have to be very careful because attackers keep finding new ways around those defenses.

Priya: So, looking at the whole picture, this paper highlights that we need more than just one fix; we need a better system for checking these app protections overall.

More episodes

← Home