Starting as an SMS stealer, the mobile malware Ginp has slowly changed focus towards payment card details. Ginp poses a significant threat, capable for breaking through the two-factor authentication codes that some banks issue in order to prevent fraudulent logins.
Cyber-experts at Amsterdam-based cybersecurity company ThreatFabric tracking have discovered that Ginp has gone through clear stages of evolution over the past five months.
Ginp can take complete control of the SMS communication on an infected device, harvesting message contents, listing them, sending messages, and even forwarding any to the command-and-control server (C2) infrastructure. In the world of malware, C2 is typically used to execute arbitrary commands on a victim system.
According to Will LaSala, Director of Security Services, Security Evangelist at OneSpan, this latest Trojan development presents a risk because it is continually altering: “The constant evolving threat of mobile malware is ever changing. Yesterday’s top malware program may get leaked and stopped but as we can see with Ginp, that same code can be reused and extended into newer and stronger threats.”
He casts an eye over new cyber-threats: “These newer threats add capabilities that make an even stronger case for implementing multi-factor authentication instead of SMS push for one-time passwords.”
LaSala presents a particular cautionary note to the finance sector: “Banks should always evaluate their threat index and ensure they stay ahead of the curve with a flexible platform that can swap out newer technologies as they are identified and implemented.”
