SOVA : Critical Mobile Banking Malware - Alert !!!

Our smartphones have become like an extension of our physical body. Last week in one of my lecture sessions I asked this question to the students, 

If you leave to the department without your smartphone, how many of you will go back and get your phone even at the risk of missing sessions or meetings?

It wasn't surprising that 100% of them said we will go back and fetch our phone. 

When I replaced the phone with an "assignment paper" in the same question, the percentage dropped significantly. What I am trying to derive here is that smartphones have evolved into an unavoidable dependency. In the entire human history, was there any such device or thing on which almost the entire human population was interacting day-in-day-out with utmost attention. I guess the answer is a BIG NO. In this backdrop, it becomes essential to have a basic knowledge about "Do's and Don'ts" on our phones. This post highlights a currently evolving security threat targeting our Android Phones.

(Image Source : https://unsplash.com/photos/S2qA7JhjI6Y)
 

Leaving out the entertainment purposes, today most of us use mobile devices for carrying out financial transactions as well. Literally, the smartphones are functioning as a Bank In Our Pocket. No doubt that its a luxury. However, if we don't take care of our devices properly it can become a big disadvantage as well, with a gamut of vulnerabilities. 

The specific reason for writing this post is the alert put out by CERT-In (Computer Emergency Response Team - India)  about a malware called SOVA.

SOVA is a mobile banking malware. SOVA means Owl in Russian. If you wonder what does a malware mean? 

Malware is any malicious software that enters into your device without your consent or knowledge and performs tasks that you are not even aware of. 

Sounds dangerous, right? Yes it is. This SOVA malware is a Android Trojan targeting your banking transactions. Again, for beginners:  

A Trojan is a software that claims doing a specific task but it is actually carrying out many hidden activities. 

Based on the potential damage a malware can do it is classified into various categories. CERT-In   has classified SOVA's Severity as CRITICAL .

This malware is available since 2021. But now SOVA has started targeting Indian Mobile bank customers. Hence on 15th September CERT IN has issued an alert about this Trojan. It can perform so many tasks without your knowledge and steal sensitive information which includes the following:

• Observe your keystrokes. This means that whatever you are keying in through your keypad can be observed by SOVA.
• Get access to your Camera: It can snap pictures and record video (Ofcourse, without your permission and knowledge !!!)
• Ability to capture screenshots. 
• Perform various actions such as Screen click, Swipe etc automatically. 
• Adding overlays over other apps to camouflage the user.
• Mimicing Payment Apps: This one is more dangerous as it has ability to mimic as your favourite payment app. 

This post is not to instil fear. However, 

Not knowing about a problem is indeed a bigger problem :) 

So how does SOVA enters into your device. The mode of attack here is Smishing (SMS Phishing). Once you click the link, then the fake app shall get installed in your phone. 

Ok. Take a deep breath. It is not the end of the story. Cyber world is always filled with such threats. We can safeguard our devices with the following best practices:

• Never ever install Apps from any Untrusted sources. Even if the app is providing wonderful service, don't install apps which are not screened by your App Store. 
• Even for the Apps from the app stores, verify the permissions. Don't grant all permission. Be strict with granting permissions. 
• Keep your Mobile operating system updated. Install all security patches. 
• If you have an anti-virus installed keep it always updated. Don't even think of installing a cracked version of anti-virus. 
• Avoid strictly visiting untrusted sites. 
• When you have received an SMS with a URL in it make sure it is redirecting to proper site. If the source of the SMS is unknown, don't click on the link. 
• When you click on shortened URLs, take utmost care. If the source from where you have received the link is not known, then don't click the link. 

Smartphones are very powerful devices. The impact of misuse is directly proportional to it's power. Phones are smart. Are we the users equally Smart? Need to Be.