South Korean Android banking menace – FakeCalls

Thursday 5 October 09:00 - 09:30, Green room

Raman Ladutska (Check Point)

When malware actors want to enter the business, they can choose markets where their profit is almost guaranteed to be worth the effort – according to past results. The malware does not need to be high profile, careful selection of the target audience and the right market can be enough.

This is the exact case that we observed in South Korea when we encountered an Android trojan named FakeCalls. This malware can masquerade as one of more than 20 financial applications and imitate phone conversations with bank or financial service employees – performing the form of attack known as voice phishing, or vishing.

Vishing attacks have a long history in the South Korean financial market. The problem was so serious that it even drew the attention from the government, resulting in a careful investigation and subsequent report: financial losses due to voice phishing constituted approximately 600 million USD in 2020, with the number of victims reaching as many as 170,000 in the period from 2016 to 2020. Knowing these facts, we understand exactly why this country and this market were chosen by the operator of FakeCalls.

We discovered more than 3,500 samples of the FakeCalls malware, which used a variety of combinations of mimicked financial organizations and implemented several new anti-analysis techniques. In our presentation we describe all of the encountered anti-analysis techniques, and show how to mitigate them, refer to the history of South Korean vishing attacks, and speak about the key details of the malware functionality.

• Download slides for this talk (.pptx)
• Download paper for this talk

Raman Ladutska Raman Ladutska has been interested in exploring the world's internals since childhood. He had a solid start, with a bunch of encyclopedias for reading, Lego bricks for building, and even a microscope for exploring. Raman's family still have fond memories of the reverse-engineered things he left in his wake. Next came perusing hacker magazines, learning to reverse engineer programs, university studies in computer security, graduation and being an all-around jolly good fellow to this very day. The Check Point Research team presents great opportunities for Raman to take on different challenges, channelling his energy and determination to a peaceful course of development and sharing the results with fellow researchers and the community.

Back to VB2023 Programme page

Back to VB2023 conference page

Register for VB2023

Other VB2023 papers