How Malicious Apps Takeover Online Accounts

People often fail to realize the value of a simple email address to a cybercriminal. Sending spam to market products or phish for sensitive details surely is valuable, but combine a malicious app with users who forget passwords can be lucrative indeed.

As a criminal, any email addresses gained may open a door to even more information. Not only by phishing, but when you forget your password, websites such as PayPal, eBay, and Amazon allow you to enter your email address to get a link via email to reset it. A persistent criminal would use email addresses obtained to attempt to get access to accounts like those, where the payoff could be very big.

Jim Stickley of Stickley on Security wanted to prove this to a group of conference attendees. So, he wrote a malicious app. His app was designed to watch for those emails that went out to the users who forgot their passwords. When the messages arrived, the app that was installed on the mobile device would simply forward those emails to him. To cover any tracks, the app would delete the email from the user's account so that on one ever knew what happened.

Armed with a copy of the email containing the link to reset the password, he simply clicked on the link, changed the password, and at the drop of hat, he had control of the account.

This is all from a simple app installed on a mobile device and is just one of many malicious apps that he has written and demonstrated over the years to hundreds of thousands of people. The idea is to show people just how dangerous apps on a mobile device can get.

2

• Download and install apps only from the official app store for your devices or if you are getting your banking app, go to your financial institution’s website directly.

• When going to websites where you will put in sensitive information, use a previously bookmarked or trusted link or manually type the URL into the browser address bar.

• Be aware of clicking on ads that appear on the sites you visit. Often they contain malware. Consider using an ad blocker software so the ads don’t show up at all.

• Always have anti-malware software installed on your devices and keep it updated.

• Create strong passwords for online accounts and don’t reuse them from account to account. If you have to write them down, consider using clues to trigger your memory before creating a list. Never leave passwords or clues in plain sight at work or at home.

If you have accounts that you are not using, consider de-activing them. This will potentially keep your email address from being used by cybercriminals or prevent your accounts from being accessed, especially if you haven’t logged in for a while.