Snowblind Malware: A New Threat to Android Banking Apps

A fresh cybersecurity threat has surfaced in the Android ecosystem. The newly identified malware, named ‘Snowblind,’ is proving to be a formidable challenge for banking apps, exploiting the Linux kernel within Android devices through a technique that has not been seen before.

Discovered by Promon, Snowblind represents a leap in the complexity of Android banking malware. It cleverly manipulates Android’s built-in security measures to execute attacks, subverting tools designed to protect users into weapons that jeopardize their financial information.

Snowblind’s Advanced Techniques

The ‘Snowblind’ malware is particularly concerning due to its use of the ‘seccomp’ security feature of the Linux kernel, which is part of the Android OS architecture. Seccomp, or secure computing mode, is a facility that restricts the system calls that applications can execute. 

Despite its intended protective role, Snowblind manipulates this feature to perpetrate attacks, essentially turning a security measure into a vulnerability. Snowblind’s technique abuses the seccomp functionality “to intercept and manipulate system calls,” Promon explained. 

This allows it to bypass standard security checks and anti-tampering measures, making it easier for attackers to stealthily carry out harmful actions on the device. They can also capture login credentials from banking apps and conduct unauthorized transactions by using other functions of the malware.

Unseen Levels of Access and Control

Snowblind does not stop at just exploiting security features. It also uses accessibility services, a common target for many types of malware due to the high level of access they offer. By manipulating these services, Snowblind gains extensive control over the device without the user’s knowledge, enabling it to conduct a range of malicious activities.

These activities include disabling critical security measures such as two-factor authentication and biometric checks. It also allows for the extraction of sensitive personally identifiable information and banking transaction data, which can be later used for fraud or identity theft.

Preventive Measures and User Safety Tips

Despite the advanced nature of this threat, Promon has been proactive in addressing it. The firm has updated its Promon SHIELD platform to version 6.5.2, which includes protections specifically designed to thwart Snowblind and similar seccomp-based attacks.

For everyday users, banking malware like Snowblind serve as a reminder to not install apps from unknown sources. To stay safe against such threats, you should download apps only from reputable sources like official app stores or directly from developers’ websites.

Related Reads:

• Medusa Banking Trojan Resurfaces, Targets Android Users in Multiple Countries
• Malware Attacks on Android Devices Draining Finnish Bank Accounts
• Is a VPN safe for online banking?