Attacks on Android Banking Applications

January 13, 2020

Attacks on Android Banking Applications

Android smartphones are actually used by the majority of mobile users in the world. Thus, the Android market is open for everyone, and each developer could register as an Android Application Developer, and can develop and publish more android applications. However, this may result on serious consequences such as the deployment of malicious code, infected Android applications and it may open the way to several attack such as reverse engineering. [1] In 2011 there were only 3809 malwares detected for Android and this number has been increasing in the space of five years and exceeded one million to 2.3 million in 2015. Despite the security measures implemented by Google there are still infected applications deployed on the Play store.On the other hand, all major institutions today uses mobile application to promote and sell their product and to offer many services to make life easier for their customers. If we consider the case of banking institutions, many transfers are done daily via the mobile. So it’s very important to secure these application against many types attacks increasingly sophisticated. Reverse engineering of Android applications is a type of attacks usually used in this context. It is a process in which we decompile an application to understand its operation while analyzing the source code. The attacker after understanding the source code can make several attacks on the Android applications.

In this article we will study some of Android banking applications in terms of security. We will show how an access to the source code of the Android application can be dangerous both for users and for servers. So after reverse engineering, we will inject malicious code that will allow us to achieve a DDOS attack on a simulated banking server. Then finally we will propose some security measures against this types of attack.