7

I have a mobile banking application installed on my phone which allows me to pay for things, transfer money using my phone from my account to another etc.

How safe or unsafe is this application? For example, what are the chances that I could get malware/virus/spyware/keylogger on my phone which could somehow record my bank details, or worse, steal my money and send my money to some foreign countries bank account?

Is such a thing possible, or is this impossible, i.e. are all android applications sand-boxed or something, which makes it impossible for malware/virus/spyware/keyloggers to tap into another application on the same phone, i.e. the banking application?

I am specifically talking about banking applications on android phones.

  • 1
    Remember that while losing control of your banking may be a temporary hassle, in the end as long as you have a photo ID you can go to your bank and generally fix everything up, so you shouldn't worry TOO much about hackers getting access to your bank account. – raptortech97 Aug 12 '14 at 13:03
4

Interesting question. In short I would say it is safe at least as your laptop/desktop are safe.

Explanation: mobile OS are far more advanced in their security architecture than your good old windows OS is.

Having said that it really depends on your device, OS and how you use it.

For example devices I would consider safe without any hesitation are unrooted iOS devices and Android Nexus devices. I would say most of these are much safer than most PC's are.

If you root/jailbreak your device you are greatly increasing the risk since you are breaking the defense mechanisms of the OS.

If you allow installation of applications from untrusted sources you are increasing the risk

If your device is not a high end device which gets updates on a timely manner you are at bigger risk (this is why Nexus devices are the safest among android devices)

If you connect to open public WiFi networks you are increasing your risk.

Additionally I would recommend to use the default keyboard and not some 3rd party keyboard. Not because I think 3rd party keyboard on the market are malicious (Apple and Google perform security audits on their markets) but because they might be logging your input for "good" purpose like word completion - but you cannot be sure they are doing it in a secure manner which will prevent your passwords from leaking who knows where...

  • 2
    I tend to disagree. iOS has a history of serious security flaws and has been easily crackable. Android devices are often pinned to unsupported version, such as 4.0 or even 2.3. The security architecture is irrelevant if the device doesn't receive patches. – Jeff-Inventor ChromeOS Aug 12 '14 at 20:54
  • 1
    @Jeff-InventorChromeOS it is true that patches are the biggest problem of the Android eco system. This is why I subject my words to the type of device, OS etc... I do not claim that iOS and Android are infallible, but they are not worse than Windows devices and in many cases even better. – aviv Aug 12 '14 at 21:18
  • @Jeff-InventorChromeOS Talking about history (slight OT): do you think (this)[forbes.com/sites/andygreenberg/2012/03/23/… forbes article is outdated? They say android is less secure. Can you, having worked for google, give some insight on this? – user10008 Aug 12 '14 at 21:19
  • They are both terrible. Android doesn't get security patches, and iOS is 100% compromised according to the Snowden leaks. You can't get less secure than 100% compromised. – Jeff-Inventor ChromeOS Aug 12 '14 at 21:58
0

A quick search on the internet shows that most banking apps have some kind of flaw. Altho most testers only tested the app itself and not the back-end servers or services (this would need approval from the bank), even here they find that some basic security measures haven't been applied. Some examples are targeting for older Android versions where permissions aren't needed, debugging left enabled, the app would accept any ssl certificate or don't even accept 2-factor authentication.

With this being said, it also depends on what banking app you are using, the bigger banks tend to do better with this as they mostly develop the apps inhouse and keep on developing it. Where smaller banks will "buy" an app from 3rd party developers and will not keep actively developing it.

  • So basically, it's very possible to have your money stolen from your bank account and transferred to some foreign country if you use a mobile banking application on your phone/tablet? – oshirowanen Aug 12 '14 at 9:45
  • This still depends on what app you use, but yes it is possible with some of the banking apps out there. – BadSkillz Aug 12 '14 at 9:54
0

Many banking systems use some sort of additional confirmation for transactions, ie bank can send confirmation code to your mobile. Even if malicious software on your desktop would try to send your money to someone else, it doesn't have access to text messages on your mobile. However, the same type of software can have an access to both - your banking and text messages with confirmation codes.

0

Any system can be compromised if not used carefully. As others have said, if the phone is rooted and apps are installed that do contain exploits then a risk exists for information to be captured from the various interfaces on the device because the device itself can no longer be "trusted."

Some apps can contain malware and viruses such as the free flashlight apps that were stealing passwords. Also if an app like DroidStealth can hide itself, other apps can as well.

That being said there are underlying issues with several of the encryption schemes being deployed for things like OpenSSL. It really comes down to how the applications for your bank are written, who wrote them, and how locked down your device is.

Other risk factors depend on the network. Just as a phone can be compromised a cell tower or wifi access point can both be compromised to allow someone to inject their own certificates and decrypt the information in-between. Since you're using an app, depending on the level of checking the app does for a particular certificate, it could be possible that it may believe it is connecting to the bank's server when it is really connecting to something else.

While there is a layer of "security" in regard to the mobile devices and what they allow and don't allow, there is also a layer of risk because the end user has no way of knowing what level the end certificates are without packet sifting (more complex over cellular). Read up on all of the latest exploits for the apps you use and adjust accordingly.

Other thoughts

If you look at it from the bank's standpoint, if it's a big bank, they likely have a team of developers working on the app all the time. It's a PR nightmare if they have an app that allows people to steal money from the bank. They'll likely roll-out updates monthly, if not weekly. They'll tell you what's been fixed. That being said, they can't control your device or your OS. Read the end user license agreement for the software you downloaded from your bank. In it, they'll clearly state what they are and are not responsible for. If they're not responsible for something according to that document, then there is the possibility that they may not plan for it in their coding, simply because they're not legally liable. While it may be in their best interest from a social standpoint, in some circumstances banks have been allowed to shift their risk in terms of their responsibility in regard to online risks. Banks get funding from governments and are protected by those different governments in certain events so it depends on your region. Because of that they are also required by law to have a reasonable level of security for whatever they produce and give out to their customers within certain jurisdictions.

In many cases the end user can be protected if they don't use the apps, because if a transaction happens via the app, even though it's not the bank customer's doing, the bank has no way of verifying the transaction is fraudulent if the person's account is authenticated on their mobile device. Meaning to the bank if it looks like you because they have all of the credentials and your account is authenticated from your device, then it likely is you, therefore anything "you" do you are liable for, whether the "you" is really you. If it comes down to a suit, they win because they have more money.

If you're using a desktop computer it might be easier to prove that you really didn't transfer all of your money away because there are logs. You can also limit access to the machine, and even setup a designated machine for sensitive transactions. Additionally on a desktop machine you can install software that will help to protect your system from viruses and malware. Be sure to update any device or machine to the most recent up-to-date versions as security releases happen quite frequently these days.

In any case you might want to look into installing software on your device that looks for exploits such as rootkits, malware, and viruses. While this isn't a fix for poor programming, bad habits, or improper usage, it could mitigate risk. You might also want to look into getting a more secure device if this is a personal issue.

-2

Android phones will always suffer from "hacks" and should be (unless you roll your own secure ROM and deal with the vendor tripwires of installing it) considered "insecure" to "less-than-ideal" secure devices.

If you are vigilant and secure your device; keep it up to date; go to few web sites; and don't install any apps you aren't very certain are safe you could consider it a moderately secure device for doing banking. I typically have a pad device that is exclusively used ONLY for secure applications (banking, PII sites, etc). Otherwise I do nothing else with that pad.

All of this said, banking is a repudiated transaction environment. If a hacker gets access to your account, while it will be a temporary hassle to you, and can have some collateral damage, there are zero electronic financial transactions that are not repudiated. Therefore hassles aside, you will in the end not be the one to pay - it will be some poor mule who was used to convert the money from electronic to physical and mule it somewhere else (all those "work from home", let me deposit some money in your account scams).

  • why do you think an android device can be hacked more than a windows PC? for example an android device out of the box doesnt allow installation of untrusted applications. A windows device allows installation of everything from any where. more examples? An android application has limited permissions and it has to ask for them, a windows app can do whatever it wants except running as admin which prompts the user... – aviv Aug 12 '14 at 12:36
  • Well the simple answer would be because I hack them every day! :) Android devices are not any technically more or less "hackable" than windows (or mac). However usage patterns, and hackable routes are more prolific as well as people tend to be more promiscuous in their security. – Tek Tengu Aug 12 '14 at 12:45
  • 1
    -1 for the third paragraph - it's been quite clearly established that banks will not reimburse transfers made by attackers who glean legitimate credentials. See this article, for example. Perhaps you are thinking of credit cards when you claim this, where it is generally true that fraudulent transactions can be challenged and recouped. – gowenfawr Aug 12 '14 at 13:19
  • Look dingus (gowenfawr), its a state jurisdictional issue but fundamentally the transaction is repudiated and end points are known. I said, there are hassles and there are, which is why you should have identity theft insurance (vs lifelock). But in the end the transaction can be reversed. Wow, I quit helping on this site for a while, because of crap like this, now I think I will again. – Tek Tengu Aug 12 '14 at 14:38
  • 1
    I've provided a cite which backs up my contention that banking transactions are not, in practice, repudiated. You are welcome to expand your answer with cites of legal cases or publicized examples where banks allowed transactions to be repudiated because they were made with valid but compromised credentials or software. But if you can't support your assertion with anything other than your vigorish, I'm afraid I can't accept it. – gowenfawr Aug 12 '14 at 14:59
-2

I would say older Android phones (2.3 and 4.0) and all iOS phones are extremely unsafe. Such older phones do not receive security patches. You don't need a 0-day exploit when the OS hasn't been updated in 3 or 5 years. The Snowden leaks included one little tidbit: 100% of iOS devices are crackable.

To mitigate the risks, I install banking apps on my tablet, which never leaves home and never connects to a public network. That way, even if Android isn't secure, there's not much opportunity for attack.

Everyone who hacks Comcast can still hack my tablet and bank account relatively easily, but at least there's a first step that's required.

It's not easy to guarantee security if you don't trust the OS. I don't install much on my tablet or use it for random web surfing. So it's basically an isolated and physically secure device.

  • 1
    How does this rule out malware? For example, you have another application installed on your phone which has undiscovered malware, which allows the malware app to tap into your banking application and send money from your bank account to some foreign country. – oshirowanen Aug 12 '14 at 8:38
  • 2
    You are correct. It's not easy to guarantee security if you don't trust the OS. I don't install much on my tablet or use it for random web surfing. So it's basically an isolated and physically secure device. – Jeff-Inventor ChromeOS Aug 12 '14 at 8:42
  • 1
    @Jeff-InventorChromeOS I would add what you comment to your answer. – Travis Pessetto Aug 12 '14 at 14:46
-3

Windows 7/8/8.1 will be massively safer than android as they still get security updates from microsoft, android is a complete mess for security, there is a few problems.

1 - google do not support android for very long, a recent exploit they announced wont be patched in 4.3 and older, 4.3 was not even 12 months old when they announced this. Microsoft meanwhile supported XP for over 10 years.

2 - even if google patch, users are at the mercy of their carriers, and carriers tend to not support old phones for long as they want to sell new phones.

3 - apps can only store data in limited places and banking apps are built for conveniance so a degree of login authentication will be cached on the device, whilst on windows certian elements also get cached, the windows mechanism is generally more secure. Proof of this is that on my banking app, if it detects the phone is rooted (Which it is) it will not let you use the app but still let you login via the browser on the phone, which shows the bank itself trusts browser login more than the app.

  • This doesn't really answer the question, which is about Android, not an Android/Windows comparison. – Mark Apr 15 '15 at 22:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.