According to the results of the DCB Index, South Africa is the leading country in the ranking, with the highest score (3.4 out of 5). In the Middle East and North Africa, Morocco and the UAE stand out, surpassing last year’s leader, Bahrain. Nigeria and the Democratic Republic of Congo also rank highly, with 3.1 and 3.0 respectively.

DCB has proven to be a powerful payment tool in the MEA region, and the overall fraud prevention of mobile players has increased by 0.2 compared to 2021, showing a collective willingness to safeguard this technology. DCB has the potential to become even more powerful than credit cards, and mobile operators have all the advantages to elevate DCB and become major fintech companies. However, it is important that businesses protect DCB with the right cybersecurity solutions.

The DCB Index is intended to provide mobile players with an overview of the development of DCB in the MEA region, helping them to better understand how to improve their business in their own country or what conditions to consider when deploying in other countries. 

The post DCB Index 2022: Insights into the Direct Carrier Billing Market in the Middle East and Africa appeared first on Evina.

Can you tell us more about where the malware hides?

The malware is hidden in a messaging app named Symoo on the Google Play Store.

It’s available worldwide, but the app has been downloaded the most by users in India, Bangladesh, Pakistan, Algeria and Nepal. 

You won’t find the app anymore on the Google Play Store however, as it’s been removed following our press release.

The malware steals phone numbers from users, how exactly does it do that?  

So the first thing to understand is that the infected app Symoo masquerades as a legitimate messaging app to impersonate users and create fake social media accounts.

It starts out with a user that finds the app on the app store, downloads it, and when it opens the infected app, the first thing that pops up is the app’s request to get the user’s phone number. 

When the user launchers the app, a loading screen appears and in the meantime, the app has launched a malicious program in the background that sends the user’s phone number to an external server and intercepts all SMS messages. 

This external server is used by a marketplace that collects the stolen phone number and reads the SMS messages linked to this number to obtain one-time codes that allow to create fake social media accounts. Millions of fake accounts on popular social networks like Facebook or Telegram are created this way and individuals can purchase these fake account directly from this platform to remain anonymous while potentially perpetrating criminal actions. 

What has been the malware’s impact up to now?

All users that have downloaded the infected app and entered their phone number are victims of the malware. These users now have fake social media profiles linked to their phone number and they aren’t aware. In India, there are 100K victims, in Pakistan 9K, in Algeria 3K and in Morocco 1K.

For more information, read the full press release.

The post How a malware-infected messaging app is impersonating millions of users worldwide appeared first on Evina.

They work in exactly the same way. Their objective is to steal mobile users’ Facebook login credentials and data.

These apps require users to log in to their Facebook account to allow them to access the app’s content and, therefore, collect the credentials.

Below is one of the apps that featured malware, and was downloaded over +500K times.

How it works

To steal login credentials, the malware launches a webview and runs a javascript command to retrieve the values typed by the user.

The next step is to use the API graph to get the account information.

The interesting malware feature

The malware is interested in the advertising campaigns that mobile users might have launched, and it’s also interested in the credit card they have registered to do so.  

This allows the malware to create its own advertising campaigns with the mobile user’s account, and thus their credit card.

Here is a list of other identified malware-infected apps – in the top new apps of the Play Store:

https://play.google.com/store/apps/details?id=com.cutestudio.neonphotoeffect&gl=FR

https://play.google.com/store/apps/details?id=com.meicalhowell.motion.pixmotion…

https://play.google.com/store/apps/details?id=com.Blodwen.Gower.photoeditlab…

Note: At the moment, most of these apps have been deleted.

Credits: Maxime Ingrao

To never miss a cybersecurity update, subscribe to our newsletter.

The post The return of the Facebook thieves appeared first on Evina.

He is also President of the European CyberSecurity Organisation (ECSO) in Brussels.

As an expert in this field, we asked him about the cybersecurity challenges on the rise in the mobile era.

Evina has just published a case study that traces the origins and outcomes of its collaboration with the Belgian mobile phone operator Proximus. What are your thoughts on this case study?

This type of case study is very exciting as it clearly demonstrates the power of cybersecurity when it aligns with business objectives.

My understanding is that Proximus was on the verge of closing down a large part of its mobile payment business simply because it had become too complex to manage. This unnecessary complexity was due to massive and repeated attacks by fraudsters. This would have been a reaction that we have often seen with other operators. However, Proximus decided to keep its wits about it, not panic and today it is reaping the rewards of not giving in to fraudsters.

This decision to face and manage fraud proved to be more than worthwhile. Thanks to Evina’s technology, Proximus contained and then eliminated fraud and thus breathed new life into its mobile payment activities.

This is a textbook case: not only does the operator now better protect its customers, but thanks to this newfound confidence, interactions are more fluid, more numerous and consequently revenues increase.

Evina embodies this new era of cybersecurity, where we are moving from a defensive to an offensive expenditure that allows access to promising new markets.

You talk about a new era in cybersecurity, what are the specifics?

The players in the Internet world are gradually becoming aware of the true potential of cybersecurity. It’s not just a question of avoiding tragedies, but of having a daily facilitator and accelerator of business.

In this new era of cybersecurity, being a specialist in good protection practices is no longer enough. The crucial challenge today is to develop advanced technologies based on an in-depth knowledge of the global economic ecosystem.

This knowledge of the ecosystem allows to intervene at multiple levels where fraudsters attack and therefore to not only protect each player but also to open up business opportunities by protecting and streamlining the entire chain.

For example, in the world of mobile monetization where operators are at risk as well as advertisers, advertising agencies, merchants or payment aggregators, companies like Evina manage to intervene at all stages of interactions and with all players. This creates a beneficial chain reaction for everyone involved.

Better protected networks mean fewer barriers and manual checks, so more simplicity, more speed, more transactions and more revenue for everyone.

Does Evina have a unique market positioning?

While Evina’s positioning is perhaps not unique, it is nevertheless rare in the market for two reasons.

Very often, cybersecurity companies are outside the ecosystem they intend to protect and therefore have a poor understanding of the issues at stake. In such cases, they can only protect to the detriment of turnover.

In the case of cybersecurity companies that are part of the ecosystem, they often have links to certain actors which creates conflicts of interest and prevents the establishment of healthy relationships based on trust.

This is why companies like Evina, who combine technical expertise, neutrality and knowledge of sectoral issues, are rare, yet essential for the long-term growth of the market. This makes them all the more valuable.

How do you see the market evolving in the coming years?

Today more than ever, the Internet has the potential to be a formidable tool for prosperity.

The increase in fraud, however, limits the full realization of this potential: barriers have been erected that were supposed to protect but which have above all prevented free trade.

To gain a little more flexibility while avoiding the criminals, many have taken refuge in secure environments run by giants, all American. This strategy, though comfortable, is not without consequences. Aside from the Cloud Act, which is a pass on your data that the American authorities claim as their own, it always comes at a higher cost than expected.

It’s a sub-optimal situation that makes too many losers to last forever.

So we already see companies like Fortnite questioning Apple’s hegemony by leaving its closed environment.

All companies that wish to escape the pincers between the taxation of GAFAM and the theft of criminals are in dire need of protection. This is why I believe in the emergence of these new high-tech companies that know how to align mastery of cybersecurity and business challenges.

They will be crucial architects of the development of a safer and more prosperous Internet, and will undoubtedly be very richly rewarded for doing so.

The post What is the future of cybersecurity? Philippe Vannier answers our questions. appeared first on Evina.

On the 4^th of August 2020, Lebanon experienced an unprecedented tragedy. In the heart of Beirut, the country’s capital, a stock of ammonium nitrate exploded causing 171 deaths, and leaving thousands injured. Because of the substantial damage in the surrounding area, more than 300.000 people are currently homeless. The images were seen around the world, prompting an international show of solidarity. Donations are pouring in to help those affected, attracting the attention of scammers trying to pass themselves off as charities.

In order to help, Evina used its knowledge in cybersecurity to check out numerous websites calling for donations for Lebanon, and identified which were legitimate websites and which ones were scams. Before sending money to a website, be certain to check the following points to make sure your donation will actually be of use to Lebanon.

Each site must clearly display the name of the organisation as well as its address, and the mandatory terms and conditions. A simple Google search using the website’s name or URL generally unearths any negative existing feedback on the internet. Also check if there are any links to an external website or social network. Finally, do a search using any identifiable information given on the site, like the name of the PayPal account or the e-mail address. If it’s a scam, they will often appear on other fake websites.

Websites to avoid

When analyzing these websites, Evina found enough elements to officially call them out as scams.

https://beyrouthshima.com

This site doesn’t display either its name, address or the terms and conditions. Their PayPal account PIXER doesn’t belong to any known organisation. However, this account is used by another suspicious website, https://www.8cups.online, which again doesn’t include an address, and their social network links don’t work.

https://savelebanonlives.com

This website doesn’t provide an address or the terms and conditions, and is completely unknown on Google or social networking platforms. Additionally, when you subscribe to their newsletter, you’ll receive an e-mail from givepalestine123@gmail.com.

https://www.impactlebanon.org

Aside from the missing address and terms and conditions, this is a phishing site asking for donations in cryptocurrency. It is impersonating another site (https://impactbeirutlebanon.com) by using the same logo and a similar URL.

https://www.cryptofundlebanon.com

Yet again, the first clue with this website is the missing terms and conditions. However, this one is more easily spotted thanks to a link to a completely unrelated Instagram account. Additionally, the webmaster tried to promote his site on Reddit but ended up deleting his post when several comments called it out as a scam.

https://loveforlebanon.com

This website includes broken links to social networks, but what really helped identify this website as a scam was the contact e-mail contact@naturelove.org. The same address is used by numerous other websites that always ask for donations. This includes websites about surfing, weddings, or Android news.

Websites to safely donate

The fact that these scams exist shouldn’t discourage you to help out the Lebanese population. Evina has compiled the following list of recommended websites, checked by us, so you can safely donate.

ASHRAFIEH 2020: https://www.just-help.org/c/relieffund

BEIT EL BARAKA: https://www.beitelbaraka.org

RIFAK el DARB: https://www.just-help.org/c/rifaqeldarb

BAYTNA BAYTAK: https://www.gofundme.com/f/help-beirut-explosion

IMPACT LEBANON: https://www.justgiving.com/crowdfunding/lebanon-relief

OFFRE JOIE: https://www.givingloop.org/offrejoie

LEBANESE RED CROSS: https://www.supportlrc.app/donate/

LEBANESE FOOD BANKS: https://lebanesefoodbank.org/donate/

The post Donations for Lebanon: beware of scams, make sure your money reaches the right people. appeared first on Evina.

We had Google shut down those applications. Evina managed to successfully reverse-engineer the malware which enabled us to protect end users against it. This is critical for our customers:

Brigitte De Ducla, Orange France

“We have successful results with Evina; in addition to providing us with premium protection on our carrier billing, they also help us create a safer customer journey, therefore preserving the global experience of our clients”.

Here’s how they steal your Facebook

When an application is launched on your phone, the malware queries the application name. If it is a Facebook application, the malware will launch a browser that loads Facebook at the same time. The browser is displayed in the foreground which makes you think that the application launched it. When you enter your credentials into this browser, the malware executes java script to retrieve them. The malware then sends your account information to a server.

Lionel Ferri, Evina CTO: “It’s a fraudulent technique that points out the danger and reflects how important it is to protect yourself. It cannot be identified by Facebook as the malware displays in front of the legit app when it is launched”.

Why are you always targeted? Because everyone is targeted.

Internet-based fraud has become so pervasive that sometimes it seems as if everyone you meet has, at some point or another, been a victim of digital fraud. Often when one is targeted by online fraudsters, the first reaction is ‘why me?’.

Rest assured that we are all in the same boat and while it is normal for the victim to think they have been specifically targeted, we are all targets. Furthermore, we must highlight that victims should never be blamed for the criminal actions of others.

Fraudsters are everywhere and they are not confined to the DCB sector. They lurk in every nook and cranny of the web and it is the job of experts like Evina to flush them out. Our clients are very helpful in this regard. They regularly provide us with valuable information that helps us lift the lid on what you could call the “digital fraud of the day”.

In conclusion, keep in mind once that the victims are not the culprits: the app developer, the app store and all other legitimate players involved are simply innocent victims of fraudsters and their malware.

The post They steal your Facebook appeared first on Evina.

All Evina customers: mobile operators, payment gateways and content editors are protected from MobOk and in doing so, so are all their customers.

How does it work? MobOk collects information that is useful for its fraudulent activities such as the relevant operator details and mobile device screen size. It then launches an invisible browser that aims to subscribe the user to premium-rate mobile services using the applicable billing operator.

MobOk will ask for permission to read notifications and this is how the malware is able to retrieve the content of SMS messages. Consumers have to accept permissions manually.

There are several indications that this type of fraud initiated in Germany. First of all, the majority of negative comments are in German, furthermore the application communicates with the ium2.de domain and finally we have received attacks on German IPs. Other cases concern Asia, especially Thailand and Malaysia.

DETECTION

Evina has created a honeypot that uses a network of 3G proxy SIM cards around the world to attract fraudulent activity. When we use SIMs in Germany, we have seen fraudulent subscriptions as a result of the MobOk application.

MOBOK GENERATIONS

The malware family has evolved a way to load its fraudulent code to avoid detection by the Play Store.

First generation

In the beginning, the malicious code was located directly in the application with only a simple obfuscation.

Second generation

In the second generation of MobOk, the malware had an encrypted DEX file in the Assets folder that contained all the malicious code. The decrypted function was directly in the code.

Third generation

Finally, MobOk uses the Bangcle packer, to hide all the files from the library and also has significant anti-reverse engineering protection.

FRAUD SCENARIO

During the attack, MobOk sends information from the affected phone to a C&C (Command and Control) server whose domain is: ium2.de. The send request is encrypted by the application.

The server in response provides MobOk with the URLs and Javascript to execute in order to achieve this fraud. The response is also encrypted.

Then, MobOk turns off the WiFi to connect to the mobile network where it will be able to charge for the premium service.

Finally, the malware launches an invisible browser where it browses the URLs it has received and executes Javascript commands.

SUMMARY

MobOk is a family of malware that is constantly evolving to remain undetected by the Google Play Store. In its latest generation, and according to our sources, none of the malware in the family has been detected. It is quite likely that MobOk will spread to many other countries and, given the code, that it will extend its fraudulent activities.

HOW TO PROTECT YOURSELF?

If you are an end-user, it is necessary to be careful with the applications you download. To limit the risk, we advise you:

• To check the comments on the application page
• To check the permissions (a wallpaper app does not need to have any specific phone permissions)
• Avoid flashlight, scanner, wallpaper, SMS applications

If you are a service provider, such as a mobile carrier, payment gateway or content editor, you must use an independent anti-fraud solution expert in payment and mobile cybersecurity. 

Evina guarantees end-users safety and ensures a sustainable growth of the German mobile payment market, collaborating with local carriers such as Mobilcom-Debitel and T-Mobile.

APPS

The post Evina protects end users from MobOk: an incessantly mutating malware family in Germany appeared first on Evina.

Google reCaptcha is the CAPTCHA solution offered by Google, which we have all already seen before:

Google recently created a third version, and it doesn’t work better. 

1- Google reCAPTCHA exposes end users to fraud

Since 2012, hacking Google reCAPTCHA has become a national sport: 

• https://arstechnica.com/information-technology/2012/05/google-recaptcha-brought-to-its-knees/
• https://threatpost.com/google-recaptcha-bypass-technique-uses-googles-own-tools/124006/
• https://www.wired.co.uk/article/google-captcha-recaptcha 

On the dark web, fraudsters resell kits to bypass Google reCAPTCHA industrially. On the web, it costs 1,5$ per 1000 Google reCAPTCHA hacked: https://anti-captcha.com/mainpage

Abdelaziz Khaled, Cyber Security Analyst at EVINA: “These tools are easy to download and set up. We find them everywhere. When we reverse-engineer a malware, as we did with MOBOK Malware, it involves a part of coding dedicated to bypassing Google reCAPTCHA” (picture below).

2- It prevents customers from purchasing what they want

Indeed, Google reCAPTCHA v3 generates false positives.

Wesley Hendriks, Head of Data Team at Sam Media: “We have tested Google reCAPTCHA v3 and compared the results with other anti-fraud solutions.  We noticed that around 50% of legitimate traffic, according to other anti-fraud solutions, received the lowest scores – ’10’ or ‘30’-  from Google reCAPTCHA V3.”

Since the product is free, Google offers very little support and understanding of the data collected. Google provides clients with a score between 0.0 and 1.0 for them to determine which transaction to block. Yet support and thorough analysis are key to fight fraud the right way.

Fabienne Huygens, Product Owner at CM.com: “When it comes to an anti-fraud solution, support is essential. The team at Evina is proactive and supports our teams on a daily basis to fight against fraud.”

Franck Semanne, Head of Carrier Billing at Bouygues Telecom: “In terms of anti-fraud solutions, we can’t rely on an average score to let us decide what we consider as a fraud. An anti-fraud solution must detect and precisely define a fraudulent attempt, and this is what we appreciate with Evina.”

Our team is at your disposal to provide you with effective tools to combat fraud, and to help your partners understand that Google reCAPTCHA is not an optimal anti-fraud solution.

The post Google Recaptcha is not an anti-fraud solution. appeared first on Evina.

Our customers are safe from this malware thanks to Evina’s protection. 

In order to charge for services the Troll SDK disables the WIFI, which draw user’s attention and bring them to give a bad rate on Google Play Store. To get around the problem, bots located in Thailand raise the average rating posting numerous 5-stars comments.

It seems the fraud is global with comments in Asia (Indian and Thai). Regarding Europe, the app is well-ranked in Austria, Italy and Spain.

FUNCTIONALITY

After installation, the Troll SDK waits several launches of the app before being executed and sending information to register to the Command & Control server hihotdog.com.

In return, the server responds with parameters including the phone_id which is used to query the server that will retrieve fraudulent offers. We also find information to execute the frauds like the time interval between each fraud.

Then, the Troll SDK executes the function doBiz, and next it queries the server to retrieve the fraudulent offers and disables the WIFI to go to the operator’s network.

Finally, the Troll SDK executes the urls and javascript contained in the server response.

It is common to find offended code or fraudulent files that are downloaded after installation in frauds to fool users. But this new fraudulent SDK does not hide, it uses a rather explicit name “Troll” and method names like “doBiz” …

It is surprising to see that the application has not been removed yet while there is no will to hide the fraud, especially since it has been installed a million times.

It is therefore necessary to be careful with the applications you download, to limit the risk we advise you:

To check the comments on the application page

To check the permissions (a wallpaper app don’t need to have phone permissions)

Avoid flashlight, scanner, wallpaper applications

We have reported the concerned apps to Google. 

The post Ad fraud: a troll lives in a one million install game appeared first on Evina.

Users complaint on the app Play Store page: content was disappointing, and some users have been subscribed to paid services without their consent. We also were able to confirm that EVINA DCBprotect blocked this malware since its very beginning. Companies protected by our solution have not been impacted by this fraud.

Since last weekend the application is ranked in the top free applications in France, Germany, Italy, Spain and in the Netherlands.

“Stars Wallpapers” has been downloaded more than 100,000 times in three days between January 2nd and January 5th.

How did we find it?

Evina uses its own global proxies network to catch frauds. We noticed an unusual behavior of few of them (data consumption higher than expected, bill invoiced for premium service). When noticing this kind of behavior, we dug on history and found where it came from: an application called “Stars Wallpapers.”

During the application’s analysis, we spotted that a piece of code of the application was missing even though it was declared.

We quickly realized that a library inside the application loads the fraudulent code. It creates two encrypted Dex files and deletes one of them as soon as it has been created and then loads it into the memory.

This method prevents detection by Google Play Store because the malicious code is not directly in the application.

First of all, the malware creates an invisible window to track the user’s behavior and trigger the fraud at the right time.

During this time, the application receives and writes instructions in streaming with a server on the faymobi.com domain on port 9091 (which helps to hide these exchanges).

Fraud instructions are stored in the application’s shared preferences. It contains encrypted information about the javascript actions to execute but also the information whether you have to send a sms or if you have to pass a captcha during the journey.

It also includes the time interval between each attack and the maximum number of attacks per day.

At the right time, the malware disables the wifi to be on the mobile network and launches an invisible browser, it executes all the actions of the file in the shared_prefs which thus subscribes to a premium service.

It is common to say that malware hides in unofficial store or is not very visible and contains suspicious permissions.

That’s why Stars Wallpapers is dangerous because it doesn’t ask for any suspicious permissions, the content of the application looks professional and above all it is very well-ranked on Google Play Store.

Fortunately, victims of this malware were able to comment or rate this application to warn of its dangerousness, which stopped its number of installations but not its ranking.

It is therefore necessary to be careful with the applications you download, to limit the risk we advise you:

To check the comments on the application page

To check the permissions (a wallpaper app don’t need to have phone permissions)

The post Malware rises to the top applications in the Google Play store appeared first on Evina.