Don't bank on your phone – it could be hacked by Zeus 'trojan horse' By Patrick Collinson 22 July

Malware attacks Android phones to steal financial data as security experts warn of 'fraudsters' heaven'.

Photo: Pixellover RM 7 /Alamy

Using a smartphone to access free Wi-Fi in a public place such as a cafe puts you at risk of a security attack.

No one knows who lies behind Zeus. Security experts believe he or she is Russian, but no one is completely sure. But what they all agree is that Zeus is the most pernicious "trojan horse" – a destructive program disguised as an application – on the internet. During the last four years it has infected millions of PCs, taking control of the computer and stealing personal banking details.

Microsoft has fought a running battle against Zeus, which is one of the most difficult types of malware to detect – but the great fear among cybercrime experts is no longer your home computer. A new strain of Zeus, dubbed "Zitmo" (it stands for "Zeus in the mobile") has begun to exploit a huge hole in personal banking security: the smartphone in your pocket.

In the past fortnight, this malicious new version of Zeus, which attacks phones using the Android operating system, has sparked intense concern among security companies. One major US internet security provider, Trusteer, claimed Google Android is "fraudsters' heaven". The chief executive of Trusteer, Mickey Boodaei, said in a blog: "Bad news: fraudsters have all the tools they need to effectively turn mobile malware into the biggest customer security problem we've ever seen."

But it's not just Zeus that smartphone customers should be worrying about, according to Alex Fidgen of MWR InfoSecurity, one of the biggest cybercrime-busting outfits in Britain. It legally hacks into computers to test and improve security. More recently it has turned its attention to smartphones and found that it can crack open every new handset it sees.

"The mobile phone industry is not fit for purpose, especially for financial transactions," says Fidgen. "The evidence is irrefutable. You cannot be assured of security with modern smartphones. As soon as the handset is compromised, then any data is up for grabs."

Fidgen says the fault lies with the handset manufacturers rather than the network providers or banks. In the race to bring new phones and new features to the market, many have left security low on the agenda. Yet modern smartphones are in effect PCs with phones attached and, particularly when they are used in public Wi-Fi hotspots, they can become fatally compromised.

Trojans can enter a smartphone in many devious ways. All you have to do is click on a link or attachment that contains the virus, and within seconds it can secretly seize control of the phone. That link might be a tinyurl in Twitter. The attachment could be a vCard, the standard format for sending a business card to a phone.

Or it could be that you are accessing a website in a cafe. At Wi-Fi hotspots, fraudsters create bogus gateways, known as "evil twins", to which the latest mobile phones will automatically connect. As the Guardian revealed in April, once a connection is established, all the information passing through the gateway can be read directly or decrypted, allowing fraudsters to harvest user names, passwords and messages.

Until now, these attacks have been rare. But experts say that's just because smartphones are still taking off. "We're walking into a minefield," says Fidgen, who has been warning about the risks of mobile banking for several months, "but nobody's bloody listening."

At Trusteer, Boodaei forecasts that "within 12 to 24 months, more than one in 20 of all Android phones and iPads/iPhones could become infected by mobile malware … building a powerful fraudulent Android application that steals and abuses your identity and your bank account is almost trivial. Distributing these applications on the Android market is even more trivial."

In a demonstration by MWR InfoSecurity in the Guardian's offices this week, security consultant David Chismon showed how easy it is to hack into smartphones. In this case it was an HTC and a Palm Pre, but he says all smartphones can be compromised.

He clicked on an innocent-looking attachment sent in a text message. But it contained a trojan, which within seconds installed itself on the phone as a bugging device. Even when we switched the phone off, in reality it was still on, and every 30 seconds it sent a recording of the user's conversations to the hacker's computer. It also began keystroke-logging and form-grabbing, to identify banking passwords.

Are Apple iPhones safer than Android? MWR InfoSecurity says Apple's famed security from viruses doesn't quite translate to mobile devices. "Both platforms have problems," says the company.

"The Android market has quite a reputation for serving malware regularly, whereas Apple seems to be in better control of the content of the App Store. Android, however, has Sandbox [a security feature], which limits the impact of malicious or vulnerable applications. This can help limit the effectiveness of the malware, a feature that does not exist on the Apple platform."

However, MWR InfoSecurity feels the mobile phone industry is generally insecure. "Even if a specific platform excels from a security perspective in one area, it will have gaping security holes in other areas."

BlackBerry phones are considered safer to use, as their maker, RIM, "keeps details of the platform a secret, which makes it much harder for attackers to write malware".

All the experts are agreed that "jailbreaking" – where you remove the limitations imposed by Apple on iPhones and iPads – exposes the user to much wider security threats.

Why not simply add an anti-virus program to your smartphone in the same way that your home PC might be protected by Norton, McAfee or AVG? The bad news is that the phones may have been built so poorly in the first place that the anti-virus programs won't be much help. All they do is give a false sense of security to users, say the experts.

We asked the banks for their views, but they told us that, as long as users take sensible precautions, customers should not be put at risk. Lloyds TSB said: "We're committed to making our customers' mobile banking experience as safe as possible. We use the latest online security technology to protect our customers' personal information and privacy, and we guarantee to refund any money lost in the unlikely event of the customer experiencing fraud using mobile banking."

But are the fraudsters constantly one step ahead? A report in Information Week, a respected US technology magazine, warned of an ingenious new approach by Zeus/Zitmo that tricks home PC users into downloading it on to their smartphone.

The trojan sleeps on the home PC until the user logs into a bank website. At that point it wakes up, intercepts the process, asking the user to download a new security device on to their mobile phone to complete the banking log-in process. But in reality, the new security device is the Zeus trojan infecting their phone. Once it's on, it takes control of the user's phone.

Zeus is such a worry because it's not one criminal gang but cells of them operating across the globe. At its heart is a Russian developer who produces the source code and then licenses the program to numerous fraudsters in the criminal underworld. This software genius regularly sends out patches and updates so that every time it is detected, Zeus bounces back again.

Don Jackson of Dell's security arm, SecureWorks, is the person who first discovered Zeus in 2007, and he has been pursuing it doggedly ever since.

"Zitmo has all the hallmarks of the original author of Zeus. This brand new version is his flagship new product which he's making available to a select few. He writes it, sells it for huge amounts of money, and even supports his 'customers' to rid it of any bugs that develop."

The original basic Zeus kit is today sold in the criminal underworld for around $3,000-$4,000 (£1,800-£2,500). Buyers get a "full arsenal of information stealing capabilities," says Jackson, and can buy add-on modules such as "Backconnect" that allows the hacker to "connect back" to the infected device and make financial transactions from it. That sells for a further £900.

A quick search on the net by Guardian Money found several web forums where users were exchanging information about Zeus, and even recommendations on how to pay for it (a Costa Rican "no ID required" payment processor appears to be one route).

In FBI raids last year, co-ordinated with the British police and assisted by Dell SecureWorks, 90 gang members suspected of using Zeus to hack into computers and steal $70m were arrested, but the designer and developer of Zeus remains elusive.

Jackson says: "We think there is an inner circle of two to 10 people, then as many as 100 working in the individual gangs. Most of the guys operate out of Russia and Eastern Europe, but they do have a large presence on the ground in the US and the UK. They can't just operate behind a keyboard.

"Sometimes they have to cash in the accounts and wire money over," he adds. "We work a lot with government and law enforcement agencies. Zitmo/Zeus operators are now ranked as the number one security threat. This is a very, very capable group."

How to stay secure

• Don't trust links or attachments from people you don't know. If a person you do know has sent you a link or attachment, check with them that it is legitimate before opening it.

• Don't use public Wi-Fi, especially for financial transactions or other secure personal transactions.

• Do apply any updates that are made available for your devices.

• Do only install applications from reputable publishers.

• Don't "jailbreak" your iPhone.

• Do set an unguessable pin in case your phone is stolen.