Hello, welcome to the Friday, March 24th, 2017 edition of the Sansanet Storm Center's Stormcast. My name is Johannes

Ulrich, and if I'm recording from Jacksonville, Florida. Checkpoint security is writing about research

done by Tencent security about a new Chinese troche. Now, the Trojan itself isn't really all that new actually.

It's called the Swearing Trojan and it's pretty much a mobile banking malware.

So what it does is it tries to emulate a legitimate online banking application, but then it tricks

the user into entering credentials and

forwards them to the misgrants. Typically, users infect themselves with these Trojans when they

install software they think is benign and it includes these Trojans as an additional payload.

But Tencent now observed a somewhat novel way of spreading matter like this swearing trojan in China

and that's by using malicious base transceiver stations or BTSs.

Now they're also sometimes referred to as fake cell towers.

A lot of attention has been spent on these fake cell towers and it has become easier and cheaper

to deploy them but once a user connects to one of these fake towers, in this particular case they will send

an SMS to user claiming to come from China Telecom and asking them to install this Trojan.

Once installed the malware is behaving like any other malware. It's intercepting passwords. It's also trying to spread itself by sending messages to contacts stored on the phone. But it's certainly surprising that these fake BTSs can reach sufficient coverage to spread a trojan like this

to a level where it does get noticed.

As a user, there isn't really all that much you can do about avoiding to connect to one

of these fake base stations.

So best thing to do is just assume that the network you're connecting to is not trustworthy.

And that's probably a good idea and attitude whenever you connect to any kind of internet connection.

And well, if you just updated last pass and you've got another update notice, it wasn't fake.

There is yet another bug that Google's Serity initiative found in this popular password wallet.

...