Rob Banks With Your Nokia 1100 – Forget the Getaway Car and Gun!

Posted by admin on 21/Apr/2009 in Security Alert Log | 2 comments

Loads of European banks provide their mobile banking customers with a list of sequential numbers and random requested checksums on a pice of paper or card. Without access to this physical list an attacker might be able to gain access to the banks online GUI but won’t be able to complete a fund transaction. This is a fairly secure method but carrying the piece of paper or card can be a bit cumbersome.

So think about it for a second, what’s more convenient and is always with you? Yep, your mobile phone.

It is becoming more common for banks to offer transaction authentication numbers (TAN) via SMS text messages. A customer registers his or her phone to receive the one-time passwords and the TAN is issued on-demand. Easy, simple, secure.

That brings us to this article: Criminals Pay Top Money for Hackable Nokia Phone

A company called Ultrascan Research Services claims East European gangs are paying BIG money for certain versions of Nokia 1100 phones. According to Ultrascan’s post some Nokia 1100 phones can be used to intercept SMS messages.

We don’t have details, we only know what is being claimed by Ultrascan. A bit of hunting around in the usual places has failed to bring up any requests or posts from would be gangster hackers offering sums of money for these phones.

To be worth the prices claimed to being paid (up to €25,000) the phone would somehow need to spoof the victim’s phone number WITHOUT using their SIM card. If that’s even possible then it is a very clever trick and suddenly enables the use of all of the past compromised account information that has been gathered by banking trojans.

That could prove to be a very sizable return on Ivan the Gangster’s investment, even for a €25,000 phone.