Snowblind malware

02.07.2024

Snowblind malware

Why in the news?                        

A new banking malware called ‘Snowblind’ is targeting Android users to steal banking credentials.

About Snowblind malware:

• It is a new Android malware that uses a built-in Android security feature to bypass anti-tamper mechanisms and steal banking credentials.
• This malware exploits a built-in security feature to bypass anti-tamper protection in apps handling sensitive information.
• It works by repacking an app so it is unable to detect the use of accessibility features that can be used to extract sensitive information like login credentials and get remote access to the app.
• It exploits a feature called ‘seccomp’, which stands for ‘secure computing’.
• It is part of the underlying Linux kernel and the Android operating system and is used to check applications for signs of tampering.
• The security firm discovered that Snowblind injects a piece of code that loads before seccomp initializes the anti-tampering measures. This enables the malware to bypass security mechanisms and utilize accessibility services to remotely view the victim’s screen.
• Snowblind can also disable biometric and two-factor authentication, two security features commonly used by banking apps to thwart unauthorized access. Like typical Android malware, Snowblind infects users who install apps from untrusted sources.
• While the security firm was unable to identify how many devices are affected by the new malware, it says that Snowblind is mostly active in Southeast Asia.

                                                                Source: Indian Express

Ques :- Consider the following statements regarding the Snowblind malware:

Statement-I

It is an android malware which uses a built-in android security feature to bypass anti-tamper mechanisms.

Statement-II

 It cannot disable biometric and two-factor authentication of any android device.

Which one of the following is correct in respect of the above statements?

A.Both Statement-I and Statement-II are correct, and Statement-II is the correct explanation for Statement-I.

B.Both Statement-I and Statement-II are correct, and Statement-II is not the correct explanation for Statement-I.

C.Statement-I is correct, but Statement-II is incorrect.

D.Statement-I is incorrect, but Statement-II is correct.

Answer C