Source code for Android iBanking bot surfaces on underground forum
Leaked source code could lead to a larger number of attacks using the mobile malware, security researchers from RSA said — The source code for an Android mobile banking Trojan app was released on an underground forum …
Context & Ripple Effects
The leak was flagged by researchers at RSA, whose name has been in the security press all winter — the company faced protests over its NSA ties ahead of its own conference in January 2014, amid an unconfirmed report of a $10 million NSA contract and RSA's categorical denial. Now its research team is the one tracking a banking Trojan going open.
Syndication across SC Magazine, Softpedia, and RSA's own Speaking of Security blog shows how far the story travelled within days. The timing matters because Android's footprint keeps expanding — Opera figures in January 2014 showed Android's share of mobile Internet usage still growing — putting more bank customers on the platform this code targets.
First-order effects
- Per RSA's researchers, the immediate effect of public iBanking source is a lower barrier to entry: less-skilled criminals can now build their own variants rather than rent access, so banks should expect a wider spread of attacks against their Android apps.
Second-order effects
- Banks and mobile security vendors are pushed toward faster detection cycles, since each new variant built from the shared source forces fresh signature and behavioral defenses.
Third-order effects
- If the pattern holds — malware source surfacing on forums and spawning variants — Android banking threats shift from a few dominant crews toward a commoditized ecosystem where reuse, not original coding, drives volume, raising pressure on banks to harden apps beyond signature-based protection.
The trend: Mobile banking malware is moving from proprietary toolkits run by small crews toward publicly recycled code that lets any actor assemble an attack.