Community Content - By WhoTookMyCrypto.com

2017 was a landmark year for the cryptocurrency industry as the rapid rise in the value of cryptocurrencies brought them to mainstream media headlines. Unsurprisingly, this has generated huge interest from both the general public and cybercriminals alike. The relative anonymity offered by cryptocurrencies has made them a favorite among criminals, who often use them to evade traditional banking systems and financial surveillance by regulators.

Given that people spend more time with their smartphones than with their computers, it's no surprise that cybercriminals have also turned their attention to them. This article explains how scammers are targeting cryptocurrency users through their mobile devices, and some steps users can take to protect themselves.


Fake cryptocurrency apps

Fake applications of crypto exchanges

The most famous example is probably the Poloniex app. Even before the launch of the official mobile trading app in July 2018, there were already several fake Poloniex crypto exchange apps on Google Play that were specially designed to look legitimate. Many users who downloaded these fraudulent apps had their Poloniex login credentials compromised and their cryptocurrency stolen. Some apps even went a step further by asking for user credentials to log into their Gmail accounts. It is important to emphasize that only accounts without two-factor authentication (2FA) were compromised.

These steps can help protect you from such scams.

  • Visit the official website of the exchange to make sure that it really offers a mobile application for trading. If so, use the link on her website.

  • Read reviews and ratings. Scam apps often have a lot of bad reviews and people complain about being scammed, so be sure to check them out before downloading. However, you should also be skeptical of apps that have perfect ratings and reviews. Any real app will have at least a few negative reviews.

  • Check the app developer information. Verify that the company, email address, and website are legitimate. You should also perform an online search on the information provided to ensure that the application is indeed associated with an official exchange.

  • Check the number of downloads. The number of downloads should also be taken into account. It is unlikely that a very popular crypto exchange will have a small number of downloads.

  • Activate 2FA on your accounts. While two-factor authentication isn't 100% secure, it's much harder to bypass and can go a long way in protecting your funds even if your account login credentials are stolen.


Fake crypto wallet apps

There are many different types of fake apps. One option aims to obtain personal information from users, such as their wallet passwords and private keys.

In some cases, fake apps provide users with previously generated public addresses. Users think funds should be deposited to these addresses. However, they do not get access to the private keys and therefore do not have access to any funds that are sent.

These fake wallets were created for popular cryptocurrencies like Ethereum and Neo, and unfortunately many users lost their funds. Here are some preventative measures you can take to avoid becoming a victim:

  • The precautions outlined above in the application section of exchanges also apply. However, an additional precaution you can take when working with a wallet app is to make sure that brand new addresses are generated when you first open the app, and that you have your private keys (or seed phrases). The actual wallet application allows you to export private keys, but it is also important to ensure that the generation of new key pairs is not compromised. Therefore, you need to use reliable software (preferably open source).

  • Even if the application provides a private key (or seed phrase), you must ensure that public addresses can be obtained and created from them. For example, some Bitcoin wallets allow users to import their private keys or seed phrases to render addresses and access funds. To minimize the risk of compromising keys and seed phrases, you can perform this operation on an air-gapped computer (disconnected from the Internet).


Cryptojacking applications

Cryptojacking has been a hot favorite among cybercriminals because of its low barriers to entry and low costs. In addition, it offers them the potential for long-term regular income. Despite lower computing power compared to PCs, mobile devices are increasingly becoming the target of cryptojacking.

In addition to web browser cryptojacking, cybercriminals also develop applications that appear to be real gaming, office, or educational applications. However, many of these applications are designed to secretly run cryptomining scripts in the background.

There are also cryptojacking apps that advertise themselves as real third-party miners, but the reward goes to the app developer, not the users.

To make matters worse, cybercriminals are becoming increasingly sophisticated, implementing lightweight mining algorithms to avoid detection.

Cryptojacking is incredibly harmful to mobile devices as it reduces performance and accelerates wear and tear. Worse, the apps can potentially act as Trojan horses for even more malicious attacks. 

To protect against them, you can take the following steps.

  • Only download apps from official stores like Google Play. Pirated apps are not pre-scanned and are more likely to contain cryptojacking scripts.

  • Watch out for excessive discharge or overheating of your phone. Once detected, close the apps that are causing this.

  • Update your device and apps to fix security vulnerabilities.

  • Use a web browser that protects against cryptojacking or install reliable browser plugins such as MinerBlock, NoCoin, and Adblock.

  • If possible, install mobile antivirus software and update it regularly.


Free Giveaways and Fake Cryptocurrency Mining Apps

These are apps that pretend to mine cryptocurrency for their users, but actually do nothing but display ads. They incentivize users to keep apps open by reflecting increasing user rewards over time. Some apps even encourage users to leave a 5-star rating to get rewarded. Of course, none of these apps actually do mining, and their users don't get rewarded.

To protect yourself from this scam, understand that most cryptocurrencies require highly specialized hardware (ASIC) to mine, which means mobile mining is not possible. Any amounts you mine will be small at best. Stay away from such apps.


Clipper applications

Such applications change the addresses of the cryptocurrencies you copy and replace them with the addresses of the attacker. So while the victim may copy the correct recipient address, the one they paste to process the transaction is replaced by the attacker's address.

To avoid falling victim to such apps, here are some precautions you can take when processing transactions.

  • Always double and triple check the address you put in the recipient field. Blockchain transactions are always irreversible, so you should be careful.

  • It's best to check the entire address, not just part of it. Some applications are "smart" enough to insert addresses similar to the intended address.


Changing the SIM card

In a SIM swap scam, a cybercriminal gains access to a user's phone number. He does this by using social engineering techniques to trick mobile operators into issuing him a new SIM card. The most famous SIM-swapping scam is related to cryptocurrency entrepreneur Michael Turpin. He claimed that AT&T was negligent in handling his cellphone credentials, causing him to lose more than $20 million worth of tokens.

Once cybercriminals have access to a phone number, they can use it to bypass any two-factor authentication tied to it. From there, they can infiltrate your cryptocurrency wallets and exchanges.

Another method that cybercriminals can use is to track your SMS messages. Holes in communication networks can allow criminals to intercept your messages, which may contain the PIN code sent to you.

What makes this attack particularly dangerous is that users are not required to take any action, such as downloading fake software or clicking on a malicious link.

In order not to become a victim of such scammers, you need to take several steps into account.

  • Do not use mobile phone number for SMS 2FA. Instead, use apps like Google Authenticator or Authy to protect your accounts. Cybercriminals can't access these apps even if they have the phone number. Alternatively, you can use hardware-based two-factor authentication, such as Google's YubiKey or Titan Security Key.

  • Do not share personally identifiable information, such as a mobile phone number, on social media. Cybercriminals can obtain such information and use it to impersonate you elsewhere. 

  • You should never announce on social media that you own cryptocurrencies, as this will make you a target. Or, if you're in a position where everyone already knows you own them, avoid revealing personal information, especially about the exchanges or wallets you use.

  • Please contact your mobile operator regarding the protection of your account. This may mean attaching a PIN or password to your account and specifying that only users who know the PIN can make changes to the account. Alternatively, you can request that such changes be made in person and prohibit them from being made over the phone.


WiFi

Cybercriminals are constantly looking for entry points into mobile devices, especially cryptocurrency users. One of those entry points is WiFi access. Public Wi-Fi is dangerous and users should take precautions before connecting to it. Otherwise, they risk cybercriminals gaining access to the data on their mobile devices. These precautions are described in the Public Wi-Fi article.


Results

Mobile phones have become an integral part of our lives. In fact, they are so intertwined with your digital identity that they can become your greatest vulnerability. Cybercriminals know this and will continue to find ways to exploit this fact. Mobile protection is no longer "optional". He became a necessity. Stay safe.