Remote SMS Injection Threatens UPI Security

A recent report by CloudSEK reveals a significant shift in mobile financial fraud, highlighting how threat actors exploit the LSPosed framework to manipulate Android at runtime. This allows them to bypass UPI SIM-binding security without modifying legitimate payment applications, facilitating remote SMS injection, identity spoofing, OTP interception, and real-time account takeover.

The LSPosed framework enables attackers to "gaslight" the Android operating system, effectively dismantling the UPI SIM-binding mechanism, which is crucial for securing transactions in India. By hooking into system-level APIs, malicious modules, such as 'Digital Lutera,' can intercept registration tokens and spoof device identities, thereby tricking banks into believing that a physical SIM is present on compromised devices.

The implications of this vulnerability are profound, eroding trust in hardware-based authentication systems and paving the way for unauthorized account takeovers. To combat this evolving threat, financial institutions are urged to enhance device integrity checks and implement robust carrier-side validation to ensure that registration messages indeed traverse the cellular network.

The UPI SIM-binding process relies on a multi-channel security protocol that matches a physical SIM's SMS with a digital app request. However, attackers can exploit this by using compromised devices that enable SMS read/write capabilities, allowing them to hijack accounts without the victim's knowledge.

Previously, threat actors relied on modified APKs to trick bank servers into believing a victim's SIM card was present on their device. Now, with LSPosed, they can execute these attacks without altering the payment application's digital signature, evading traditional security measures like Google Play Protect.

The ecosystem has shifted from application modification to runtime manipulation, showcasing a new level of sophistication in fraud tactics. By establishing a robust Command & Control infrastructure, attackers can orchestrate real-time fraud, undermining the existing security models that banks depend upon.

This evolution in mobile threats necessitates immediate action by banks and financial institutions, emphasizing the importance of adopting advanced security measures to safeguard users against these sophisticated attacks.