Your Bank Thinks I'm You - A Kill Chain Against Mobile Banking Security

The talk walks through a full attack chain against mobile banking and digital wallet apps used in a Latin American market, with the testing described as done in an authorized setting. The presenter frames the defenses as four stacked layers: runtime self-protection with root and integrity checks, anti-instrumentation, biometric identity verification with liveness detection, and anti-deepfake controls. The attack moves through them in order, starting with hiding a rooted device using freely available kernel-level modules and integrity-spoofing tools.

The middle section covers the Frida-based stage. By hooking the biometric SDK's image retrieval call, the researchers swapped the captured frame for a chosen image before the SDK packaged and signed it. Where the SDK added metadata and encoding, they rebuilt the same template on the client so the backend received a consistent payload. The liveness check ran entirely on the phone, so a real face could pass it while a different photo was submitted for matching. They also generated synthetic faces from ID photos with consumer AI tools, reporting that none were flagged by the anti-deepfake controls across their trials.

The closing part argues that the weakness is architectural: each layer trusts the one before it, and client-side checks cannot carry the decision. Suggested fixes include server-side validation of liveness, cryptographic binding of captured media, and behavioral analysis. The presenter also notes that criminal KYC bypass toolkits are sold online and that the demo videos could not be shown on stage.