![](bgc.png)
Commerzbank A.G. (2016). Commerzbank photoTAN -
Android Apps on Google Play. Accessed: 12 October
2016.
Company, B. . (2016). Customer Loyalty in Retail Banking:
Global Edition 2016.
Cronto (2008). Commerzbank and Cronto Launch Secure
Online Banking with photoTAN. Accessed: 20 Sep-
tember 2016.
Cronto (2011). Cronto Launches World’s First Visual Tran-
saction Signing Hardware. Accessed: 4 October 2016.
Cronto (2011). CrontoSign. Accessed: 02 October 2016.
Dehghanpoor, C. (2016). Brain Test re-emerges: 13 apps
found in Google Play. Accessed: 16 September 2016.
Deutscher Sparkassen- und Giroverband (2015). Stellung-
nahme zur Angreifbarkeit von App-basierten TAN-
Verfahren. Accessed: 19 November 2017.
Dmitrienko, A., Liebchen, C., Rossow, C., and Sadeghi, A.
(2014). On the (in)security of mobile two-factor au-
thentication. In Christin, N. and Safavi-Naini, R., edi-
tors, Financial Cryptography and Data Security - 18th
International Conference, FC 2014, Christ Church,
Barbados, March 3-7, 2014, Revised Selected Papers,
volume 8437 of Lecture Notes in Computer Science,
pages 365–383. Springer.
Donenfeld, A. (2016). QuadRooter: New Android Vulne-
rabilities in Over 900 Million Devices. Accessed: 11
September 2016.
European Banking Authority (2016). EBA consults on strong
customer authentication and secure communications
under PSD2.
European Banking Authority (2017). EBA paves the way
for open and secure electronic payments for consumers
under the PSD2.
European Union (2015). Directive (EU) 2015/2366 of the
European Parliament and of the Council of 25 Novem-
ber 2015 on payment services in the internal market,
amending Directives 2002/65/EC, 2009/110/EC and
2013/36/EU and Regulation (EU) No 1093/2010, and
repealing Directive 2007/64/EC (Text with EEA rele-
vance). 337:35–127.
Goodin, D. (2016a). 10 million Android phones infected by
all-powerful auto-rooting apps. Accessed: 11 Septem-
ber 2016.
Goodin, D. (2016b). Android phones rooted by "most seri-
ous" Linux escalation bug ever. Accessed: 31 October
2016.
Haupert, V. and Müller, T. (2016). Auf dem Weg verTAN:
Über die Sicherheit App-basierter TAN-Verfahren. In
Meier, M., Reinhardt, D., and Wendzel, S., editors,
Sicherheit 2016: Sicherheit, Schutz und Zuverlässig-
keit, Beiträge der 8. Jahrestagung des Fachbereichs
Sicherheit der Gesellschaft für Informatik e.V. (GI),
5.-7. April 2016, Bonn, volume 256 of LNI, pages 101–
112. GI.
ING (2016). ING International Survey: Mobile Banking
2016.
Kivva, A. (2016). The banker that can steal anything. Acces-
sed: 22 September 2016.
Konoth, R. K., van der Veen, V., and Bos, H. (2016). How
anywhere computing just killed your phone-based two-
factor authentication. In Grossklags, J. and Preneel,
B., editors, Financial Cryptography and Data Secu-
rity - 20th International Conference, FC 2016, Christ
Church, Barbados, February 22-26, 2016, Revised Se-
lected Papers, volume 9603 of Lecture Notes in Com-
puter Science, pages 405–421. Springer.
Lafortune, E. Proguard. Accessed: 12 October 2016.
Maier, D., Müller, T., and Protsenko, M. (2014). Divide-and-
conquer: Why android malware cannot be stopped. In
Ninth International Conference on Availability, Relia-
bility and Security, ARES 2014, Fribourg, Switzerland,
September 8-12, 2014, pages 30–39. IEEE Computer
Society.
Mulliner, C., Borgaonkar, R., Stewin, P., and Seifert, J.
(2013). Sms-based one-time passwords: Attacks and
defense - (short paper). In Rieck, K., Stewin, P., and
Seifert, J., editors, Detection of Intrusions and Mal-
ware, and Vulnerability Assessment - 10th Internatio-
nal Conference, DIMVA 2013, Berlin, Germany, July
18-19, 2013. Proceedings, volume 7967 of Lecture
Notes in Computer Science, pages 150–159. Springer.
Number26 GmbH (2016). N26 - Banking by Design. Acces-
sed: 10 October 2016.
Polkovnichenko, A. and Boxiner, A. (2015). BrainTest –
A New Level of Sophistication in Mobile Malware .
Accessed: 16 September 2016.
Promon AS (2016). Promon SHIELD
TM
- Rock-Solid App
Security! Accessed: 12 October 2016.
Rao, S. P., Kotte, B. T., and Holtmanns, S. (2016). Privacy
in LTE networks. In Yan, Z. and Wang, H., editors,
Proceedings of the 9th EAI International Conference
on Mobile Multimedia Communications, MobiMedia
2016, Xi’an, China, June 18-20, 2016, pages 176–183.
ACM.
Reaves, B., Scaife, N., Tian, D., Blue, L., Traynor, P., and
Butler, K. R. B. (2016). Sending out an SMS: charac-
terizing the security of the SMS ecosystem with public
gateways. In IEEE Symposium on Security and Privacy,
SP 2016, San Jose, CA, USA, May 22-26, 2016, pages
339–356. IEEE Computer Society.
Tanriverdi, H. (2016). Mobiles Banking: Hacker knacken
Photo-Tan-App. Süddeutsche Zeitung, 72(241).
Thomas, D. R., Beresford, A. R., and Rice, A. C. (2015).
Security metrics for the android ecosystem. In Lie,
D. and Wurster, G., editors, Proceedings of the 5th
Annual ACM CCS Workshop on Security and Privacy in
Smartphones and Mobile Devices, SPSM 2015, Denver,
Colorado, USA, October 12, 2015, pages 87–98. ACM.
Zhang, V. (2016). ‘GODLESS’ Mobile Malware Uses Multi-
ple Exploits to Root Devices. Accessed: 11 September
2016.
ICISSP 2018 - 4th International Conference on Information Systems Security and Privacy
160