Forgot your password?
typodupeerror
Security

Banking Malware, Under the Hood 92

Posted by timothy
from the is-that-a-hemi? dept.
rye writes "What is your computer actually DOING when you click on a link in a phishing email? Sherri Davidoff of LMG Security released these charts of an infected computer's behavior after clicking on a link in a Blackhole Exploit Kit phishing email. You can see the malware 'phone home' to the attacker every 20 minutes on the dot, and download updates to evade antivirus. She then went on to capture screenshots and videos of the hacker executing a man-in-the-browser attack against Bank of America's web site. Quoting: 'My favorite part is when the attacker tried to steal my debit card number, expiration date, security code, Social Security Number, date of birth, driver's license number, and mother's maiden name– all at the same time. Nice try, dude!!'"
This discussion has been archived. No new comments can be posted.

Banking Malware, Under the Hood

Comments Filter:
  • to click on the attachment in the first place, you've already set the bar for your intelligence (or at least common sense) pretty low, why not try?

    • Re: (Score:3, Funny)

      by Anonymous Coward

      but, but,... but a Nigerian Prince has $200,000 waiting for me!

      • If you don't buy a lottery ticket, you don't have a chance of winning. That's their 'reasoning.'
        Of course, slashdaughters know buying a lottery ticket does not increase your chances of winning. I have personal experience with this winning $20 twice never buying a ticket. (Realtors and and other salesfolk give them out in mailings).
        But lotteries are big money-makers. And so apparently, are phishing schemes.
        • by Anonymous Coward on Tuesday June 04, 2013 @12:05PM (#43905631)

          One time when one of the lotteries' jackpot got really big, the local news did a "man on the street" interview. One guy said, "I figure my chances of winning are 50-50. Either I win or I don't."

          • by slew (2918)

            One guy said, "I figure my chances of winning are 50-50. Either I win or I don't."

            You might laugh, but this is the starting point of Laplace's Rule of Succession (an important rule in baysian statistical estimation)... ;^)

          • by peterhoeg (172874)

            Then buy 2 tickets and double your chances to 100%.

        • Re: (Score:2, Informative)

          by Anonymous Coward

          Of course, slashdaughters know buying a lottery ticket does not increase your chances of winning.

          With no ticket your chance of winning is 0, with at least one ticket it is non-zero. If you can't understand how having a greater than zero chance is greater than having a zero chance, I'm afraid there's no hope for you at all.

          I have personal experience with this winning $20 twice never buying a ticket. (Realtors and and other salesfolk give them out in mailings).

          You might not have bankrolled the ticket purchase yourself, but the ticket was still purchased. But since you seem to be intent on semantics, the proper phrase would be "having a ticket" not "purchasing a ticket".

          • by Minwee (522556) <dcr@neverwhen.org> on Tuesday June 04, 2013 @03:03PM (#43907351) Homepage

            With no ticket your chance of winning is 0, with at least one ticket it is non-zero. If you can't understand how having a greater than zero chance is greater than having a zero chance, I'm afraid there's no hope for you at all.

            With no ticket, you have spent $0 and have an expected return of $0. Your expected return from the transaction is $0.

            If you buy a ticket then you have spent $X on the ticket and have a probability Y of receiving $Z, and a probability of (1-Y) of receiving $0. No matter what happens you have spent $X, but statistically you can expect a return of $(Y * Z), assuming that there are no other players with a chance of picking the same numbers. Your expected return from the transaction is $( (Y*Z) - X ). Unless the lottery is run by complete morons who are desperate to give away money, X will always be greater than (Y*Z), so you can always expect to lose money.

            As an example, let's suppose that you are playing a lottery in which you need to correctly guess six different numbers between one and fourty-nine. Your chance of winning the grand prize is [ (49!) / (6! * (49-6)! ) ] or one in 13,983,816. If a ticket costs $2, then any jackpot of less than twenty-eight million dollars means you are paying more than you can expect to make back. The chance of winning the jackpot is overshadowed by the certainty of losing your initial investment, meaning that you are just giving money away.

            If you can't see from this that lotteries are a tax on people who aren't good at math, then I'm afraid there's no hope for you at all. It's just one of many ways to pay for a few minutes of entertainment, really no different from paying for cable TV or giving money to a street magician performing "Three Card Monty".

            • Re: (Score:2, Insightful)

              How the hell is buying something voluntarily equivalent to a tax? Taxes are mandatory, the lottery is not, period. Donation to the government maybe. This is an extension of the politically correct victim mindset, i.e. lottery = tax on the poor, tax on the bad at math, etc. I think people know full well the actual odds are astronomical, it's just that people tend to believe they're special, or it's destiny, or somehow their prayers will be answered. It's willful ignorance.
              • by Macgrrl (762836)

                I occasionally buy tickets and treat it as an entertainment expense; I don't expect to win, but it's amusing to dream about what I would do with the money if I did for a few days.

                The trick is the fantasizing only works as entertainment if you actually have a chance to win, however small.

                • Oh, I understand that, I even buy them myself sometimes, and like you, I don't have any real expectation of winning. Not all the numbers anyway; I forgot to mention that big lotteries still pay out something if you get *some* of the numbers, and the odds are slightly better there, though still lousy.
                  My main point though was that the lottery is not some kind of "tax", that's a bogus equivalence.
            • It's not terribly uncommon to find a lottery where all or a portion of the jackpot is carried over to the next jackpot if nobody picks the winning numbers. In some cases this can increase the payout sufficiently that the YZ > X. The part about people being bad at math is that very small numbers round off to 0.

              A one-in-a-million chance to win a billion dollars is a great deal if the tickets cost less than $1000--but you're still just throwing money away if you buy a ticket.

          • I figure that my odds of finding the wining ticket (which was purchased by someone else) while walking the dog, or having it blow onto my windshield and stick while I drive down the freeway on my way to work are very close to me picking the right numbers if I were to purchase the ticket myself, so i don't bother to buy a ticket, I just wait for the universe to provide the winning one...

            • by Khashishi (775369)

              if you really believe that, you are worse at probability than those people who buy the tickets.

              • by rthille (8526)

                Not at all. "very close" in the sense of 1/12,000,000 is very close to zero, and so is 1/(2**127**127) [or whatever probability you want to assign to the "universe presenting me with a wining ticket" ]

              • by rthille (8526)

                and the mods were right, I was going for the funny moderation...

      • Only 200k? My offer was much higher.

      • I seem to recall reading about how someone fell for a scam like this once - only the scammer came through with the cash. The guy invested a few hundred bucks and got paid something like ten thousand dollars. Zimbabweian dollars. So he ends up getting repaid $40 or so, but seemed to think it was a great experience.
      • More like forty days of fornication!
    • Re: (Score:2, Funny)

      by Anonymous Coward

      Probably saw you were running IE 7 and made an assumption about your technical aptitude.

    • by minstrelmike (1602771) on Tuesday June 04, 2013 @11:50AM (#43905461)
      Actually, there are two different populations of phish messages going around now. One of them surprisingly enough is full of misspellings and odd grammar in a tale about a Nigerian prince. If folks click on that, the senders know they have a live one.

      But the other phishing schemes are subtle. I think reasonably intelligent folks who skim emails (instead of read them), especially on a tiny smart-phone/blackberry screen, are just liable to click to someplace nasty. After all, ain't no one 100% right 100% of the time.
      • by Synerg1y (2169962) on Tuesday June 04, 2013 @02:43PM (#43907179)

        There's a very basic question that needs to be asked by people: why am I getting this email? If you can't figure it out, a siren should go off in your mind as to what this could be.

        I do feel bad for anybody that's been caught by this, technical ineptitude is not a valid reason to get your money stolen, especially considering the average age of the victims (it's up there).

        • by DarthBart (640519)

          That's why phishers either send out very generic messages (from "The Bank") or messages from the big banks (BoA, Chase, etc). The majority of the recipients will say "I don't have a [BoA|Chase|Citi] account" and discard it. Among those who do have an account, most of them will throw away the message as a phish. All it takes is 1 user to fall for it to make the whole effort worthwhile.

          I get email from my bank all the time, so I wouldn't immediately disregard it as a fish. However, I *never* click on the

          • by Synerg1y (2169962)

            I don't get any emails from my bank, but I do on less important accounts, I tend to click the link also and what lets me sleep at night is the security cert's browser logo that basically states that this is the certificate and here's who it's issued by (I forget the exact lingo).

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      Attachments? Did we travel in time back to 2008?
      The malware spreaders generally don't use attachments today. They're scrutinized too heavily by security systems, and the encrypted zip file ones are dropped outright.

      They send link filled HTML garbage emails that look exactly like the link filled HTML garbage emails that legitimate companies send out. Clicking on anything sends s your browser to an attack site that will automatically try many many exploits, customized to your platform. Much quicker and much m

  • by sl4shd0rk (755837) on Tuesday June 04, 2013 @11:58AM (#43905553)

    So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.

    • by Anonymous Coward

      So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.

      It's quite a bit more than that. Perhaps you should RTFA.

      • The infection vector does not have to come via email. It can just as easily infect via drive-by on a web page.
      • No hosts file involvement is necessary.
      • It injects malware into the system and browser.
      • The malware is self updating, to stay current and evade detection.
      • The malware in the browser inserts itself into your normal online banking activity.
      • It looks 100% legitimate, except for the nature of the "security verification" questions which are too far rea
      • by Anonymous Coward

        So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.

        It's quite a bit more than that. Perhaps you should RTFA.

        • The infection vector does not have to come via email. It can just as easily infect via drive-by on a web page.
        • No hosts file involvement is necessary.
        • It injects malware into the system and browser.
        • The malware is self updating, to stay current and evade detection.
        • The malware in the browser inserts itself into your normal online banking activity.
        • It looks 100% legitimate, except for the nature of the "security verification" questions which are too far reaching to be real.

        And the same drive-by infection has happened large scale in the wild on OS-X (later iterations of Mac Flashback). Modern security threats are not about the Windows only viruses and easily avoidable threats that many geeks grew up with. It is a very advanced multi-billion dollar business.

    • You get an email at work. It's from HR. It says click here to sign up for mandatory training.

      Installs hack. Waits in background for you to go to your banking website.

  • by houbou (1097327) on Tuesday June 04, 2013 @11:59AM (#43905569) Journal
    are based on human greed, stupidity, carelessness and/or lack of knowledge. People who use their systems in a hurry tend to make some very sloppy mistakes.
    1) when you get an e-mail: check the actual e-mail address. so, what is it actually made of? xxxx@yyyy.com 2) Nothing is free. When you are tempted to browse a website that you've never been before, at the very least, try and use google and see if there are security warnings, trust ratings or something
    3) Don't respond to any e-mails saying you won gazillions amounts of dollars, because many of these requests end up as a confirmation that your e-mail is well and valid which is information that can be further used by the hackers
    4) Disable images in your e-mail, so that you avoid some spyware
    5) When you download a file, scan it for viruses,spyware,malware, I mean, c'mon, use your head. Avoid self-executables and go for ZIP, RAP, 7Zip, etc.. but even then, don't just open the bloody compress file.
    6) Don't make easy passwords.. Instead, my favorite is, think of a phrase you often use, for example, can be a phrase like "Wellness petite treats are for my 2 little puppies". OK, this isn't a phrase I use often, but, it's an example. Now, your password could be Wpta4m2lp! Pass this around and freely add whatever I may have missed out.
    • by stewsters (1406737) on Tuesday June 04, 2013 @12:18PM (#43905747)
      Don't use IE6. Don't use IE7. Don't Use IE8. Its 2013. Use Chrome, Firefox, or IE 10+

      Install chrome, chrome://plugins/ , block automatic execution of java and flash. Make it so you need to click. Install an adblocker to reduce driveby downloads. Install noscript + ghostery if you are wearing aluminum foil on your head.

      Auto install security updates. If something disables it most likely you have a virus. Keep everything up to date.
      Don't install toolbars or weather apps from unknown sources.
      • Don't use IE6. Don't use IE7. Don't Use IE8. Its 2013. Use Chrome, Firefox, or IE 10+ Install chrome, chrome://plugins/ , block automatic execution of java and flash. Make it so you need to click. Install an adblocker to reduce driveby downloads. Install noscript + ghostery if you are wearing aluminum foil on your head. Auto install security updates. If something disables it most likely you have a virus. Keep everything up to date. Don't install toolbars or weather apps from unknown sources.

        Right now IE10 actually seems to be the browser that out of the box has the least critical vulnerabilities according to multiple reports, and kudos deserved for that, but what it unfortunately lack are the protection addons that you list - adblocker and noscript (ghostery doesn't really help much in this context). That is a big difference, and I wouldn't surf the net without it. Safe surfing and attachment habits are simply not enough anymore. There was a report recently that most infections are now comin

        • I use Privoxy [privoxy.org] instead of AdBlock. It doesn't matter what browser you use. Also blocks some identifying information about your browser / system being reported to the site your visiting, which is nice.
      • by Anonymous Coward

        The Chrome equivalent to NoScript is a joke. The plugin 'feature' of Chrome is nowhere near as powerful as Firefox, to the extent that Chrome's version of NoScript will load the scripts, then block them - every time. This gives hackers a window of opportunity. Aluminum foil suggests that anyone using NoScript is unnecessarily paranoid, yet if the users discussed in TFA had NoScript installed and browsed the sites in Firefox, then there would have been no way for the exploits to run - fact. Ghostery is for p

      • by tgd (2822)

        Don't use IE6. Don't use IE7. Don't Use IE8. Its 2013. Use Chrome, Firefox, or IE 10+

        Install chrome, chrome://plugins/ , block automatic execution of java and flash. Make it so you need to click. Install an adblocker to reduce driveby downloads. Install noscript + ghostery if you are wearing aluminum foil on your head.

        Auto install security updates. If something disables it most likely you have a virus. Keep everything up to date.

        Don't install toolbars or weather apps from unknown sources.

        And freakin' leave the UAC on. If you turn UAC off, you also disable the running of IE at low integrity mode, and disable the UI isolation that is enabled on there. Then, don't turn off protected mode. If you have an extension that doesn't work -- don't use it. If a website won't function properly in protected mode, don't use the website.

        IE9 and IE10 on Win7/8 do a damn good job of protecting from crap in your browser from doing things in a stealthy way until you're a moron and start turning all of that sec

    • by Anonymous Coward

      regarding easy passwords... http://xkcd.com/936/ [xkcd.com]

    • Re: (Score:3, Informative)

      by BenJury (977929)

      When it comes to passwords, personally I like to made a little 'algorithm' for their construction that involves something about the website I'm visiting and seeded with various other bits n pieces.

      For example, I could always use the first three digits of my old phone number, along with the first three characters of the website and then the capitalised predominant colour of the logo. For example the /. password would be 206slaGreen, but for the BBC it would be 206bbcRed. You could use anything, the number of

    • by sicapo (622621)

      Don't respond to any e-mails saying you won gazillions amounts of dollars, because many of these requests end up as a confirmation that your e-mail is well and valid

      You don't have to reply, just the fact that the email didn't bounce back to the sender means that this is a valid address.

      • by mwehle (2491950)

        You don't have to reply, just the fact that the email didn't bounce back to the sender means that this is a valid address.

        Or it means that the mail administrator has turned off non-delivery notifications.

    • Most of the exploits are based on human greed, stupidity, carelessness and/or lack of knowledge.

      Sure. Most users aren't technical experts and will fall for a carefully constructed illusion.

      But anyone who is using a computer on-line in a non-trivial way can be a victim of an attack. Zero-day exploits get found, and every major browser has been compromised, and every major OS has been compromised, and no amount of security software and hardware can make you completely immune to threats. You can do a lot to reduce the risk, but there's no such thing as perfect security in today's on-line world. The only

    • Actually, if people stopped supporting HTML email, none of this would happen.
      Because links like <a href="http://phonysite.freewebpages.cx/site/bankofamircaphishingsit/login.phpe">bankofamerica.com</a> would be quite obvious in plain text email.

      But people and email client developers insist on such non-standard email that's just a red carpet for phishing and provides no actual use to any legitimate user.

  • by CAOgdin (984672) on Tuesday June 04, 2013 @01:18PM (#43906343)
    This malware (which puts up the appearance of a credit/debit card and asks for all you information) calls a server in the Ukraine. It was delivered by eMail (to a naive user) and intercepts attempts to reach your financial institution via their website. It presents, after login (did they capture the login info?), a panel looking like the credit/debit card, asking for the user to fill in all information, including account number, CVC, address, and other personal information (why anyone would fill in that data is beyond me!)

    After much gnashing of teeth, I discovered it was undetectable by any known virus checker I use (AVG, Malwarebytes, Spybot), so I had to dig deeper. It turned out that the malware was using any references to 127.0.0.1 (local machine) for it's hook. All I had to do was edit the HOSTS file and add the domain names of the miscreant with a reference to a different IP address that is known to be a deadend (you could, for example, use 127.7.7.7).

    When the malware couldn't execute, it couldn't disable the various malware detectors, and several files were then identified and removed.
    • This malware (which puts up the appearance of a credit/debit card and asks for all you information) calls a server in the Ukraine. It was delivered by eMail (to a naive user) and intercepts attempts to reach your financial institution via their website. It presents, after login (did they capture the login info?), a panel looking like the credit/debit card, asking for the user to fill in all information, including account number, CVC, address, and other personal information (why anyone would fill in that data is beyond me!) After much gnashing of teeth, I discovered it was undetectable by any known virus checker I use (AVG, Malwarebytes, Spybot), so I had to dig deeper. It turned out that the malware was using any references to 127.0.0.1 (local machine) for it's hook. All I had to do was edit the HOSTS file and add the domain names of the miscreant with a reference to a different IP address that is known to be a deadend (you could, for example, use 127.7.7.7). When the malware couldn't execute, it couldn't disable the various malware detectors, and several files were then identified and removed.

      Word of caution, "this malware" is a dangerous phrase these days, as the base hidden infection is often capable of downloading completely different payloads on the fly (often as a result of an auction business not unlike Googles - it contacts servers and download highest bidder at the moment). Doing a boot from external media cleaning is highly recommended on an infected system (and periodically regardless) to avoid that the malware blocks the antimalware.

      • by CAOgdin (984672)
        Gee, should I never eat again, because the food might be contaminated?

        I said I fixed one instance. I didn't say I solved the entire malware problem!
        • Gee, should I never eat again, because the food might be contaminated? I said I fixed one instance. I didn't say I solved the entire malware problem!

          Uhm.. late coming back here, but my point was that you manually fixed a symptom on this system that might (!) just be indicative of something more. I would still recommend running a good clean-boot-from-external media-based cleaner just to be sure (not the ones you mentioned, but Kaspersky perhaps, and no, I'm not a Kaspersky sales rep, their rescue disc is free).

  • re: banking malware, under the hood .. "What is your computer actually DOING when you click on a link in a phishing email?"

    er..nothing.... apart from opening the attachment in the appropriate application. What it doesn't do is execute code. You see, apart from Windows, on the Linux desktop, open doesn't equate to run ...

Do not simplify the design of a program if a way can be found to make it complex and wonderful.

Working...