Slashdot Mirror
Banking Malware, Under the Hood
rye writes "What is your computer actually DOING when you click on a link in a phishing email? Sherri Davidoff of LMG Security released these charts of an infected computer's behavior
after clicking on a link in a Blackhole Exploit Kit phishing email. You can see the malware 'phone home' to the attacker every 20 minutes on the dot, and download updates to evade antivirus. She then went on to capture screenshots and videos of the hacker executing a man-in-the-browser attack against Bank of America's web site. Quoting: 'My favorite part is when the attacker tried to steal my debit card number, expiration date, security code, Social Security Number, date of birth, driver's license number, and mother's maiden name– all at the same time. Nice try, dude!!'"
to click on the attachment in the first place, you've already set the bar for your intelligence (or at least common sense) pretty low, why not try?
He tried to kill me with a forklift!
Looks pretty legit to me. Bankofamerca.com https with a valid cert. The requested data isn't much out of line with what they usually ask for. My wife would fill in all the data without hesitation, and I probably would in duress because I have bills to pay.
So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.
Join the Slashcott! Feb 10 thru Feb 17!
are based on human greed, stupidity, carelessness and/or lack of knowledge. People who use their systems in a hurry tend to make some very sloppy mistakes.
1) when you get an e-mail: check the actual e-mail address. so, what is it actually made of? xxxx@yyyy.com 2) Nothing is free. When you are tempted to browse a website that you've never been before, at the very least, try and use google and see if there are security warnings, trust ratings or something
3) Don't respond to any e-mails saying you won gazillions amounts of dollars, because many of these requests end up as a confirmation that your e-mail is well and valid which is information that can be further used by the hackers
4) Disable images in your e-mail, so that you avoid some spyware
5) When you download a file, scan it for viruses,spyware,malware, I mean, c'mon, use your head. Avoid self-executables and go for ZIP, RAP, 7Zip, etc.. but even then, don't just open the bloody compress file.
6) Don't make easy passwords.. Instead, my favorite is, think of a phrase you often use, for example, can be a phrase like "Wellness petite treats are for my 2 little puppies". OK, this isn't a phrase I use often, but, it's an example. Now, your password could be Wpta4m2lp! Pass this around and freely add whatever I may have missed out.
So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.
It's quite a bit more than that. Perhaps you should RTFA.
This malware (which puts up the appearance of a credit/debit card and asks for all you information) calls a server in the Ukraine. It was delivered by eMail (to a naive user) and intercepts attempts to reach your financial institution via their website. It presents, after login (did they capture the login info?), a panel looking like the credit/debit card, asking for the user to fill in all information, including account number, CVC, address, and other personal information (why anyone would fill in that data is beyond me!)
After much gnashing of teeth, I discovered it was undetectable by any known virus checker I use (AVG, Malwarebytes, Spybot), so I had to dig deeper. It turned out that the malware was using any references to 127.0.0.1 (local machine) for it's hook. All I had to do was edit the HOSTS file and add the domain names of the miscreant with a reference to a different IP address that is known to be a deadend (you could, for example, use 127.7.7.7).
When the malware couldn't execute, it couldn't disable the various malware detectors, and several files were then identified and removed.
The link goes to a "harmless" but obscure address with a blank page which redirects you to another legit address. the 2nd address is for a compromised website that attacks your system.
However for at least a few years attacks from compromised websites could happen at almost any time to anyone. For example there was a Seagate Blog attacking customer computers not too long ago. Porn Blogs appear to be popular sites to use. I got a blackhole hit from a credible Techsite recently.
Allow Java to run on a site you have been to a thousand times? Ooops you're owned.
The main source of compromised sites are Apache/CentOS servers,
The main attacker from compromised Apache/CentOS machines right now are the Blackhole variants that use Java and a lack of AV software to infect Windows boxes with any number of payloads. FBIware and ransomware seem pretty common.
re: banking malware, under the hood ..
"What is your computer actually DOING when you click on a link in a phishing email?"
...
er..nothing.... apart from opening the attachment in the appropriate application. What it doesn't do is execute code. You see, apart from Windows, on the Linux desktop, open doesn't equate to run
AccountKiller