Slashdot Mirror
Banking Malware, Under the Hood
rye writes "What is your computer actually DOING when you click on a link in a phishing email? Sherri Davidoff of LMG Security released these charts of an infected computer's behavior
after clicking on a link in a Blackhole Exploit Kit phishing email. You can see the malware 'phone home' to the attacker every 20 minutes on the dot, and download updates to evade antivirus. She then went on to capture screenshots and videos of the hacker executing a man-in-the-browser attack against Bank of America's web site. Quoting: 'My favorite part is when the attacker tried to steal my debit card number, expiration date, security code, Social Security Number, date of birth, driver's license number, and mother's maiden name– all at the same time. Nice try, dude!!'"
to click on the attachment in the first place, you've already set the bar for your intelligence (or at least common sense) pretty low, why not try?
He tried to kill me with a forklift!
BofA actually has VERY good online security.
If setup right, you should be shown a picture you choose to confirm that you are on the legit site. Then in addition to your password, you can setup a system where a six digit numeric token is sent to your cell phone which is also needed to authenticate.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Easy enough to push your username to the real site, scrape the "security image", and then present the legit image to the user.
Once they've faked a legitimate SSL session, you're owned.
This is scary. It should not be possible.
So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.
Join the Slashcott! Feb 10 thru Feb 17!
are based on human greed, stupidity, carelessness and/or lack of knowledge. People who use their systems in a hurry tend to make some very sloppy mistakes.
1) when you get an e-mail: check the actual e-mail address. so, what is it actually made of? xxxx@yyyy.com 2) Nothing is free. When you are tempted to browse a website that you've never been before, at the very least, try and use google and see if there are security warnings, trust ratings or something
3) Don't respond to any e-mails saying you won gazillions amounts of dollars, because many of these requests end up as a confirmation that your e-mail is well and valid which is information that can be further used by the hackers
4) Disable images in your e-mail, so that you avoid some spyware
5) When you download a file, scan it for viruses,spyware,malware, I mean, c'mon, use your head. Avoid self-executables and go for ZIP, RAP, 7Zip, etc.. but even then, don't just open the bloody compress file.
6) Don't make easy passwords.. Instead, my favorite is, think of a phrase you often use, for example, can be a phrase like "Wellness petite treats are for my 2 little puppies". OK, this isn't a phrase I use often, but, it's an example. Now, your password could be Wpta4m2lp! Pass this around and freely add whatever I may have missed out.
From TOS, it says the user has already clicked on the link, and their PC has become infected. My guess that it has installed a rogue root cert into the browser, and rogue DNS entries, so that the link to the attackers server is indeed encrypted, and the browser shows it as safe.
This is why I tell people about live CDs to do their banking with. Even if their computer is 100% pwned, unless it's in the BIOS, a live CD gives them a clean system.
I don't know a lot about blackhole but it wouldn't surprise me if it only infects Windows boxes. But lots of things are getting more universal now with the usual suspects of cross-platform compromise enablers, er, I mean helper applications...
But do you really want to reboot your computer every time you want to do banking? Or have a special computer you only use for banking. I guess the second is a viable option with something like Raspberry Pi. Have a little mini computer that you only use for banking, and access it using a KVM switch from your regular desktop.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Easy enough to push your username to the real site, scrape the "security image", and then present the legit image to the user.
That doesn't work. If the request doesn't come from a previously authenticated browser, they don't show the image. Instead, you have to answer several security questions (father's middle name, favorite pet, etc.) just to see the image.
So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.
It's quite a bit more than that. Perhaps you should RTFA.
And why do you think the request would not be coming from a previously authenticated browser? The malware can work through your regular IE install, to send a page request for https://actualbankwebsite.com/login in a window you don't see. Then show the user an identical looking login page (copied from the real one) in a security-compromised browser window. Now the malware can grab the login credentials, pass them along to the real bank webpage, and initiate a funds transfer to some other (compromised) bank account. Finally, return the user's view to the already-logged-in actual bank page, so they won't even know what hit them. Intercept and delete any confirmation emails about the impending transfer coming from the bank.
So.... I have to give out my personal data to a site that I don't know is legitimate because they won't show me the security image because they don't know that I'm legitimate?? Who's going to blink first?
This malware (which puts up the appearance of a credit/debit card and asks for all you information) calls a server in the Ukraine. It was delivered by eMail (to a naive user) and intercepts attempts to reach your financial institution via their website. It presents, after login (did they capture the login info?), a panel looking like the credit/debit card, asking for the user to fill in all information, including account number, CVC, address, and other personal information (why anyone would fill in that data is beyond me!)
After much gnashing of teeth, I discovered it was undetectable by any known virus checker I use (AVG, Malwarebytes, Spybot), so I had to dig deeper. It turned out that the malware was using any references to 127.0.0.1 (local machine) for it's hook. All I had to do was edit the HOSTS file and add the domain names of the miscreant with a reference to a different IP address that is known to be a deadend (you could, for example, use 127.7.7.7).
When the malware couldn't execute, it couldn't disable the various malware detectors, and several files were then identified and removed.
If setup right, you should be shown a picture you choose to confirm that you are on the legit site.
"SiteKey" only marginally improves security compared to regular TLS/https and notably doesn't help against a MITB attack as described in TFA. If this malware is worth anything, that picture will still be there.
Then in addition to your password, you can setup a system where a six digit numeric token is sent to your cell phone which is also needed to authenticate.
Ooh, two-factor authentication. That's been mandatory in Danish banks for years, but hey, good to see some American banks actually providing security beyond "mother's maiden name"... even if the user has to opt-in.
Simple two-factor authentication still doesn't help against MITB attacks, of course. ("VERY good online security", indeed.)
Who's going to blink first?
Unless you are an idiot, you will. When I log in to my bank, the first thing I see (before I enter my password) is my security image. If instead, it starts asking me for my dad's middle name, that is a pretty big clue that something is wrong. If I am logging in from a different machine or a new browser, then that explains it. But if is my normal browser, I will take a hard look at the URL, and probably decide to close the tab and start a fresh session.
I can't see any way for malware to simulate a "normal" login to Bank of America. It may be possible, but what others are describing would not work without raising a lot of suspicions in any non-stupid person.
Did you bother to read the article and check the examples?
I will take a hard look at the URL, and probably decide to close the tab and start a fresh session.
The example image shows a browser with "https://www.bankofamerica.com/..." in the address bar. Feel free to close the browser and start a new session compromised by the malware exactly the same as before. Feel safer now? The thing that made this particular attempt "obvious" to a non-stupid person was only the extreme level of over-reach in greedily asking for all that identifying info at once; scale back a little to replicate normal bank log-on credentials, and what's left for you to tell the difference? I often get a re-verification page for "changing" a browser from several bank-type sites after routine upgrades; it's not an alarmingly rare event. If your own computer is seriously compromised, then there's very little you can do to assure proper secure communications through it.
I have a VM that I only use for banking. Easy enough, and safe.
Socialism: a lie told by totalitarians and believed by fools.
I can't see any way for malware to simulate a "normal" login to Bank of America. It may be possible, but what others are describing would not work without raising a lot of suspicions in any non-stupid person.
Google Man-in-the-middle attack. The malware in this case resides in your computer between your browser and BoA. When your browser sends a request, malware intercepts it and passes it on. BoA sees an exactly normal request and sends requested data to malware, which then sends it to your browser. If BoA asks for a cookie, malware asks your browser for the cookie and sends it on to BoA. The malware is completely indistinguishable from you to BoA, and indistinguishable from BOA to you. It's impersonating you to BoA and impersonating BoA to you.
At least until malware decides to inject a little extra information into the server's response. Then you get to see your perfectly normal BoA login, complete with personalized security image and description, but with an extra line that asks for your mother's maiden name. Or, after successfully entering your password, you get a completely malware-generated page asking for personal validation data that may or may not ever be sent on to BoA. If the malware is on you machine, it can spoof any web site and perform an undetectable MITM.
re: banking malware, under the hood ..
"What is your computer actually DOING when you click on a link in a phishing email?"
...
er..nothing.... apart from opening the attachment in the appropriate application. What it doesn't do is execute code. You see, apart from Windows, on the Linux desktop, open doesn't equate to run
AccountKiller
Easy enough to push your username to the real site, scrape the "security image", and then present the legit image to the user.
Once they've faked a legitimate SSL session, you're owned.
This is scary. It should not be possible.
Yes, but the six digit code (2nd factor of authentication) is not so easy to fake.
The fact that legit looking websites are so incredibly easy to fake is what has forced banks to introduce a 2nd factor of authentication (be it a code sent via SMS or on a token).
This is also why (in)security questions need to die and die fast. "What's your first pets name" Hmmmm, I'll just get that off facebook.
Calling someone a "hater" only means you can not rationally rebut their argument.
I have to give out my personal data to a site that I don't know is legitimate
No, you don't. This is what KeePassX is for. You select random answers to the questions.
What city were you born in?
Fred Flinstone
Who is John Galt?
To expand on what the other posters said. A VM is still vulnerable to a keylogger on the host machine. So any passwords or bank codes you type into the VM can be read by the host OS. The host can most likely intercept the network traffic as well. It can also get information off the "screen" and read the virtual hard disk, unless the virtual hard disk is encrypted, but it can read the password you type in anyway when booting the VM.This is why many recommend booting off a live CD. It's the only way you can be relatively sure the OS itself isn't compromised.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
VMs give strong isolation as long as you never do anything on the host (and I don't). There has never been a "VM escape" in the wild (the dev teams are pretty serious about keeping it that way on all of the VM platforms). If you have a VM that you only use for banking, that's pretty darn safe, though you can revert to snapshot on logout (VMware has a setting for this) or just boot from an ISO every time, if you want to be absolute about it.
Every OS has privilege escalation exploits - only the known ones are fixed.
Socialism: a lie told by totalitarians and believed by fools.
Arrogance leads to getting rooted. You never know what the 'high dollar" exploits are until it's too late, because their value lies in not having made the news yet.
Socialism: a lie told by totalitarians and believed by fools.
I never do anything on the host. I didn't realize I needed to spell that out for this audience.
It's also worth noting that while the vulnerability you describe is real, no exploit exists in the wild yet - like the SCADA malware, it would be quite involved to write. While military malware will make that kind of thing more common in years to come, you still can't make a MITB attack work that way.
Socialism: a lie told by totalitarians and believed by fools.