Slashdot Mirror
Banking Malware, Under the Hood
rye writes "What is your computer actually DOING when you click on a link in a phishing email? Sherri Davidoff of LMG Security released these charts of an infected computer's behavior
after clicking on a link in a Blackhole Exploit Kit phishing email. You can see the malware 'phone home' to the attacker every 20 minutes on the dot, and download updates to evade antivirus. She then went on to capture screenshots and videos of the hacker executing a man-in-the-browser attack against Bank of America's web site. Quoting: 'My favorite part is when the attacker tried to steal my debit card number, expiration date, security code, Social Security Number, date of birth, driver's license number, and mother's maiden name– all at the same time. Nice try, dude!!'"
but, but,... but a Nigerian Prince has $200,000 waiting for me!
BofA actually has VERY good online security.
If setup right, you should be shown a picture you choose to confirm that you are on the legit site. Then in addition to your password, you can setup a system where a six digit numeric token is sent to your cell phone which is also needed to authenticate.
"Have you ever thought about just turning off the TV, sitting down with your kids, and hitting them?"
Probably saw you were running IE 7 and made an assumption about your technical aptitude.
Actually, there are two different populations of phish messages going around now. One of them surprisingly enough is full of misspellings and odd grammar in a tale about a Nigerian prince. If folks click on that, the senders know they have a live one.
But the other phishing schemes are subtle. I think reasonably intelligent folks who skim emails (instead of read them), especially on a tiny smart-phone/blackberry screen, are just liable to click to someplace nasty. After all, ain't no one 100% right 100% of the time.
If you don't buy a lottery ticket, you don't have a chance of winning. That's their 'reasoning.'
Of course, slashdaughters know buying a lottery ticket does not increase your chances of winning. I have personal experience with this winning $20 twice never buying a ticket. (Realtors and and other salesfolk give them out in mailings).
But lotteries are big money-makers. And so apparently, are phishing schemes.
Easy enough to push your username to the real site, scrape the "security image", and then present the legit image to the user.
Once they've faked a legitimate SSL session, you're owned.
This is scary. It should not be possible.
So a link in a malicious email can compromise my Windows box and cause my web browser to navigate to addresses in a local hosts file. Welcome back to 1997.
Join the Slashcott! Feb 10 thru Feb 17!
are based on human greed, stupidity, carelessness and/or lack of knowledge. People who use their systems in a hurry tend to make some very sloppy mistakes.
1) when you get an e-mail: check the actual e-mail address. so, what is it actually made of? xxxx@yyyy.com 2) Nothing is free. When you are tempted to browse a website that you've never been before, at the very least, try and use google and see if there are security warnings, trust ratings or something
3) Don't respond to any e-mails saying you won gazillions amounts of dollars, because many of these requests end up as a confirmation that your e-mail is well and valid which is information that can be further used by the hackers
4) Disable images in your e-mail, so that you avoid some spyware
5) When you download a file, scan it for viruses,spyware,malware, I mean, c'mon, use your head. Avoid self-executables and go for ZIP, RAP, 7Zip, etc.. but even then, don't just open the bloody compress file.
6) Don't make easy passwords.. Instead, my favorite is, think of a phrase you often use, for example, can be a phrase like "Wellness petite treats are for my 2 little puppies". OK, this isn't a phrase I use often, but, it's an example. Now, your password could be Wpta4m2lp! Pass this around and freely add whatever I may have missed out.
Only 200k? My offer was much higher.
21st Century Renaissance Man
From TOS, it says the user has already clicked on the link, and their PC has become infected. My guess that it has installed a rogue root cert into the browser, and rogue DNS entries, so that the link to the attackers server is indeed encrypted, and the browser shows it as safe.
Attachments? Did we travel in time back to 2008?
The malware spreaders generally don't use attachments today. They're scrutinized too heavily by security systems, and the encrypted zip file ones are dropped outright.
They send link filled HTML garbage emails that look exactly like the link filled HTML garbage emails that legitimate companies send out. Clicking on anything sends s your browser to an attack site that will automatically try many many exploits, customized to your platform. Much quicker and much more effective.
This is why I tell people about live CDs to do their banking with. Even if their computer is 100% pwned, unless it's in the BIOS, a live CD gives them a clean system.
I don't know a lot about blackhole but it wouldn't surprise me if it only infects Windows boxes. But lots of things are getting more universal now with the usual suspects of cross-platform compromise enablers, er, I mean helper applications...
One time when one of the lotteries' jackpot got really big, the local news did a "man on the street" interview. One guy said, "I figure my chances of winning are 50-50. Either I win or I don't."
But do you really want to reboot your computer every time you want to do banking? Or have a special computer you only use for banking. I guess the second is a viable option with something like Raspberry Pi. Have a little mini computer that you only use for banking, and access it using a KVM switch from your regular desktop.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Easy enough to push your username to the real site, scrape the "security image", and then present the legit image to the user.
That doesn't work. If the request doesn't come from a previously authenticated browser, they don't show the image. Instead, you have to answer several security questions (father's middle name, favorite pet, etc.) just to see the image.
So.... I have to give out my personal data to a site that I don't know is legitimate because they won't show me the security image because they don't know that I'm legitimate?? Who's going to blink first?
Of course, slashdaughters know buying a lottery ticket does not increase your chances of winning.
With no ticket your chance of winning is 0, with at least one ticket it is non-zero. If you can't understand how having a greater than zero chance is greater than having a zero chance, I'm afraid there's no hope for you at all.
I have personal experience with this winning $20 twice never buying a ticket. (Realtors and and other salesfolk give them out in mailings).
You might not have bankrolled the ticket purchase yourself, but the ticket was still purchased. But since you seem to be intent on semantics, the proper phrase would be "having a ticket" not "purchasing a ticket".
This malware (which puts up the appearance of a credit/debit card and asks for all you information) calls a server in the Ukraine. It was delivered by eMail (to a naive user) and intercepts attempts to reach your financial institution via their website. It presents, after login (did they capture the login info?), a panel looking like the credit/debit card, asking for the user to fill in all information, including account number, CVC, address, and other personal information (why anyone would fill in that data is beyond me!)
After much gnashing of teeth, I discovered it was undetectable by any known virus checker I use (AVG, Malwarebytes, Spybot), so I had to dig deeper. It turned out that the malware was using any references to 127.0.0.1 (local machine) for it's hook. All I had to do was edit the HOSTS file and add the domain names of the miscreant with a reference to a different IP address that is known to be a deadend (you could, for example, use 127.7.7.7).
When the malware couldn't execute, it couldn't disable the various malware detectors, and several files were then identified and removed.
If setup right, you should be shown a picture you choose to confirm that you are on the legit site.
"SiteKey" only marginally improves security compared to regular TLS/https and notably doesn't help against a MITB attack as described in TFA. If this malware is worth anything, that picture will still be there.
Then in addition to your password, you can setup a system where a six digit numeric token is sent to your cell phone which is also needed to authenticate.
Ooh, two-factor authentication. That's been mandatory in Danish banks for years, but hey, good to see some American banks actually providing security beyond "mother's maiden name"... even if the user has to opt-in.
Simple two-factor authentication still doesn't help against MITB attacks, of course. ("VERY good online security", indeed.)
I seem to recall reading about how someone fell for a scam like this once - only the scammer came through with the cash. The guy invested a few hundred bucks and got paid something like ten thousand dollars. Zimbabweian dollars. So he ends up getting repaid $40 or so, but seemed to think it was a great experience.
Please put some pants on before you post again.
Who's going to blink first?
Unless you are an idiot, you will. When I log in to my bank, the first thing I see (before I enter my password) is my security image. If instead, it starts asking me for my dad's middle name, that is a pretty big clue that something is wrong. If I am logging in from a different machine or a new browser, then that explains it. But if is my normal browser, I will take a hard look at the URL, and probably decide to close the tab and start a fresh session.
I can't see any way for malware to simulate a "normal" login to Bank of America. It may be possible, but what others are describing would not work without raising a lot of suspicions in any non-stupid person.
There's a very basic question that needs to be asked by people: why am I getting this email? If you can't figure it out, a siren should go off in your mind as to what this could be.
I do feel bad for anybody that's been caught by this, technical ineptitude is not a valid reason to get your money stolen, especially considering the average age of the victims (it's up there).
Did you bother to read the article and check the examples?
I will take a hard look at the URL, and probably decide to close the tab and start a fresh session.
The example image shows a browser with "https://www.bankofamerica.com/..." in the address bar. Feel free to close the browser and start a new session compromised by the malware exactly the same as before. Feel safer now? The thing that made this particular attempt "obvious" to a non-stupid person was only the extreme level of over-reach in greedily asking for all that identifying info at once; scale back a little to replicate normal bank log-on credentials, and what's left for you to tell the difference? I often get a re-verification page for "changing" a browser from several bank-type sites after routine upgrades; it's not an alarmingly rare event. If your own computer is seriously compromised, then there's very little you can do to assure proper secure communications through it.
With no ticket your chance of winning is 0, with at least one ticket it is non-zero. If you can't understand how having a greater than zero chance is greater than having a zero chance, I'm afraid there's no hope for you at all.
With no ticket, you have spent $0 and have an expected return of $0. Your expected return from the transaction is $0.
If you buy a ticket then you have spent $X on the ticket and have a probability Y of receiving $Z, and a probability of (1-Y) of receiving $0. No matter what happens you have spent $X, but statistically you can expect a return of $(Y * Z), assuming that there are no other players with a chance of picking the same numbers. Your expected return from the transaction is $( (Y*Z) - X ). Unless the lottery is run by complete morons who are desperate to give away money, X will always be greater than (Y*Z), so you can always expect to lose money.
As an example, let's suppose that you are playing a lottery in which you need to correctly guess six different numbers between one and fourty-nine. Your chance of winning the grand prize is [ (49!) / (6! * (49-6)! ) ] or one in 13,983,816. If a ticket costs $2, then any jackpot of less than twenty-eight million dollars means you are paying more than you can expect to make back. The chance of winning the jackpot is overshadowed by the certainty of losing your initial investment, meaning that you are just giving money away.
If you can't see from this that lotteries are a tax on people who aren't good at math, then I'm afraid there's no hope for you at all. It's just one of many ways to pay for a few minutes of entertainment, really no different from paying for cable TV or giving money to a street magician performing "Three Card Monty".
I figure that my odds of finding the wining ticket (which was purchased by someone else) while walking the dog, or having it blow onto my windshield and stick while I drive down the freeway on my way to work are very close to me picking the right numbers if I were to purchase the ticket myself, so i don't bother to buy a ticket, I just wait for the universe to provide the winning one...
Awesome furniture, accessories and cabinetry in Santa Rosa, CA: http://humanity-home.com/
I can't see any way for malware to simulate a "normal" login to Bank of America. It may be possible, but what others are describing would not work without raising a lot of suspicions in any non-stupid person.
Google Man-in-the-middle attack. The malware in this case resides in your computer between your browser and BoA. When your browser sends a request, malware intercepts it and passes it on. BoA sees an exactly normal request and sends requested data to malware, which then sends it to your browser. If BoA asks for a cookie, malware asks your browser for the cookie and sends it on to BoA. The malware is completely indistinguishable from you to BoA, and indistinguishable from BOA to you. It's impersonating you to BoA and impersonating BoA to you.
At least until malware decides to inject a little extra information into the server's response. Then you get to see your perfectly normal BoA login, complete with personalized security image and description, but with an extra line that asks for your mother's maiden name. Or, after successfully entering your password, you get a completely malware-generated page asking for personal validation data that may or may not ever be sent on to BoA. If the malware is on you machine, it can spoof any web site and perform an undetectable MITM.
One guy said, "I figure my chances of winning are 50-50. Either I win or I don't."
You might laugh, but this is the starting point of Laplace's Rule of Succession (an important rule in baysian statistical estimation)... ;^)