Banking malware returns to basics to evade detection, Trusteer says

Malware authors add phishing-like credential theft capabilities to banking Trojan programs, researchers from Trusteer say

Financial malware authors are trying to evade new online banking security systems by returning to more traditional phishing-like credential stealing techniques, according to researchers from security firm Trusteer.

Most financial Trojan programs used by cybercriminals today are capable of tampering in real time with online banking sessions initiated by victims on their computers. This includes the ability to execute fraudulent transactions in the background and hide them from the user by modifying the account balance and transaction history display in their browser.

As a result, banks have started deploying systems to monitor how customers interact with their websites and detect anomalies that might indicate malware activity. However, it seems that some malware creators are returning to more traditional techniques that involve stealing credentials and using them from a different computer in order to avoid being detected.

Trusteer researchers have recently detected changes in the Tinba and Tilon financial Trojan programs designed to prevent victims from accessing the real online banking websites and replace their log-in pages with rogue versions.

"When the customer accesses the bank's website, the malware presents a completely fake web page that looks like the bank login page," Trusteer's chief technology officer Amit Klein said Thursday in a blog post. "Once the customer enters their login credentials into the fake page the malware presents an error message claiming that the online banking service is currently unavailable. In the meantime, the malware sends the stolen login credentials to the fraudster who then uses a completely different machine to log into the bank as the customer and executes fraudulent transactions."

If the bank uses multi-factor authentication that requires one-time passwords (OTPs), the malware asks for this information on the fake page as well.

This type of credential theft is similar to traditional phishing attacks, but it is harder to detect because the URL in the browser's address bar is that of the real website and not a fake one.

"It's not as sophisticated as injecting transactions into web banking sessions in real time, but it accomplishes its goal of evading detection," Klein said.

This "full page replacement" feature is present in Tinba version 2, which Trusteer researchers have recently discovered and analyzed. The malware comes with support for Google Chrome and attempts to limit its network traffic by storing images loaded on the fake page locally.

According to the Trusteer researchers, Tinba v2 is already used in attacks targeting major financial institutions and consumer Web services.

"Banks have always faced two attack vectors in the online channel," Klein said. "The first is credentials theft. There are various ways to execute this type of attack including malware, pharming and phishing. The second attack vector is session hijacking which is achieved through malware. These two vectors require two different solutions."

Banks should make sure that they have protection in place against both attack types, otherwise cybercriminals will quickly adapt their techniques, Klein said. "You can't put a lock on your door and leave the window open."

Join the CSO newsletter!

Error: Please check your email address.

Tags Trusteeronline safetysecurityAccess control and authenticationspywareIdentity fraud / theftmalwarefraud

More about GoogleTrusteerTrusteerTrusteer

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place