Attackers use Ramnit malware to target Steam users

New Ramnit variant uses man-in-the-browser techniques to capture Steam log-in credentials, Trusteer researchers said

A new variant of the Ramnit financial malware is using local Web browser injections in order to steal log-in credentials for Steam accounts, according to researchers from security firm Trusteer.

Ramnit is a computer worm first discovered in 2010 that spreads by infecting executable, HTML and Microsoft Office files on the local computer.

The malware can steal browser cookies and FTP (File Transfer Protocol) credentials stored locally, but it also hooks the browser process in order to modify Web forms and inject rogue code into Web pages, a technique known as a man-in-the-browser (MitB) attack.

The MitB functionality is commonly used by financial malware to trick online banking users into exposing their personal and financial information as well as their online banking credentials.

Security researchers from Trusteer, a company that's in the process of being acquired by IBM, recently identified a new Ramnit variant that targets users of Steam, one of the largest digital distribution and online multiplayer platforms for computer games.

The Ramnit attack circumvents the client-side encryption used for the log-in form fields and can defeat attack detection systems that might run on the server, according to Etay Maor, fraud prevention manager at Trusteer.

Cybercriminals have targeted Steam accounts by using key-logging malware and phishing attacks before. However, Ramnit uses more advanced techniques like Web injection to steal log-in credentials when users sign into the Steam Community site from an infected computer.

According to Maor, when a user accesses the Steam Community log-in page and enters his or her username and password, the form is encrypted using the site's public key. To overcome this, Ramnit modifies the form in a way that allows it to capture the password in plain text.

The user isn't able to tell that anything is wrong, because nothing changes on the log-in page.

Unlike HTML injections that alter the screen the user is familiar with, this injection keeps the screen as is, Maor said Monday via email. However, in the background, the encrypted "password" field is replaced with a non-encrypted field.

When the user fills in the form and submits it, the malware intercepts the request, reads the data from the non-encrypted field and deletes the field before sending the request to the Steam Web server. According to Maor, this can hide the attack from security software that scans for unusual form elements in order to detect malware injections.

For example, if a submitted log-in form altered by banking malware contains a credit card number field that shouldn't be there in the first place, it could indicate to the server operator that the user was a victim of a MitB attack. However, in this Steam attack, Ramnit makes sure the server never gets to see the injected field.

The malware could use key logging instead of HTML injections to steal the data, but it would take the malware operator a lot of time to separate the actual credentials from everything else in the key logging file, Maor said. "The file itself is not easy to work with as opposed to forms that give you the data elements in a structured format. It's simply a matter of saving time and effort."

In the past, Ramnit has mainly targeted banks, but Trusteer researchers have already seen it being used to target customers of non-banking institutions, organizations and services, Maor said. "It all depends on what the operator wants to achieve; it is a sophisticated tool that can be used for multiple targets regardless of their orientation."

Join the CSO newsletter!

Error: Please check your email address.

Tags online safetyIBMsecuritygamesonline servicesspywaremalwarefraudTrusteer

More about IBM AustraliaMicrosoftTrusteerTrusteerTrusteer

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts