February 08, 2013, 7:11 AM —
Image credit: flickr/Loco Steve
Financial malware authors are trying to evade new online banking security systems by returning to more traditional phishing-like credential stealing techniques, according to researchers from security firm Trusteer.
Most financial Trojan programs used by cybercriminals today are capable of tampering in real time with online banking sessions initiated by victims on their computers. This includes the ability to execute fraudulent transactions in the background and hide them from the user by modifying the account balance and transaction history display in their browser.
As a result, banks have started deploying systems to monitor how customers interact with their websites and detect anomalies that might indicate malware activity. However, it seems that some malware creators are returning to more traditional techniques that involve stealing credentials and using them from a different computer in order to avoid being detected.
Trusteer researchers have recently detected changes in the Tinba and Tilon financial Trojan programs designed to prevent victims from accessing the real online banking websites and replace their log-in pages with rogue versions.
"When the customer accesses the bank's website, the malware presents a completely fake web page that looks like the bank login page," Trusteer's chief technology officer Amit Klein said Thursday in a blog post. "Once the customer enters their login credentials into the fake page the malware presents an error message claiming that the online banking service is currently unavailable. In the meantime, the malware sends the stolen login credentials to the fraudster who then uses a completely different machine to log into the bank as the customer and executes fraudulent transactions."
If the bank uses multi-factor authentication that requires one-time passwords (OTPs), the malware asks for this information on the fake page as well.
This type of credential theft is similar to traditional phishing attacks, but it is harder to detect because the URL in the browser's address bar is that of the real website and not a fake one.
"It's not as sophisticated as injecting transactions into web banking sessions in real time, but it accomplishes its goal of evading detection," Klein said.