Banking Trojan steals money from under your nose
Researchers at security firm Finjan have discovered details of a new type of banking Trojan horse that doesn't just steal your bank log-in credentials but actually steals money from your account while you are logged in and displays a fake balance.
The bank Trojan, dubbed URLZone, has features designed to thwart fraud detection systems which are triggered by unusual transactions, Yuval Ben-Itzhak, chief technology officer at Finjan, said in an interview Tuesday. For instance, the software is programmed to calculate on-the-fly how much money to steal from an account based on how much money is available.
It exploits a hole in Firefox, Internet Explorer 6, IE7, IE8, and Opera, and it is different from previously reported banking Trojans, said Ben-Itzhak. The Trojan runs an executable only on Windows systems, he said. The executable can come via a number of avenues, including malicious JavaScript or an Adobe PDF, he added.
The specific Trojan Finjan researchers analyzed targeted customers of unnamed German banks, according to the latest Finjan report. It was linked back to a command-and-control server in Ukraine that was used to send instructions to the Trojan software sitting inside infected PCs. Finjan has notified German law enforcement, Ben-Itzhak said.
"It's a next generation bank Trojan," he said. "This is part of a new trend of more sophisticated Trojans designed to evade antifraud systems."
Finjan researchers were able to trace the communications from the code on an infected machine back to the command-and-control server, which was left unsecured, according to Ben-Itzhak. On that server, they saw the LuckySploit administration console and were able to see exactly what types of rules the Trojan was written to follow and statistics on victims.
About 90,000 computers visited the sites housing the malware and 6,400 of them were infected, a 7.5 percent success rate, he said. Of those whose computers installed the Trojan, a few hundred had money stolen from their bank accounts, he said.
During the span of 22 days in mid-August, the criminals behind the Trojan stole the euro equivalent of nearly $438,000.
The Trojan code includes detailed instructions on how the Trojan should calculate the amount to steal from a victim's bank account.
(Credit: Finjan)Here's how the Trojan works:
Potential victims get their computers infected either by opening an e-mail and clicking on a link to a Web site created to distribute malware or by visiting a site that has been compromised and malware hidden on it.
In this case the malware, a toolkit called LuckySploit, exploits a known security hole in the browser, and installs the Trojan on the computer. When the Trojan notices the computer user visiting the site of a targeted bank it springs into action.
While the computer user goes about his or her business on the site, the Trojan looks at the available balance and figures out how much money to steal. The Trojan is given a minimum and a maximum range that is below the amount that triggers antifraud systems and to leave a certain percentage in the account, Ben-Itzhak said.
After performing the calculation, the Trojan then makes the transaction, communicating with the bank site through the browser without the computer user knowing.
"The Trojan is sending requests to the bank and getting replies that your browser doesn't display," Ben-Itzhak said. "You are looking at your account and you don't see any of it."
A Finjan blog post describes it like this:
URLZone is a Trojan Kit that allows the attacker with the use of the 'URLZone Builder' to create a configuration file. This file contains precise orders to the bot, enabling the attacker to target any bank he wants...The URLZone successfully managed to bypass the German banks' protection using 'One Time Password.' This is a technique used to enable the user to get a new password every time he logs into his account. Its goal is to make the theft of usernames and passwords worthless. In order to be successful, the malware must execute itself on the browser to change the parameters and fool the the user to approve a fraudulent money transaction from his account...So far the malware behavior is similar to many other Trojans. However, URLZone uses the delivered configuration file to manipulate the user.
The Trojan has the money sent to the bank account of a money mule, someone who has an account set up to receive the funds. Money mules are typically people recruited online as "independent contractors" or "financial managers" whose sole purpose is to wire the money placed into their account to someone else, typically out of the country, in exchange for a commission. Because their accounts are used only once or twice, they often do not realize the ruse immediately, Ben-Itzhak said.
Meanwhile, the Trojan hides the theft by erasing it from the report of account activity displayed to the computer user and shows a fake balance--what the amount would be if not for the theft. The victim will not notice something is wrong until a different, uncompromised computer is used to access the account, an ATM is used, or a transaction is denied because of insufficient funds.
The Trojan also keeps a log of the victim's bank account log in credentials, takes screenshots, and snoops on the user's other Web accounts, such as PayPal, Facebook, and Gmail, according to the Finjan report.
This is the first Trojan Finjan has come across that hijacks a victim's browser session, steals the money while the victim is doing online banking, and then covers its tracks by modifying information displayed to the victim, all in real time, Ben-Itzhak said.
People should keep their antivirus, operating system, browser and other software up to date to protect against this type of attack, he said.
Updated 5:30 a.m. PDT to specify that the Trojan targets Firefox, Internet Explorer 6, IE7, IE8, and Opera, that is different from previous Trojans, and that it affects Windows only. Also, more technical details were added, as well as links to the report and blog post from Finjan.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
You think you're protected, and that's why criminals love you.
"Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000"
Bottom line: I wouldn't read too much into the English. The hackers could be from anywhere. The main clue is the use of some German words in the code (and the fact that they target German banks). This makes it most likely that they are European. (Perhaps from Germany, perhaps from Eastern Europe, who knows.)
http://www.symantec.com/security_response/writeup.jsp?docid=2007-121718-1009-99
I have no love for M$ (except my love of hating them), but a trojan is a dangerous thing on any platform.
The problem with software sentinels for both internal and external fraud, that once you know the rules, you can by pass them, whereas with hardware it is much harder to do and with unique hardware solution for each bank, hacking into the system will become much harder - never will it be impossible maybe, but it will bring down the numbers to 5% comparing to today's numbers.
The moment banks will admit the problem and admit they need to change their attitude towards security, then breaking and hacking and commiting fraud will become far more difficult.
Another way is to do banking data transmissions in more noisy data piping that way without knowing these noisy path ways you can get trapped easier for attempting Fraud(Kind of like getting caught in a sea current).
This is just one more of a bucketful of reasons to not use computers for banking or purchases over the net.
Anyone who believes it's safe to do so is either ignorant or stupid.
@Mergatroid
So you didn't order your in foil hat online?
Banking over the web is quite safe if you take the rather simple prudent actions needed to protect yourself. It is certainly a great deal safer than using an ATM or using a credit card at a restaurant... and most people consider those things to be an acceptable risk.
Note the attack had a 7.5% infection rate. That means the vast majority of computers which accessed a compromised website (92.5%) were NOT infected, presumably despite having JavaScript turn on. The machines which were not compromised likely had up-to-date patches.
Of those infected, about half were successfully compromised. This particular attack was very specific to German banks. The worry is new attacks will target banks in other countries.
I won't name the bank..... screw them is wachovia.
"It exploits a hole in Firefox, Internet Explorer 6, IE7, IE8, and Opera,"
With a hippie name like Lavalight, I can tell you use a Mac. PLEASE don't just post things to justify your purchase of a Mac by saying Windows sucks, over and over and over. I have used both Windows and Mac. I have never had a problem with either. Then again, I protect my computer and surf porn using my Linux boot. ;)
http://www.w3schools.com/browsers/browsers_os.asp
@lavalight,
You could be right about the windows only thing but have not seen any mention of that on other sites. A link would be much appreciated. Being javascript based, it could very well be on others OSes also.
See Crimeware gets worse - How to avoid being robbed by your PC
http://blogs.computerworld.com/14806/crimeware_gets_worse_how_to_avoid_being_robbed_by_your_pc
Anyway, this malware seems targeting at Windows based PCs. Based this article, PC users may get infected by email or prompt click. It sounds like that the malware is first as an executable program. When it is activated by clicking, then the Trojan is installed into browser (as javascript based plugin?). For Mac users, it is just impossible to get a piece of binary to run as an installer by email or click. Mac is based on strong UNIX security framework. It is hard to get infected and even harder to spread to other users.
http://news.cnet.com/8301-1009_3-10199652-83.html?tag=mncol;posts
Safari hole exploited in seconds at security conference
Don't worry, I bet I hate winblows more than you.
We can't live with it we can't live without it and it's ran by the brave people who might get caught out.
Why do I say this well if I was printing money and I said I wanted to give money to a few more, many more would be at my door demanding theirs which would collapse potentially the whole Economic system because Supply would not meet demand fast enough. However If I did nothing supply would not meet demand the other way round and that's where fraud comes into play, It's not fair but when policed well It works (by the way $432,000 is a joke).
It's the hole in Marxism He missed the bit about people always wanting more and what that really means not that trying to distribute the economy well is not a good idea and a good part of the economy in itself just that the economy is more dependent on production/supply than capital. for example you could theoretically run a whole economy on other systems than money but nothing no matter what you tried would work without supply.
let's say 6 guys worked on learning from past mistakes/ successes in such trojan writings, for 100 hours a week for 7 weeks, and handed out $12k t0 the mules.
that's $10k a week per guy, or $100 an hour per guy .
"tax free."
or maybe their costs were 15% higher in time/$.
$85 an hour after taxes.
if you're doing that well, do yourself a favor and don't say "rent a coder" anywhere near a client.
:"you could theoretically run a whole economy on other systems than money"
since about 600 bC nobody has been able to have such a game run for more than about a generation.
"capital" is just term for stored energy.
Use windows only on a computer that is not attached to the internet. It is a good operating system for computers that are isolated.
http://www.w3counter.com/globalstats.php (my source for numbers)
- There have been Unix viruses in the past. There hasn't been one in a while and *nix is fairly proof against them, but nothing is "impossible".
- Since OS X is based on a unix derivative (Darwin), it's also quite strong against viruses. Proof - there hasn't been one against it yet. Not. One. Virus. OS X is currently in it's 6th iteration (Snow Leopard, 10.6) and the original version came out nearly a decade ago. It if was so easy to do, it would have been done by now.
- OS 9 had many viruses that affected it and had a fraction of today's OS X market, so the "market share" fertilizer is bunk and won't grow anything but stupidity.
- Most important one of all - THIS IS A TROJAN, NOT A VIRUS. The user got tricked into installing it. Maybe winblows made that easier, but once their foot is in the door the game is over. Any *nix derivative will allow the user to install programs!
The firewall wouldn't stop it because the requests are coming from the browser. If they were blocked, then all your normal banking would be blocked as well. That's what's ingenious about this Trojan, it operates exactly as if you were issuing the commands, but it doesn't show you the results (unless you get them from a separate source like the SMS messages.)
Apparently, it is specific to a bank - all banks have different layout of their website and virus has to navigate website to collect information and imitate website's view it presents to a user.
Sharia law would be a good thing.
If they knew their hand would be chopped off if caught then this type of fraud would go down by over 75% or until they get sneakier.
well, i suppose people could default to the neo-caliphate position of bin laden et al and have a world govt running sharia law.
"or until they get sneakier"...hmm. i'm not seeing any reports of arrests on this one, yet. nor of very many of the past 71 such ...
This is the same stupid logic that equates legalising abortion with increased abortion rates - something that has not happened in a single nation with legalised abortion. Or supporting single teen mothers will encourage more teens to be single mothers - the attitude of most of the US law makers right there, and yet, the US has the highest teen pregnancy rate in the world while countries that support teen mothers have the lowest.
BTW - I work with people from Ukraine, Poland etcetera, some of them have a better understanding of the English language than people who's first language is English.
Get a Mac.
Another happy and joyful comment, as always. I'm glad to see you fill your day with sunshine and happiness, spreading cheer and good will everywhere you go.
Oh, and respect too! I almost forgot that. Your comments are always so very respectful of companies and people. I always enjoy how you thoughtfully construct your well laid out comments which add so very much great value to any and all conversations.
Once again, thank you for brightening everyone's day with your wit and whimsy!
- by opit September 30, 2009 8:00 AM PDT
- That's a wild exploit - that threatens online banking's very existence.
- Like this Reply to this comment
-
Showing 1 of 2 pages (109 Comments)People : the article plainly states IE 6,7,8 plus Firefox and Opera ( ! ) are all at risk.
MD_Willington
Are you trying to prove your point with context ? 'I' might be understood. I have never heard of 'it' being omitted in that fashion. "Who's" is the contraction for "Who is" : not the possessive "Whose".