Banking malware returns to basics to evade detection, Trusteer says

Malware authors add phishing-like credential theft capabilities to banking Trojan programs, researchers from Trusteer say

Financial malware authors are trying to evade new online banking security systems by returning to more traditional phishing-like credential stealing techniques, according to researchers from security firm Trusteer.

Most financial Trojan programs used by cybercriminals today are capable of tampering in real time with online banking sessions initiated by victims on their computers. This includes the ability to execute fraudulent transactions in the background and hide them from the user by modifying the account balance and transaction history display in their browser.

As a result, banks have started deploying systems to monitor how customers interact with their websites and detect anomalies that might indicate malware activity. However, it seems that some malware creators are returning to more traditional techniques that involve stealing credentials and using them from a different computer in order to avoid being detected.

Trusteer researchers have recently detected changes in the Tinba and Tilon financial Trojan programs designed to prevent victims from accessing the real online banking websites and replace their log-in pages with rogue versions.

"When the customer accesses the bank's website, the malware presents a completely fake web page that looks like the bank login page," Trusteer's chief technology officer Amit Klein said Thursday in a blog post. "Once the customer enters their login credentials into the fake page the malware presents an error message claiming that the online banking service is currently unavailable. In the meantime, the malware sends the stolen login credentials to the fraudster who then uses a completely different machine to log into the bank as the customer and executes fraudulent transactions."

If the bank uses multi-factor authentication that requires one-time passwords (OTPs), the malware asks for this information on the fake page as well.

This type of credential theft is similar to traditional phishing attacks, but it is harder to detect because the URL in the browser's address bar is that of the real website and not a fake one.

"It's not as sophisticated as injecting transactions into web banking sessions in real time, but it accomplishes its goal of evading detection," Klein said.

This "full page replacement" feature is present in Tinba version 2, which Trusteer researchers have recently discovered and analyzed. The malware comes with support for Google Chrome and attempts to limit its network traffic by storing images loaded on the fake page locally.

According to the Trusteer researchers, Tinba v2 is already used in attacks targeting major financial institutions and consumer Web services.

"Banks have always faced two attack vectors in the online channel," Klein said. "The first is credentials theft. There are various ways to execute this type of attack including malware, pharming and phishing. The second attack vector is session hijacking which is achieved through malware. These two vectors require two different solutions."

Banks should make sure that they have protection in place against both attack types, otherwise cybercriminals will quickly adapt their techniques, Klein said. "You can't put a lock on your door and leave the window open."

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags fraudmalwarespywareonline safetyAccess control and authenticationTrusteerIdentity fraud / theft

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?