Panda Security goes inside the web’s black market

24. January 2011 · Comments Off on Panda Security goes inside the web’s black market · Categories: blog · Tags: , , , ,

Panda Security Goes Inside Web’s Black Market

PandaLabs released 44 page report called, The Cyber-Crime Black Market: Uncovered. If you are not familiar with the subject, this report is very good. Here are some highlights:

The exponential growth of malware

Five years ago, there were only 92,000 strains of malware cataloged throughout the company’s 15-year history. This figure rose
to 14 million by 2008 and 60 million by 2010, which gives a good indication of the rate of growth.

At this rate is it reasonable to rely on a signature-based approach to malware detection? No mention is made of 0-day malware. We like FireEye‘s behavioral approach to complement a signature-based approach to anti-malware.

The cyber-crime professions

Panda quotes the FBI’s list of ten different professions that make up the cyber-crime black market – Programmers, Distributors, Tech Experts, Hackers, Fraudsters, Hosted systems providers, Cashiers, Money mules, Tellers, and Organization Leaders. This division of labor should give you some idea of the maturity of the cyber-crime underground.

The process

Panda does a fairly good job of documenting the process although this section of the report could have been better organized.

The black market at-a-glance

This section show just how sophisticated the black market ecosystem is. Just like the markets we engage in every day, there are promotion, try & buy offers, discounts for volume purchases, multiple payment options, and post-sale support services.

What to do and what not to do

The report closes with some common sense advice as to what to do and what not to do to minimize your risk of cyber-fraud.

Defending Against the Zeus E-Banking Attacks

15. March 2010 · Comments Off on Defending Against the Zeus E-Banking Attacks · Categories: blog · Tags: , , , ,

Brian Krebs wrote another article about the rising number of E-Banking funds transfer fraud incidents where the Zeus trojan/botnet is used to compromise end point systems. The man-in-the-browser (MITB) exploit is a version of the classic man-in-the-middle (MITM) attack where the user’s bank credentials are stolen without the user realizing it. In fact, the Zeus trojan goes on “to control what the user sees on his or her browser.”

One is left to ask, is there is no “inline” defense against the Zeus trojan? In other words, is there no end point anti-malware product that can successfully defend against morphing trojans/botnets like Zeus?

It appears that the best choices at present are:

  • Use a dedicated PC, preferably one that boots from a CD, to do your online banking
  • Depend on your bank to:
    • Use behavior anomaly detection systems to catch/stop fraudulent transactions
    • Refund fraudulent transactions after the fact

Alternatively from a bank process perspective, why not require a 48 hour waiting period between the time a new payee is created and the time a payment can be made to that new payee?

In addition, the bank could add another step to the “add a payee process” where the bank sends an email or even hard copy notification of the new payee to the user (payer) and the user has to call from a known home phone number to verify the new payee.

Clearly these steps would add a level of inconvenience to online banking, but that has to be weighed against the costs of reimbursing consumer and corporate customer losses. If the lawsuits in progress are adjudicated in favor of the corporations suing their banks, we may very well see these or other changes.

URLZone – Funds Transfer Fraud innovation accelerates

04. October 2009 · Comments Off on URLZone – Funds Transfer Fraud innovation accelerates · Categories: Botnets, Breaches, Funds Transfer Fraud, Innovation, Malware · Tags: , , ,

Web security firm, Finjan, published a report (Issue 2, 2009) this week on a more advanced funds transfer fraud trojan called URLZone. It basically follows the now well understood process I blogged about previously, where:

  1. Cybercriminals infect Web sites using, for example, Cross Site Scripting.
  2. Web site visitors are infected with a trojan, in this case URLZone.
  3. The trojan is used to collect bank credentials.
  4. Cybercrirminals transfer money from the victims to mules.
  5. The money is transferred from the mules to the cybercriminals.

URLZone is a more advanced trojan because of the level of automation of the funds transfer fraud  (direct quotes from the Finjan report):

  • It hides its fraudulent transaction(s) in the report screen of the compromised account.
  • Its C&C [Command and Control] server sends instructions over HTTP about the amount to be stolen and where the stolen money should be deposited.
  • It logs and reports on other web accounts (e.g., Facebook, PayPal, Gmail) and banks from other countries.

In the past, the trojan was merely a keylogger that sent credentials back to the cybercriminal. These exploits were mostly against small businesses and schools where relatively large amounts of money could be stolen. But the URLZone trojan has much more sophisticated command and control which enables a much higher volume of transactions. Finjan reports 6,400 victims in 22 days losing 300,000 Euros. So far all the victims have been in Germany.