Trojans demonstrated new tactics that went well beyond the rather simple keylogging-with-screenshots efforts that we had seen in previous years. Most Trojans now use rootkit techniques to hide on a victim’s system and disable anti-virus software or prevent signature updates. Often the victim’s computer becomes part of a botnet and receives malware configuration updates.









Free Myspace Generators



Simple Trojans, such as those predominant in South American countries, lie dormant until the victim opens the bank’s website. They then add fields for the user to fill in, asking for credit card number and ATM PIN, for example, or for a couple of indexed transaction authorization numbers (iTANs). The Trojan usually comes with a configuration file that contains information for hundreds of banks, specifying the additional fields and their layout and mimicking the bank’s design. Although these Trojans, such as Torpig, are still popular today, they are far from state of the art.



More troublesome is the Silentbanker family. These Trojans can silently change the details a user enters to transfer the money to the attacker during a transaction. The user is not aware that anything is amiss until the next account statement arrives. Bebloh, also known as URLZone, takes this deception even further. This Trojan not only changes the transaction details to suit the attacker but it will also check the user’s account and transaction limits and stay just below them to avoid alerting the bank. Bebloh also keeps track of the transactions the user originally made and changes the account statement to display these instead of the real transactions. Of course, the account balance is modified as well.



The latest, and perhaps most worrisome, development comes from the Zeus family. These Trojans are frequently updated with new versions and are sold on underground forums to anyone interested in starting a career in crime. Zeus comes with a command and control server and is extremely flexible in its configuration, allowing easy adjustments to a criminal’s specific needs. Now there is a man-in-the-middle console that allows an attacker to operate in real time. The attack could occur like this: When the victim logs into an online banking account the user sees a maintenance bar that moves slowly until it is full, and then must answer additional security questions, with everything in the bank’s website design.



These steps help buy time for the attacker. The moment the victim logs in, the attacker is notified and initiates a transaction while the victim is waiting. In the next step the victim is asked to register his or her mobile phone number and to confirm this with a specific iTAN. The attacker uses this iTAN, which the bank requests, to complete the illicit transaction. Once the victim enters the iTAN, the attacker completes the transaction and the victim gets to see a message saying the phone registration was successful but that online banking is closed for maintenance.



One variant of Zeus is JabberZeus, which has a complex structure for providing near real-time stolen information to an attacker. This version is most often used to steal one-time passwords, which certain banks require to add another layer of protection for large transactions. With this variant, an attacker uses the Jabber protocol as an instant message system to gather the stolen data. The attacker then selects which information is most (financially) important.



Given the widespread use of the Zeus kit we anticipate many more similar attacks in 2010, and not only against banking sites. This variation allows attackers to circumvent all types of two-factor authentication on websites.