What To Expect After the Target Card Data Breach

If you braved the crowds and went shopping at Target on Black Friday this year, or bought something from the retailer in the weeks since, you need to check your credit card statements. You may be among the 40 million customers affected by what may turn out to be the largest financial breach of 2013.
Unfortunately, beyond being careful and frequently checking your banking and credit card statements for suspicious transactions, there really is not much consumers can do. The vigilance needs to last beyond this month and January, though, as the impact of this theft will be felt for months, if not years, experts warned. There may also be phone and email-based scams on the way taking advantage of the breach.
Did You Get a Deal?Shoppers who took advantage of Target's Black Friday specials and other holiday deals in the physical stores from Nov. 27 to Dec. 15 were affected. Thieves obtained customer names, credit or debit card numbers, card expiration dates, and the three-digit CVV security codes printed on the cards, according to the retailer. Customers who shopped at Target's online store don't appear to have been impacted by the breach.
Security writer Brian Krebs first reported the breach on Wednesday, and Target released a statement on Thursday confirming the theft. Target hasn't provided much information about the breach, beyond stating the problem has been fixed and it is still in the middle of its forensic investigation. Experts said these investigations can take months.
"We can't say for sure that all stores were impacted, but we do see customers all over the U.S. that were victimized," an anti-fraud analyst told Krebs.
Impact on CustomersTarget is asking customers to check their card statements for fraudulent activity and to report all suspicious transactions. Remember, this breach impacts all credit and debit cards that may have been used at the physical stores during this time period, not just Target cards.
Beyond that, there is really not much customers can do to about this breach beyond canceling the card and getting a new one, said Wolfgang Kandek, CTO of Qualys who shopped at Target during the time period and is one of the millions affected. Instead of getting a replacement card, which would be "a hassle," Kandek is keeping an eye on all the transactions hitting his credit card by frequently logging into his credit card account online, he said.
Kandek, like many of the other customers, has to trust the fraud detection algorithms that the credit card companies use, and hope that the companies will honor their promise to reverse any unknown charges. "There is not much a customer can do in such a situation," Kandek said.
Customer Vigilance NeededIf the customers aren't going to cancel their cards, it's critical that they keep monitoring their accounts and keep a close eye on transactions. Thieves may sit on bank details for a while and wait for the customers to stop being so vigilant.
"Not finding any indications of third party activity doesn't necessarily mean you're in the clear," said Lee Weiner, senior vice-president of products and engineering at Rapid7.
The fraudulent transactions may also appear for months, if not years. The thieves may be planning to sell the details instead of using them directly, which means a lot of different buyers will be using these numbers at different times. Criminals can also use the information to create physical credit or debit card clones. These counterfeit cards can be used anywhere cards are accepted until the card's expiration date.
"The potential for widespread online ordering fraud which can be particularly nasty considering we're in the midst of the holiday season," said James Lyne, global head of security research at Sophos.
Just because your card was included in the breach doesn't necessarily mean criminals will exploit your information. The number has to be sold or actually used. In many cases, cyber-criminals look at how much the shoppers spent to know who has the most liquid assets, said Grayson Milbourne, security intelligence director at Webroot. This breach should be a "huge wake-up call for consumers to understand they need to take their personal security more seriously," he said.
Piggyback AttacksCyber-criminals frequently launch "piggyback" attacks after a breach to take advantage of people confused and worried about the security of their information. Attackers can impersonate the card issuing company over the phone or via email and claim there may be a problem because of the Target breach. These scammers can ask users for their banking information or online credentials. Users may be asked to visit a malicious link.
"If you receive any communication around the incident, treat it with caution," warned Weiner. Instead of sharing information on the phone or email, call the card issuing company directly using the number on the back of your card, or go directly to the bank's Website, Weiner recommends.
What's Next?
Monitoring all the financial transactions can be challenging, and you may not be sure if you are missing anything. Placing a freeze on your credit cards and using a monitoring service such as one provided by Lifelock can help keep track of your accounts.
Considering the increase in financial-based malware and attacks, Target's data breach is not isolated. You need to be vigilant and protect your financial details as best as you can.
On the other hand, if you find yourself dealing with a lot of fraudulent transactions appearing on your card because the criminals are using your data, it might be less of a hassle to just cancel that card and start over.

Phone Companies Got Millions For Selling Your Information To Police

Earlier this year, Massachusetts Senator Edward Markey requested that the American telecom providers answer a series of questions about the information they provided to  law enforcement. These included everything from wire taps to controversial "cell-tower dumps." What may surprise you is that the telecoms often charge investigators fees for that information—which amounted to well over $26,594,000 in 2012. But what that number really means is actually far more complicated.
Wait—How Much?
That's a rough estimate, taken from the documents published by Senator Markey. Here's the breakdown for number of information requests and fees collected in 2012:
AT&T: 297,500 requests, and $10,298,000
Verizon: 270,000 requests, and "Less than $5 million"
T-Mobile: 297,350 requests, and $11,000,000
Cricket: 59,000 requests, but did not disclose the money earned
C Spire: 2,350 requests, and "less than $55,000"
US Cellular: "Over 20,588 requests," and $241,000
Sprint declined to reveal the requested information publicly, saying it preferred to discuss the issue face to face. With that in mind, $26,594,000 is a low estimate.
What Kind of Information?
For the most part, this is the kind of data collection we like. We want the cops to catch the bad guys, to tap the bad guy's phone to catch more bad guys, and so on. Though most of the major telecoms are cooperating with the NSA's mass surveillance programs, those seem to fall squarely outside these figures.
But there's a dark side to these figures. For instance, they include the "cell tower dumps," where law enforcement defines a period of time and the telecoms provide a list of every number that connected to that tower in a given period. While certainly smaller than the NSA's programs, it is still massive. Cricket, one of the smallest companies, reported that their cell tower dumps are limited to two hours, but that they observe about 175 calls per hour. Scale that up many times over for Verizon or AT&T.
Geolocation information is also part of the requests processed by the telecoms. AT&T, for instance, said it fielded 77,800 geolocation requests in 2012. Of these, 31,000 were historical and 46,800 were provided in real-time. But at a glance, pen registers (that is, recordings of what numbers were called by a particular line) and associated observations tend to make up the bulk of requests.
Worse yet, as we reported earlier, these cell tower dumps and other observations are sometimes authorized without a warrant. That means that there's no judge or authority beyond the requesting law enforcement agency observing the requests.
Interestingly, Senator Markey inquired if the telecoms were aware of law enforcement agencies utilizing their own tracking equipment, such as "Stingray phone trackers." All but one of the telecoms denied such knowledge, except C Spire. "C Spire is aware that several federal law enforcement agencies and at least one municipal police department have access to their own tracking equipment," the company wrote.
What Does It Mean?
In their responses, each of the telecoms used careful wording to explain that they are authorized to collect fees from law enforcement in order to offset the cost of aiding investigations. Many also point out that they frequently do not charge law enforcement.
Many of the telecoms assert, and they are almost certainly correct, that they do not actually make money from handing over information. "AT&T's charges are intended to recoup at least a portion of our costs incurred in providing these [required] responses, and we believe we fall short of our actual costs," wrote AT&T. "For example, the scope of providing CALEA compliance alone is so broad and touches so many different areas within our company that capturing actual costs is virtually impossible." Ah, our old friend CALEA.
It's possible that the telecoms are releasing this information (sometimes highly detailed information) because they want to play ball with the powers that be. AT&T, Verizon, and their ilk have a lot at stake with a forthcoming spectrum auction and threats to break apart monopolistic phone companies.
It's also possible that the telecoms are perfectly happy to release this information because they don't want to be collecting it in the first place. AT&T says that they employ "100 full time workers" 24 hours a day, seven days a week in order to comply with requests and reject 1,300 requests last year. Cricket employs a third party agency in order to handle all their requests. No doubt these companies prefer not to be burdened with sifting through information requests, and having to determine which are legal and which are improper.
But all that aside, one thing is certain: a lot of data, and a lot of money, is changing hands.

Outbidding the Crooks: One Way to End Exploits

When a burglar throws a brick through a jeweler's window and makes off with the stock, his gains are substantially less than the jeweler's losses. The thief will have to fence the items below their actual value, since they're "hot." The jeweler has not only lost the value of the merchandise, he has to pay for a new window. By the same token, a cyber-crook who steals a million credit card numbers might sell them for a few thousand bucks; notifying a million customers and setting them up with new cards will cost the card issuer vastly more.
This disparity sparked an idea for Stefan Frei, Research Vice President at NSS Labs. Most cyber-attacks crack the victim company's security by exploiting some type of vulnerability in the operating system or other software. What if we could take that tool away from the crooks? In a detailed research paper, Frei and fellow analyst Francisco Artes spell out the bold idea of creating an International Vulnerability Purchase Program (IVPP) that would pay more for vulnerabilities than the crooks can afford.
Running the Numbers
Different pundits offer different estimates of financial losses worldwide due to cybercrime, but they range between tens of billions and hundreds of billions. Frei ran the numbers on vulnerabilities published in 2012 and found that the cost to purchase each for $150,000 would have been vastly lower than the amount of financial damage they caused.
First, let's look at the highest cost and the lowest return. Suppose the IVPP paid $150,000 for every vulnerability regardless of severity or prevalence of the software involved and thereby avoided ten billion in financial losses. The cost of purchase is just under 8 percent of the losses in this worst-case scenario.
However, fully one third of exploited vulnerabilities were found in programs by the top ten vendors. Just paying for those, and accepting an estimate of 100 billion for losses, the cost goes down to 0.3 percent of the lost value. A graduated scale of payment based on severity would also reduce costs. As a comparison, the report notes that retail companies in the US expect to lose 1.5 to 2.0 percent of annual sales to pilferage or "inventory shrinkage."
The report also found that the cost of buying all vulnerabilities in 2012 would have been about 0.005 percent of the U.S. GDP or the European Union's GDP, and under 0.3 percent of total revenue for the software industry.
Security Holes Are Here to Stay
Part of the paper reviews the current situation as regards software vulnerabilities. Simply put, even if it were possible to write flaw-free software, it wouldn't be profitable. The big cost of a data breach falls on the company that was breached, not on the purveyor of the flawed software. In business terms, that cost is a "negative externality" for the software vendor, and "profit-driven businesses do not invest in eliminating negative externalities."
Conceivably users could force the issue by refusing to purchase software from vendors of software containing security holes. In practice, though, vulnerabilities are the norm. We all expect them, and they're not going away. The report notes that "there is no legal liability for the quality of software, and this is unlikely to change anytime soon."
The researcher who discovers a new security hole can quietly submit it to the vendor, announce it publicly, or sell it to the highest bidder. An earlier NSS Labs study reported a thriving resale business for black market exploits. The report notes that things would be a lot worse but for the fact that many security researchers altruistically refrain from selling to black marketers.
Crooks Can't Compete
In a supply-and-demand world, you might think that the crooks would just compete with the good guys, bidding more for brand-new vulnerabilities. The report points out that the same disparity between small gain for the crooks and big loss for the victims means that the crooks simply can't compete. They can't offer more than their maximum anticipated revenue, while an IVPP could pay much more to avoid colossal losses.
In fact, the substantial reward for newly-found security holes would likely lead to more discoveries. A researcher whose only potential reward is a pat on the back, T-Shirt, or a few hundred dollars just isn't as motivated. When grabbing the brass ring gets you $150,000, that's a different story.
Big Plans
The full report offers a detailed proposal for just how an International Vulnerability Purchase Program would work. It covers everything from who would pay, to how reporting would happen, to the full organizational structure, and more.
Will it happen? That remains to be seen. But this very thoroughly thought-out report convinces me that it really could work.

Qadars – a banking Trojan with the Netherlands in its sights

Introduction

A new banking Trojan has been making its round in the past few months. First publicly discussed by LEXSI, this banking Trojan has been very active, infecting users throughout the world. Its modus operandi is banking fraud through web injection. While this approach has been present for a long time in various banking Trojan families, it is still effective. Win32/Qadars uses a wide variety of webinjects, some with Android mobile components, used to bypass online banking security and to gain access to user’s bank account. Usually, banking Trojans either target a broad array of financial institutions or focus on a much smaller subset, usually institutions of which the user base is geographically close. Win32/Qadars fall in the second category: it pinpoints users in specific regions and uses webinject configuration files tailored to the banks most commonly used by the victims.  As we have been monitoring its evolution, we have seen six main countries affected by Win32/Qadars:

• Netherlands
• France
• Canada
• India
• Australia
• Italy

While most of the attacks directed to users in these countries were launched in waves, users in the Netherlands were targeted throughout the monitoring period. This threat caught our attention because:

• It is still very active after six  months and is continuously updated
• It targets very specific regions of the world
• It uses a wide range of webinjects, some of which were also used by another banking Trojan family in a completely unrelated campaign
• It uses Android/Perkele to bypass mobile based two-factor authentication systems

Historical Perspective

The first sign we saw of this malware was in mid-May 2013. The following graph shows the daily detection for Win32/Qadars.

Figure 1 : Win32/Qadars Daily Detections

Although the first detections occurred in May, the first true wave of infections occurred in late June. Interestingly, the authors seem to have been through a testing phase since the next detection spike was seen weeks later with barely any detections in between. Also, Italian users were mainly targeted in the first wave while the subsequent campaign mainly targeted Dutch users. We believe that this kit is either kept private or being sold only to selected people. We have seen a handful of different campaigns, but most of the infections we’ve analyzed are from the same campaign and thus share the same command and control (C&C) servers.

We can track the evolution of the malware through the build number that is embedded in the executable. The first version we saw was 1.0.0.0 and the latest one is 1.0.2.7. The steady release of new versions indicates that this malware is in constant maintenance and development. The following graphs shows the date each version was first seen by our telemetry data.

Figure 2 : Build Number Evolution Throughout the Monitoring Period

Technical Analysis

Win32/Qadars uses a Man-in-the-Browser (MitB) scheme to perform financial fraud. Just like Win32/Spy.Zbot, Win32/Qadars injects itself into browser processes to hook selected APIs. Using these hooks, it is able to inject content into pages viewed by the user. This injected content can be anything, but is usually a form intended to harvest user credentials or JavaScript designed to attempt automatic money transfers without the user’s knowledge or consent. Webinject configuration files are downloaded from the C&C server and contain the URL for the target webpage, the content that should be injected into the webpage and finally where it should be injected. This configuration file format is very similar to all the other banking Trojans out there. Once downloaded, the configuration is kept AES-encrypted in the computer’s registry keys. Currently, Win32/Qadars is able to hook two different browsers so as to perform content injection: Firefox and Internet Explorer. There is some stub for Chrome in the code, so we might see support for this browser in the future.

Once the malware is installed on a machine, the bot herder can control his bots through different commands, most of which are listed in the table below.

Table 1: Commands and Description

One addition that was made in version 1.0.2.7 is an FTP credential stealer. It supports a wide array of FTP clients and tries to open up their configuration files and steal the user’s credentials. Interestingly, in order to steal user credentials, it integrates some known static passwords that some of these FTP clients use by default to encrypt their configuration file. This behavior is not new and has already been seen in Win32/PSW.Fareit (Pony Loader), for example.

Network Communications

Win32/Qadars uses AES in ECB mode to encrypt its network communications. Before sending a message, the client will generate a random string of nine (9) characters and will use its MD5 hash as the AES key to encrypt it. It will also generate another random string which it will embed in the message sent to the server. This key will be used by the server to encrypt its response. To securely transfer the AES key used to encrypt the message to the server, the client will further encrypt it, two characters at a time, and append it to the message. Finally, the overall message is encoded using base64 and sent to the server. The following figure depicts this process and lists the different fields present in the messages sent to the server.

Figure 3 : Client-to-Server Communication

The server response is encrypted using the server key embedded in the client request. It also appends the MD5 digest of the message as an error detection mechanism. The following figure shows the structure of the server response.

Figure 4 : Server-to-Client Communication

Examining the different message IDs used by Win32/Qadars tells us more about its functionalities. The table below lists most of the different message IDs and their description.

Table 2 : Message IDs and Description

Knowing the network protocol used by Win32/Qadars greatly enhanced our ability to track the botnet and study its behavior.

Infection Vector

Win32/Qadars’ webinject configuration file changes frequently and targets specific institutions. To maximize their success with these webinjects, the malware authors try to infect users in specific regions of the world. In the following section, we will show which countries were the most targeted, but let’s first take a look at the infection vectors the malware author chose so as to target specific countries. From May to October, it is not clear how the malware was spreading. Through our telemetry system, we found several hints that they might have bought compromised hosts in the countries they were interested in. We draw this conclusion because all of the compromised computers we analyzed also had Trojan downloaders and other infamous Pay-per-Install (PPI) malware such as Win32/Virut.

Beginning in November, we saw that Win32/Qadars is now also being distributed through the Nuclear Exploit Kit. Below are a couple of URLs that were used to distribute it at the beginning of November. The Nuclear Exploit Kit pattern used at the time is clearly visible:

hxxp://nb7wazsx[.]briefthink[.]biz:34412/f/1383738240/3447064450/5
hxxp://o3xzf[.]checkimagine[.]biz:34412/f/1383770160/1055461891/2
hxxp://pfsb77j2[.]examinevisionary[.]biz:34412/f/1383780180/1659253748/5

Both of these infection vectors allow the bot masters to choose where the computers they compromise are located.

Regional Targets

Win32/Qadars has focused mainly on six countries up until now: the Netherlands, France, Canada, Australia, India and Italy. The following graph shows the geographical distribution of the detection in the period May 2013 to November 2013.

Figure 5 : Detection Distribution

Win32/Qadars clearly seeks to infect Dutch computers as 75% of detections come from this region. Analysis of the times when it was detected show that there were several infection waves.

Figure 6: Win32/Qadars Daily Detections by Countries

Detections in the Netherlands always show the highest prevalence, followed by detections reported in France. The case of Canada is particularly interesting as all of the detections in this country occurred in the last fifteen (15) days of October. Of course, the webinject configuration file downloaded by the bots at this time contains code that targeted the main Canadian financial institutions.

The webinject downloaded by the bots targets financial institutions in the 6 countries mentioned above with varying degree of sophistication. Some webinjects will just collect extra information whenever a user tries to login to his bank’s secure website. This is done through the injection of an extra form or elements asking the user for private information whenever he logs into his bank. An example form is shown below.

Figure 7 : Phishing-like Webinject

Other webinjects are much more complicated and can perform transactions automatically and bypass the two-factor authentication systems implemented by banks.

Webinjects

The webinjects used by banking Trojans can be obtained in several different ways. They can be directly coded by the cybercriminals who operate the botnet, or they can be bought. There are several coders offering to sell public webinjects or to produce them tailored to the customer’s wishes. There are many such offers and some will even ask for a different price depending on the features needed. When analyzing webinjects used by Win32/Qadars, it is clear that they were not all written by the same people as the techniques and coding styles are quite different. In fact, we believe that they were all bought on various underground forums. One webinject platform they use has a distinctive way of fetching external content such as scripts and images. The URL in the injected JavaScript will look something like this:

hxxp://domain.com/gate.php?data=cHJvamVjdD1tb2ItaW5nbmwtZmFuZCZhY3Rpb249ZmlsZSZpZD1jc3M=

The “data=” portion of the URL is base64 encoded. When decoded, this string reads “project=mob-ingnl-fand&action=file&id=css”, which clearly gives away the target as well as which file it is trying to retrieve. Interestingly, we found the exact same kind of syntax in webinjects used by a campaign targeting Czech banks and using Win32/Yebot (alias Tilon) as the banking Trojan. Although we found no trace of this particular webinject platform in the underground forums we looked at, we did find several other offerings.

Automatic Transfer System (ATS)

ATS, now commonly used in banking Trojans, is a term applied to webinjects that aim to initiate an automatic transfer once a user accesses his bank account through a compromised computer. It will usually contain code to automatically find the account with the highest amount and initiate a transfer to an attacker/money mule controlled account. The code will usually contain some tricks (read social engineering) to defeat two-factor authentication systems that are sometimes imposed by banks when performing transfers. We have found several coders in underground forums selling public or private ATS for several banks around the world. In the underground forums, a “public” webinject is one that is sold to anyone by the vendor while a “private” one is customized to the buyer’s need and is usually not resold by the coder. In general, buyers of private webinjects will get the source code and the rights to redistribute it to others. We know that Win32/Qadars authors are buying some webinjects because we found one public ATS that they had integrated into their webinject configuration file. Like many other offerings, this coder sells, along with the webinject, an administrator panel (shown below) to let the cyber criminals control several aspects of how the automatic transfer should be carried out.

Figure 8 : ATS Webinject Administration Panel

This particular offering is targeting a French bank and the coder claims that it can bypass the SMS two-factor authentication system put in place by the bank to prevent fraudulent transfers.

Perkele

In several ATS we have analyzed, like the one described above, the malware must intercept an SMS so to make the transfer go through. This is necessary because the bank sends a transaction authorization number (TAN) to the user’s mobile whenever he initiates a money transfer. The user must input this TAN in his browser before the transfer is authorized. The usage of a mobile component by a banking Trojan is not new. Zeus-in-the-mobile, or ZitMo, and others have been around for quite some time. What is particularly interesting in this case is that several webinject coders are actually bundling such mobile malware with their webinjects. This means that a bot master can now buy very complex webinjects that are not only JavaScript code, but also contain an administration panel and some mobile malware customized to the targeted bank.

In the case of Win32/Qadars, the mobile component we’ve seen bundled with the webinject is Android/Perkele, mobile malware that can intercept SMS messages and forward them to the cybercriminals. This kit has already been profiled by Brian Krebs. The webinject takes care of everything in this case: when the user logs into his bank account, content is injected into his browser asking him to specify his mobile brand and to download a “security” application onto his mobile phone. Since the user sees this content while he is accessing his account, he is more likely to believe that this message is genuine and that the application truly comes from his bank. In one sample we analyzed, once the banking application is installed on the phone, it sends an SMS message to a phone number in the Ukraine.

Figure 9 : Screenshot of Android/Perkele Targeting a French Banking Institution

Android/Perkele supports the Android, Blackberry and Symbian operating systems, but we have seen only the Android component used in conjunction with Win32/Qadars. Once the application is installed on the user’s phone, the automatic transfer can be attempted, since the SMS containing the required TAN can be obtained by the fraudster. This webinject offering is a good example of malware commoditization. The botnet master can now buy a complete solution that will allow him to conduct automatic transfers and bypass two-factor authentication systems in a totally automated fashion. All he needs to provide is a way to inject content into the user’s browser. This functionality is implemented in all modern banking Trojans.

The mobile malware Android/Perkele, once installed on a user mobile, is used by fraudster to intercept SMS messages and hide them from the user. It is interesting to see that Google is taking a proactive stance in order to defeat this kind of threat. The newest Android OS, dubbed KitKat, has changed how the applications on the phone can receive SMS messages and hide them from the user. It will now be much more complicated to hide SMS because there is only one application that will be able to do that, and by default that is the system messaging application. Thus, users infected by threats like Android/Perkele will have a much better chance of spotting the infection if they are running the latest android OS.

Conclusion

We have seen lately a resurgence of new banking Trojans being spread in the wild. Win32/Napolar, Win32/Hesperbot and Win32/Qadars have all appeared in the last few months. It is probably no coincidence that there is now a plethora of banking Trojan source code available following the leaks of Win32/Zbot and Win32/Carberp source code. Another interesting development to watch for is the thriving webinject coder scene. These people are offering ever more sophisticated pieces of code that can bypass a wide range of two-factor authentication systems. It will be interesting to see whether at some point the market matures enough for us to see the emergence of popular webinject kits, in much the same way as happened in the exploit kit scene.

Special thanks to Hugo Magalhães for his contribution to this analysis.

SHA1 hashes

Win32/Qadars (Nuclear Pack):    F31BF806920C97D9CA8418C9893052754DF2EB4D
Win32/Qadars (1.0.2.3):         DAC7065529E59AE6FC366E23C470435B0FA6EBBE
Android/Perkele:            B2C70CA7112D3FD3E0A88D2D38647318E68f836F

The Death of Anti-Virus: conference paper

Death of a Sales Force: Whatever Happened to Anti-Virus? is a paper written by Larry Bridwell and myself for the 16th AVAR conference in Chennai, which was kindly presented by ESET’s Chief Research Officer Juraj Malcho, as neither Larry nor myself were able to attend the conference in the end. The paper is also available from the ESET Threat Center Resources page here.
Here’s the abstract:

Anti-Virus is, it seems, an ex-parrot. We’ve seen so many announcements of the death of anti-virus we’ve taken to carrying black ties around with us, ready for the next one. This paper probably won’t have much impact on the ludicrously funereal tone of some commentary, but will take an informed look at the reasons most often given for the imminent demise of the AV industry and in the hope of achieving a balanced view of the present role and future evolution of malware analysis.  Reports of the (near-) death of static signature detection may not be exaggerated, but anti-malware technology has moved far beyond simple signatures. We consider in depth the accuracy of some of the basic contentions that keep turning up ad infinitum in memoriam…

1. Conclusions based on detection testing and pseudo-testing statistics
2. Anti-virus is ok if you don’t have to pay for it
3. Heuristic detection has gone the way of the static signature
4. Spammed out malware is less important than targeted malware
5. New (mobile) platforms require new defensive paradigms

Catching or blocking malware is just part of the security challenge, at home or in the workplace, and malware detection is a very different technology to what it was 20 years ago, but does that mean it’s obsolescent? We look at the three primary functions of AV:

• protection in the form of proactive detection and blocking through a range of heuristic, reputational and generic countermeasures
• detection of known malware
• remediation where something is detected and has managed to gain a foothold

We contend and demonstrate that while emphasis has undergone an irreversible shift from detection by signature, to remediation of signature-detected malware, to more generic detection by technologies such as heuristics, behaviour analysis, and reputation, a complete solution addresses all those issues. AV is dead, or at best comatose: at any rate, self-replicating malware is a small part of a much larger problem, while signature detection is primarily a fallback technology that helps with remediation rather than a primary layer of protection.

Anti-malware technology moved on long ago. Customer and media perception, though, has lagged way behind. Could it be that when other sectors of the security industry, driven by commercial agendas, engage in inaccurate and at best misinformed anti-AV commentary, that they are also putting their own interests and those of the community at large at risk? Would a world without the mainstream anti-malware industry be such a good place to live?

Target down? “Biggest data breach ever” leaks 40 million credit and debit cards from retailer at height of shopping season

Details of 40 million customer debit and credit cards may have leaked in a data breach at Target – which began on November 27 and ended on December 15.

“Approximately 40 million credit and debit card accounts may have been impacted between Nov. 27 and Dec. 15, 2013,” the retailer said in a statement. The data stolen is reportedly “track data” which can be used to clone cards, according to Brian Krebs.

“Target alerted authorities and financial institutions immediately after it was made aware of the unauthorized access, and is putting all appropriate resources behind these efforts.  Among other actions, Target is partnering with a leading third-party forensics firm to conduct a thorough investigation of the incident.”
The story initially broke via security expert Brian Krebs’ site, Krebs on Security, leaked to him via officials at 10 credit card issuers.
It’s still unclear which stores were affected, and who the attackers are. Krebs quotes one unnamed anti-fraud analyst at a card issuer as saying, “We can’t say for sure that all stores were impacted, but we do see customers all over the U.S. that were victimized.”
According to ABC News, the U.S. secret service is currently investigating, but declined to provide further details. The report said that the attack hit the height of the shopping season, and described it as “one of the largest data breaches of all time”. ABC’s report said that unnamed security experts did not expect the incident to be resolved until “well into the new year.”
The data stolen was “track data”, according to Krebs’ sources. This, Krebs warns, is exactly what cybercriminals need to clone credit cards – but the damage caused by the breach may depend on whether the criminals also have access to PIN numbers.

“The type of data stolen — also known as “track data” — allows crooks to create counterfeit cards by encoding the information onto any card with a magnetic stripe. If the thieves also were able to intercept PIN data for debit transactions, they would theoretically be able to reproduce stolen debit cards and use them to withdraw cash from ATMs,” Krebs said.

ESET Senior Research Fellow David Harley warns that even if the criminals do not have access to this data, the security of Target customers will be impacted.

Harley says, “Even if your PIN or password is well chosen, your security is reduced – not necessarily completely compromised – if  data such as track data are compromised by other means.”

“It’s not clear exactly how the data were stolen in this case, and therefore whether PIN data for debit cards were also stolen. Still, it’s always worth trying to make it harder for a crook to guess PINs: the PINs people actually tend to use are more stereotyped than you might think. See this blog for more details.

The store issued a statement via its website, saying, “Your trust is a top priority for Target, and we deeply regret the inconvenience this may cause. The privacy and protection of our guests’ information is a matter we take very seriously and we have worked swiftly to resolve the incident.”

 ”You should remain vigilant for incidents of fraud and identity theft by regularly reviewing your account statements and monitoring free credit reports.  If you discover any suspicious or unusual activity on your accounts or suspect fraud, be sure to report it immediately to your financial institutions.”

Target breached: 5 defensive steps shoppers should take now

As you may have heard from the copious news coverage (including our own post this morning) Target’s stores in the US were the target of a security breach which has given criminals access to the data from the magnetic strips on customers’ credit and debit cards. This data includes the customer’s name, credit or debit card number, the card’s expiration date and CVV (the three-digit security code).
Indications are that this breach began near the end of November, though some sources say it may have begun as early as mid-November, and it was closed on December 15. If you shopped in a Target store during that period of time, you may be wondering how to identify or mitigate problems caused by this breach. Here are a few steps you can take now:

1. Check your account for suspicious activity

The first, and most important thing you can do is to check the transactions for the credit and debit cards you used at Target stores during this time period. If you see activity that you do not recognize, it is important that you notify the card issuer immediately.
Keep in mind that it is likely the criminals will not have used or sold all of the data they have stolen yet. In order not to flood the market and devalue the data, they are likely to sell it over the course of several months. You will need to be vigilant with these accounts for a while.
Reports are that the site for Target’s REDcard are overwhelmed, and may not be responding, so you may need to be patient and try again periodically.

2.  Ask for a replacement debit/credit Cards

If you would rather not wait for the hammer to drop on criminals potentially selling your stolen data, especially if the card in question is a debit card which pulls funds directly from your bank account, you may wish to ask for a replacement card. Keep in mind that if you have any auto-pay accounts that reference this account number, you will need to update that information. By asking for a replacement card, you will have more outlay of time now, in the hopes of preventing a bigger outlay of time in the future, if your card data does get stolen.

3.  Choose a stronger debit PIN

If the card that was used was a debit card, you may wish to change your PIN. There is no indication at this time that that information was part of what was intercepted in the breach, but many people use weak PINs that are easy to guess. Making this change is a small step that can greatly improve your security.

4. Check your credit report

Criminals could take the data they have stolen and combine it with other data to wreak more havoc. It is a good idea to regularly monitor your credit report, to identify and then report any fraudulent transactions. Target has provided detailed contact information for the three credit reporting agencies. You may also want to look into setting up a fraud alert or a credit freeze if you want additional protection against fraudsters trying to get credit in your name. Be aware that these steps will also mean you have to go through additional verification if you wish get credit, for the duration of the alert or freeze.

5. Change your Target.com password

There is no indication that Target.com was compromised, but this incident is a good reminder to be vigilant about choosing strong passwords and changing them often.

Bonus tip

Beware of scams: Criminals are aware that people will be feeling especially anxious about their security and privacy as a result of this incident. This could lead to other scams. Some folks may, ironically, be more apt to fall for social engineering tactics that prey on this fear of their cards being compromised. Be sure not to click on links in emails purporting to come from businesses using this angle, especially if they appear suspicious in any way. Instead, you should type the expected URLs into your browser directly to contact companies.

Cryptolocker 2.0 – new version, or copycat?

In our previous blog, Filecoder: Holding your data to ransom, we published information about the resurgence of file-encrypting ransomware since July 2013. While the majority of these ransomware families are most widespread in Russia, there are families that are targeting users (especially business users) globally.

Cryptolocker, detected by ESET as Win32/Filecoder.BQ, is one of the most infamous examples and has received widespread public and media attention in the past two months. As shown by the ESET LiveGrid® detection statistics below, the country most affected by this family is the United States.

Last month we discovered another Filecoder family, which caught our attention because it called itself “Cryptolocker 2.0”. Naturally, we wondered if this is a newer version of the widespread ransomware developed by the same gang. In this blog post, we will provide a comparison between this “Cryptolocker 2.0” – detected by ESET products as MSIL/Filecoder.D and MSIL/Filecoder.E – and the “regular” Cryptolocker.

Cryptolocker 2.0 vs. Cryptolocker

Both malware families operate in a similar manner. After infection, they scan the victim’s folder structure for files matching a set of file extensions, encrypt them and display a message window that demands a ransom in order to decrypt the files. Both use RSA public-key cryptography. But there are some implementation differences between the two families.

There are three visible differences between the two families. Cryptolocker uses (as mentioned in the ransom message) RSA-2048, whereas Cryptolocker 2.0 claims to use RSA-4096 (though in reality it uses RSA-1024). Cryptolocker 2.0 displays the deadline by which the private key will supposedly be deleted, but doesn’t show a countdown timer like Cryptolocker. And, interestingly, Cryptolocker 2.0 only accepts the ransom in Bitcoins, whereas different variants of Cryptolocker have also been accepting MoneyPak, Ukash or cashU vouchers.

More implementation differences were revealed after analyzing the malware. The first and most obvious difference is in the programming language used – Cryptolocker was compiled using Visual C++, whereas Cryptolocker 2.0 was written in C#. The files and Registry keys used by the malware are different, and, more interestingly, so is the list of file extensions that the ransomware seeks to encrypt. Cryptolocker appears to be more “business-user-oriented” and doesn’t encrypt image, video and music files, whereas Cryptolocker 2.0 does – its list of targets includes file extensions such as .mp3, .mp4, .jpg, .png, .avi, .mpg, and so on.

When the malware is run, it contacts the C&C server to request a unique RSA public key. Then, each file that meets specific criteria (matching file extension, file path not in exclusion list) is encrypted using a different randomly-generated 3DES key, and this key is then encrypted using the RSA public key received from the server. The encrypted key is then written to an auxiliary file, with the same filename and extension as the encrypted file and an appended second extension “.k”:

%filename%.%fileext%.k

Thus, decryption of the files would only be feasible if the RSA private key was known, which would allow the decryption of the 3DES keys.

The original Cryptolocker works in a similar fashion, with some subtle differences. For example, it uses AES instead of 3DES. Also, the encrypted key is saved to the end of each encrypted file, not in a separate file.

Cryptolocker (Win32/Filecoder.BQ) also contains a domain-generation-algorithm for C&C addresses, whereas the new Cryptolocker 2.0 doesn’t contain such a feature. An overview of the differences between the two malware families is presented in the table below.

In addition to this, the recently-discovered trojan contains some features unrelated to the ransomware functionality. The application includes windows that mimic “activators” or cracks for proprietary software, including Microsoft Windows, Microsoft Office, Team Viewer, Adobe Photoshop or even ESET Smart Security.

The application chooses which window to display depending on the binary’s file name. After launch, it is installed on the system, and subsequently the malware operates in the “ransomware mode” as described above. This technique of masquerading as software cracks serves as an additional spreading mechanism for the trojan. Aside from the legal issues, this demonstrates the increased risks entailed when using pirated software.

Cryptolocker 2.0 is also capable of spreading via removable media by replacing the content of .exe files they contain with its own body.

The list of functionalities present in the trojan code is quite extensive and also includes stealing Bitcoin wallet files, launching the legitimate BFGMiner application or running DDoS attacks against a specified server. However, we were unable to establish whether this functionality was actually being used at present.

Tech chiefs meet Obama to outline PRISM spying concerns

Leaders of some of the world’s biggest tech companies including Twitter, Google and Apple met with president Obama on Tuesday to discuss their concerns about the PRISM spying revelations that have come to light this year.
The meeting was billed by the White House as a chance to discuss numerous tech issues including the flawed Healthcare.gov website, but the tech leaders were only there to discuss surveillance issues, the Guardian quoted one executive as saying.
“That is not going to happen,” they said. “We are there to talk about the NSA.”
The tech leaders issued a joint statement that called on Obama to make sure surveillance oversights are reformed.
"We appreciated the opportunity to share directly with the president our principles on government surveillance that we released last week and we urge him to move aggressively on reform," they said in a widely reported statement.
The White House also issued a statement, acknowledging the importance of ensuring the internet remains a protected sphere.
“This was an opportunity for the president to hear from CEOs directly as we near completion of our review of signals intelligence programs, building on the feedback we’ve received from the private sector in recent weeks and months,” it said.
“The president made clear his belief in an open, free and innovative internet and listened to the group’s concerns and recommendations, and made clear that we will consider their input as well as the input of other outside stakeholders as we finalise our review of signals intelligence programs.”
Yahoo CEO Marissa Mayer, chief operating officer of Facebook Sheryl Sandberg and Dropbox founder and chief Drew Houston were also in attendance.
The tech industry has been outraged since the news of mass survelliance broke earlier in the year and firms have been using their collective might to put pressure on the government to change the way data on citizens is gathered.
Earlier this week a US judge branded spying as Orwellian, and added that the US government had failed to prove that it had directly helped to stop any terrorist attack.

Amazon to trial cloud computing services from Chinese data centres in 2014

Amazon Web Services (AWS) is to begin a preview of a China Region for its cloud computing platform early next year. The move will be important for businesses using AWS who may be looking to expand into the growing Chinese marketplace.
Announcing the limited preview coming in early 2014, Amazon said it is partnering with local Chinese providers, including ChinaNetCenter and Sinnet. These companies will provide the necessary data centre hosting and internet connectivity for the Chinese AWS platform.
While this is Amazon's fourth AWS Region in Asia Pacific and the tenth region globally, the move means customers inside China and international companies looking to target the Chinese market will be able to host some services locally.
With the launch of the new AWS China Region, these customers will be able to run their applications on infrastructure hosted in mainland China. This significantly reduces latency to local end users and enables companies with requirements to store their data in China to easily do so, Amazon said.
Andrew Jassy, Amazon Web Services senior vice president, said customers had been pressing for a local AWS Region in China.
"China represents an important long-term market segment for AWS. We are looking forward to working with Chinese customers, partners and government institutions to help small and large organisations use cloud computing to innovate and deploy faster, save money, expand their geographic reach, and do so without sacrificing security, availability, data durability and reliability," he said.
AWS said it also maintains a local technical support operation in China, as part of the AWS global network of support centres. This is ready to help customers of all sizes with a support channel that is staffed 24x7, all year round with experienced and technical support engineers.
International customers are likely to have some concerns regarding security, especially in the wake of the PRISM scandal. However, AWS has already been stepping up data security in areas such as its CloudHSM platform, which gives customers control over encryption keys used to protect data stored on AWS.

ICO urges data privacy awareness before Christmas app download frenzy

The Information Commissioner’s Office (ICO) has issued a warning to mobile phone and tablet owners to be on their guard against data-stealing app downloads over the festive period. The watchdog has also warned developers to ensure they adhere to data protection legislation.

With millions of devices expected to be activated after being given as gifts, eager owners will then rush to download new apps, with 328 million downloaded on Christmas Day last year, the ICO said.

However, despite this demand for apps, many users are concerned that they don’t know about the data they are giving up when they agree to terms and conditions, usually having not read the contract at all.

A survey by YouGov, commissioned by the ICO, found that 62 percent of people are concerned about this issue and 49 percent said they have not downloaded an app due to privacy concerns.
ICO principal policy advisor for technology Simon Rice said the findings underlined the importance of being aware of what sort of data you are handing over to an app and the company behind it.
“Apps often work by using personal information. This can include information you would not normally choose to give out to a stranger, such as the contact details of friends and relatives, and details of your location,” he noted.
To counter the risks this could pose the ICO has issued four pieces of guidance for device owners to bear in mind this Christmas.

• Only download apps from official and trusted app stores. Be extremely careful of using untrusted sources.
• Read the information available about an app in the app store before you download it. Check you are happy about the personal information it will be using.
• Have a regular clearout. Many of us have downloaded an app and only used it once. If you no longer use the app, uninstall it.
• Consider downloading mobile security software to help keep your device secure.

As well as warning consumers about the issues of privacy, the ICO also gave developers a reminder of their obligations to protect the user data they gather with a detailed document outlining the requirements around data protection.
“The app development industry is one of the UK’s fastest-growing industries, but our survey shows almost half of app users have rejected an app due to privacy concerns. It is important that developers tackle this issue by making sure their apps look after personal information correctly," he said.
“Our guidance will help them achieve this by explaining the legal requirements when using personal information. That includes how to obtain lawful consent, the measures required to keep people’s information secure and advice on carrying out routine testing and maintenance."

NSA saves world from plot to “remotely destroy” PCs, claims NSA director

An international plot which would have turned huge numbers of PCs  into “bricks” by remotely triggeriing deeply buried malware was foiled by the National Security Agency, according to an interview given to CBS by NSA director Keith Alexander.

The scale of the attack could have “taken down the U.S. economy”, an NSA official claimed.

The CBS show 60 Minutes named China as the country behind the alleged attack,which would have arrived “disguised as a request for a software update”, and attacked machines at the BIOS level. BIOS is the simple software which turns computers on, ‘starting up’ hardware such as drives before Windows starts.

The virus would have enabled PCs to be “remotely destroyed,” Alexander claimed in the CBS interview.

Neither Alexander, nor his colleague Information Assurance Director Debora Plunkett specified which nation was behind the attack, nor how many computers would have been affected.

In the hour-long interview, which also dealt with allegations of widespread spying against U.S. citizens, the NSA director made clear that the attack was designed on the mass scale.
“The NSA working with computer manufacturers was able to close this vulnerability”, Ross said, according to The Register’s report.
Debora Plunkett, cyber defense director for the NSA, said, “One of our analysts actually saw that the nation state had the intention to develop and to deliver, to actually use this capability– to destroy computers.
“The attack would have been disguised as a request for a software update. If the user agreed, the virus would’ve infected the computer. . Think about the impact of that across the entire globe. It could literally take down the U.S. economy.”

Attacks which work at this level are rare, and would require what ESET Senior Research Fellow David Harley describes as “an extraordinarily effective delivery mechanism”.

In a recent We Live Security feature on Five Malware that Kept Researchers Up at Night, ESET Security Researcher Lysa Myers ranked the Chernobyl malware number one on her list, saying that it remained in the news “for years”, due to the “pain it caused its victims,” saying, “In some cases the virus would even flash the BIOS, which is to say it rendered the computer completely unusable by overwriting code on a chip attached to the motherboard that enables computers to turn on. This virus hit over a million computers worldwide, and stuck around for many years after the last variant was found.”

“It’s not totally impossible to make a machine effectively (not necessarily permanently) unusable by trashing the BIOS,” says Harley, “But I’ve never heard of this one, unless the NSA have just become aware of 1998’s  Spacefiller/CIH/Chernobyl.”

Harley says that staging such an attack today would also face technical difficulties – beyond those faced by Chernobyl.

“This is essentially what CIH did to vulnerable machines (i.e. PCs using a particular combination of chipset and flash ROM). It changed one byte of the bootstrap routine, which was enough to stop a vulnerable machine from booting.”

But times have changed, Harley says, and crafting such an attack would be difficult these days. “

“Not all machines use the same BIOS,” Harley says. “Even in the days of CIH, some manufacturer’s restricted the initial boot code to a read-only stub, so that the machine could go far enough into the boot process to be reflashed.”

“Some systems had a jumper to write protect the BIOS – that’s pretty standard now, though it’s not necessarily a default. However, where the BIOS is reflashable from software, it does – more often than not – require the customer to disable write-protection. Of course, that does leave the customer vulnerable to social engineering.”

The NSA revealed few details of the BIOS malware’s functions, or how it would be delivered. Harley says that the methods mentioned in the CBS interview were simple social engineering and targeted emails – which may not be “very practical” as a mass attack.

“There is, of course, no guarantee that a new BIOS-trashing program would work exactly or even substantially like CIH,” Harley says. “After all, hardware and malware have moved on. But the sort of nightmare scenario proposed here would also require an extraordinarily effective delivery mechanism. From the transcript of the interview, one of the interviewees was talking about social engineering and targeted emails. But targeted social engineering isn’t very practical when everyone is the target. Clearly, while it’s referred to as a virus, a virus that ‘bricks’ its host has limited value as a delivery mechanism (none, once it has delivered its payload).”

“Unless, of course, the ‘vulnerability’ is in the supply chain, a possibility that isn’t mentioned in the transcript. Surprisingly, given the alleged source of the malware. I’ve no idea how many motherboards are made in China, but I suspect it’s a pretty large number. “

Malicious Firefox add-on turns thousands of PCs into botnet which “hunts” weak websites

A Firefox add-on has turned 12,500 users of the browser into a botnet which scours every page visited by infected users for vulnerabilities. The ‘Advanced Power’ add-on ensnared 12,500 PCs – and found 1,800 vulnerable websites for its unknown creators, according to security expert Brian Krebs.

 SC Magazine says that the add-on also has other capabilities, including password hijacking, but these have not been used.

Based on Google Translate language recognition, Krebs initially reported that text strings in the malware suggested it might be Czech in origin. Human inspection by a native Czech speaker in ESET’s labs revealed that technology was not perfect in this case – and the texts look more like some dialect of Russian.
“The malicious add-on then tests nearly every page the infected user visits for the presence of several different SQL injection vulnerabilities,” according to Krebs.
SQL injection attacks are one of the most common methods used to attack websites, but attackers require vulnerabilities to use them.
“Attackers can use this access to booby-trap sites with drive-by malware attacks, or force sites to cough up information stored in their databases,” Krebs said.
Information Week reports that the malware has been in circulation since May 31 this year at least, and quotes “Kafeine” at the Malware Don’t Need Coffee blog, who said that the malware was distributed at least in part by the Blackhole exploit kit.

Krebs’ report notes that the attack represents a way for hackers to ‘test’ a much larger sample of websites for vulnerabilities rather than simply targeting sites at random – by piggybacking on legitimate site visits, it removes the “blind guesswork” hackers often have to perform to find vulnerable sites.

Mozilla has now blocked the add-on, saying, “It is a malicious extension that is distributed under the same name to trick users into installing it, and turns users into a botnet that conducts SQL injection attacks on visited websites.”

Small businesses are new target for criminals as attacks double, report warns

The assault by cybercriminals against big businesses continued this year – 93% of big companies suffered a data breach in 2012, and 78% were attacked by outsiders, according to a report by Price Waterhouse Cooper. But small businesses – those with less than 50 employees – are rapidly becoming a target, with attacks by outsiders doubling in one year.

Overall, the cost to British business has tripled in the past year, the report said – with large businesses facing attack every few days, and smaller businesses every few weeks.
“Small businesses used not to be a target, but are now also reporting increasing attacks,” the British report warned, saying that breaches suffered by small businesses had increased nearly by half. This year, 63% of small businesses suffered a security breach – last year, that figure was 41%.
The report, commissioned in partnership with the British government’s Department for Business, Innovation and Skills, based on a survey of 1,400 people, found that attacks by outsiders against small businesses had more than doubled – up to 15% from 7% a year ago.

“Outsider attacks also increased substantially, especially against small businesses,” the report said. “ Large organizations still bear the brunt of attacks, with the average company having a serious attack every few days. But, small businesses are rapidly becoming a target too, on average suffering a serious attack once every six weeks.”

The IB Times reported that the sheer number of breaches meant that security spending was rising steadily – to what PWC described as “the highest level ever recorded in this survey.” Companies now spend 10% of their IT budget on security, according to the report.

“Overall, the survey results show that companies are struggling to keep up with security threats, and so find it hard to take the right actions. The right tone from the top is vital – where senior management are briefed frequently on the potential security risks, security defences tend to be stronger.”

ESET Senior Research Fellow David Harley says, “I doubt if there’s any business that hasn’t experienced some sort of breach (which may or may not have been noticed). But some kinds of attack probably work better against small businesses (which don’t usually have dedicated security staff).”

PWC also observed that larger businesses tended to be better at ‘vetting’ third-party companies such as suppliers, saying, “Large organisations are generally more diligent at ensuring third parties have adequate security. For example, they are three times as likely as small businesses to obtain audit rights and twice as likely to carryout penetration testing.”

Many breaches still occur due to staff error – 36% of the year’s worst breaches were due to “human error”, PWC say, and a further 10% due to deliberate misuse of systems.
“There’s a clear payback from investing in staff training. 93% ofcompanies where the security policy was poorly understood had staff-related breaches versus 47% where the policy was well understood,” PWC says.

Biometric ‘Smart ID’ card could offer the ultimate in portable security

A new ‘Smart ID’ card, BluStor, aims to “eliminate hacking and identity theft” – using a combination of voiceprints, fingerprints and iris readings and connecting to mobile devices via Bluetooth, so an app can confirm a user’s ID instantly.

The card stores biometric details for users, and connects to BluStor’s Secure Mobile Briefcase app, which checks fingerprints, iris scans or voiceprints against the ones stored on the card, according to a report by Biometric Update.
“That input is compared with the user’s biometric files stored on the BluStor card. If the offered biometric does not match the stored file, the SMB remains locked,” the company says. The app can be used to lock devices entirely, or to lock folders of sensitive data. It can also be used as an entry system, an ID card, or to store medical files, the company says.
The app works on both Android and iOS, and will be available for testing in Spring 2014. The full version will launch in Fall 2014.
The card connects to nearby devices via Bluetooth 4.0, and stores up to 8GB of data – the U.S. government has already expressed interest in using the cards for storing medical data, BluStor claims, and a Middle Eastern country is interested in using the system for national ID cards.
BluStor also sugggests that the cards could be used for remote employee authentication – allowing home workers to access sensitive data freely. The cards also have room for file storage for email, medical records or work files.

Technology Tell said in its report, “The BluStor Secure Mobile Briefcase idea is pretty genius, and it also has widespread application across quite a number of fields and industries. But most importantly, it provides consumers with a way to secure their mobile devices without the use of a pin or password.”

The high-capacity cards allow the biometric details of a user to be stored in full on the card, and are encrypted with high-grade AES encryption. BluStor claims it is “virtually impossible for a hacker to gain access to a user’s device.”

The card is the brainchild of Finis Conner, a serial entrepreneur who launched Seagate in 1979, and launched the first 5.25-inch drives for Mac computers,  “About two years ago, there was a combination of technologies that had arrived primarily to service the mobile device market, and that was in the form of Bluetooth 4.0 high-performance low-power devices, ultra-thin polymer batteries,” he told Biometric Update. “ I pulled my guys together again and we designed a solution, which is the BluStor platform.”

Biometric ID has become a hot topic this year, after Apple’s adoption of a fingerprint reader on its iPhone 5S, and as cloud services require users to memorise more and more passwords.

Phear of Phishing

(All four blog articles in this series, of which this article is the last, are available as a single paper here: The_Thoughtful_Phisher_Revisited.)
From the sort of ‘visit this link and update or we’ll cancel your account’ message that we saw in the previous blog in this series (The Less Thoughtful Phisher), it’s a short step to trying to frighten you into logging into a malicious URL by telling you there’s already suspicious activity on your account.

Dear Valued Customer,

Your Nationwide Account has been limited due to the unusual login attempt to your online banking.

Resolve Your Nationwide Account

Thanks,
Nationwide Building Society.

Well, fall for this and suspicious activity will certainly happen, though it may take a while before you realize it has taken place.

Yes, it’s me. No, it’s me.

And here’s a short example of a type I’ve been seeing a lot of recently. The potential victim might think that simply confirming or denying that they requested a change is safer than linking to an obvious login link – after all, we keep telling you not to go directly to a link in a message you can’t trust – but the scammer isn’t going to be content with a simple yes or no. At some point in the process you’re going to have to share your login details, and the scammer will have got what he wants. And you may not be surprised to note that – as with most examples of this type of message I’ve seen so far – the ‘yes’ and ‘no’ links are exactly the same. It seems to have starter to occur to them, though, that the social engineering might be a little more convincing if they went to a different page.

Dear Valued Customer,

This is a short email to let you know that your NatWest Credit Card Online Services security details was recently changed on Monday, November 11, 2013 at 9:32:48 AM. Please confirm that this request was made by you.

Yes, I made this request.

No, I did not make this request.

Best wishes

Paul Riley
Head of Credit Card

 What an interesting coincidence that the Head of Credit Cards at MINT has, according to the message of which I generated a screenshot in an earlier blog in this series, exactly the same name as the Head of Credit Card(s) at NatWest. At least, so the number of NatWest phishing messages I’ve seen with that signature would seem to indicate. Unless he’s changed jobs. Or, more likely, some phishing phreak thought that Paul Riley was a name likely to inspire confidence in UK readers. Just as I always feel reassured when I get offers from various dictator’s widows to share millions of dollars. ;)

We don’t know why, but we know exactly when…

Here ‘he’ is again with a more comprehensive message. I love the precision with which they report the date and time of this imaginary breach.

Dear Valued Customer,

An attempt to access your NatWest Credit Card Online Services was denied on: Thursday, 07 November 2013 at 7:03:55 GMT

Access was denied for one of two reasons:

The response to your personal logon details did not match our records

A recent change in your contact information.

If you remember trying to access NatWest Credit Card Online Services on the above date and time, please select “That was me.”

If you do not remember trying to access NatWest Credit Card Online Services on the above date and time, please select “That was NOT me.” You will then be prompted to Confirm your account profile on file with us.

That was me.

That was NOT me.

Best wishes

Paul Riley
Head of Credit Cards

P.S …don’t forget that you can make a payment online using the payments and transfers link once you have logged on.

Please do not reply to this email. It is for notification only as this mailbox cannot accept incoming mail. If you need to contact us then use the Contact Us link at www.natwest.com.

National Westminster Bank plc. Registered in England and Wales (Registered Number 929027)
Registered Office: 135 Bishopsgate, London EC2M 3UR.

Authorised and regulated by the Financial Services Authority.

This email message is confidential and for use by the addressee only. If the message is received by anyone other than the addressee, please return the message to the sender by replying to it and then delete the message from your computer. Internet emails are not necessarily secure. The Royal Bank of Scotland plc does not accept responsibility for changes made to this message after it was sent.

Whilst all reasonable care has been taken to avoid the transmission of viruses, it is the responsibility of the recipient to ensure that the onward transmission, opening or use of this message and any attachments will not adversely affect its systems or data. No responsibility is accepted by The Royal Bank of Scotland plc in this regard and the recipient should carry out such virus and other checks as it considers appropriate.

Talk about adding value. Two possible reasons for the ‘problem’ you have to log on to resolve, an opportunity to make a payment while you’re at it (more money? Bring it on!), and a lengthy disclaimer that looks like it was scraped from a real site or document.

Newly MINTed

And here is Mr Riley, again, apparently moonlighting back with MINT. I wonder if he’s getting paid by both divisions.
And yes, this time the scammers used different links for yes and no. Apart from the change of provider, the value-added disclaimer is almost identical to the previous message (so I haven’t reproduced it).

Dear Valued Customer,

Our records shows that your MINT Credit Card Online Services security details was recently changed on Tuesday, November 05, 2013 at 06:09:42 PM. Please confirm that this request was made by you.

Yes, I made this request.

No, I did not make this request.

Best wishes

Paul Riley
Head of Credit Cards

Implore-sible…

Dear Account Holder,

We noticed a violation of our services on your account and for this
reason, your account will be closed if you fail to resolve the
issue within the next 48 hours.

This will only take a moment, We implore you to resolve the issues
on your account immediately to restore access.

Resolve Here to complete the process.

Sincerely,
Lloyds Bank

I like it. Short and to the point. Log on and give us your money or we’ll close your account. Even though, as usual, we don’t know anything about you or your account… I really like ‘we implore you’: it’s always comforting when a scammer asks nicely.

Doomed!

At Lloyds, we take your security very seriously indeed. In fact
we’ve invested in a host of measures that help protect you
and your money

Recent transactions involving your designated accounts was revoked.

Follow the provided steps to restore your online access and to
review your account status

Online banking Log on

Sincerely,
Lloyds Bank

Eek! Revoked! I’m doomed. (I’ve been seeing a lot of these, but this one is enough to give you the idea…)

Browserbeaten

And one last shot across the browser from ‘Paul Riley’.

Dear Valued Customer

Thank you for choosing NatWest Online Credit Card Services.

At NatWest Credit Card Services we are continually making improvements to protect our customers from fraud, but there are also things you should do to ensure that your details are kept safe when using your card online. We ask that you always have the latest anti-virus software protection on whichever device you use to access NatWest Online Credit Card whether that be your laptop, pc or mobile. We also offer free ‘Rapport’ security software protection that works alongside your anti-virus software to give added online protection.

At NatWest Credit Card Services we have introduced new additional security measures and updated our software to protect our Online Credit Card Account users. The security update will be effective immediately and requires our NatWest Credit Card customers to update their access. Please click on “Continue” below to update yours today.

CONTINUE

Find out more
If you have any questions about using your card online, we’re happy to help. Simply visit our Help 24/7 service.

Yours sincerely,

Paul Riley
Head of Credit Cards

Rapport, of course, is Trusteer’s banking-specific security software, which has been genuinely recommended and made available by various banks to their customers. Nice touch of circumstantial suggestion of good intent, and perhaps an indication of content scraping, but the real intent here is far from benevolent.
And finally…
At least for this series.

Dear Valued NatWest Card Customer

Due to too many errors on your NatWest Credit Card account.
Your access to NatWest Credit Card Online Services has been locked out. Please use the link below to unlock.

Unlock Your NatWest Credit Card Online Services

Please do not reply to this message. For questions, please call Customer Service at the number on the back of your card. We are available 24 hours a day, 7 days a week.

Happily, this has some major logical weaknesses that should alert most people immediately to what they’re looking at here.

1. There is no personalization to prove they’re addressing a known customer
2. There’s an inline link to a very dodgy-looking URL
3. If you were in any doubt about this, you could check it instantly by going to a known genuine URL to log in, where hopefully you would be able to log in without a problem.