Money Online: Threats And Electronic Payment Protection

Online shopping, online money transfers and online banking save us a lot of time and make our lives easier. However, these same technologies also make life easier for cybercriminals by offering them new and easy ways to steal users’ money. Using stolen payment data is an effective and popular way of making a quick profit. Although banks try to protect their customers, attacks against individual users are still quite common. Hacking a bank is more time-consuming and expensive and the risk of being caught is higher. By contrast, many individual customers use computers with numerous vulnerabilities, which are easier to compromise. By stealing a relatively small amount from each hijacked online banking account, a cybercriminal has a good chance of going undetected. Significantly, attacks against individual customers are largely automated and require almost no operator involvement.

Weapons of mass infection

Banking Trojans have been popular in the criminal market for several years. The huge number of potential victims who do not keep applications on their computers up-to-date gives enormous opportunities to cybercriminals. A Trojan infects a workstation and independently collects payment information; some are even capable of conducting financial transactions on behalf of users.
For example, the ZeuS banking Trojan injects its own data entry form into a web page, which enables it to get the user’s payment details (card number, CVC2/CVV2, full name, billing address etc.).
After injecting its code into the browser, Carberp, a malicious program that is widespread in Russian cyberspace, saves the bank card data (card number) from the online banking system’s main page and then prompts the user for additional information (CVV2, personal data etc.).

Hacking a bank is more time-consuming and expensive and the risk of being caught is higher. By contrast, many individual customers use computers with numerous vulnerabilities, which are easier to compromise.

In addition to web injection, Trojans use other techniques to obtain payment information. For example, the latest variants of the Carberp malware mentioned above can modify the code of iBank 2, a popular online banking system, on-the-fly, which enables them to intercept payment details.

Getting over the second hurdle

Some banks try to make cybercriminals’ lives harder by introducing sophisticated variants of extra authentication factors, such as tokens – small USB devices which contain a unique user key that is requested every time a payment transaction is performed. Developers of the Lurk Trojan have found an ingenious method of bypassing this protection and authorizing payment transactions:

1. A user initiates a payment transaction in the online banking system and enters the relevant details.
2. The Trojan intercepts the payment details and waits for the system’s prompt for a token.
3. The online banking system prompts the user to provide a token. The user does this by plugging a USB token into an appropriate hardware port.
4. The Trojan intercepts this and brings up a “blue screen of death,” which tells the user that a memory dump is being created for subsequent analysis, asking the user not to turn off the workstation until the operation is completed.
5. While the user is waiting for the operation to be completed (with the token still in the USB port), the cybercriminals, who now have access to the user’s account, complete their payment transaction, transferring the user’s money to their account.

Financial transaction security system

After a piece of banking malware makes its way onto a computer, it needs to find a way to intercept payment data. Trojans most commonly use the following techniques to achieve this:

• Web injection (modifying the contents of web pages before displaying them to the user)
• Hijacking an HTTP/HTTPS session (a classical example of the ‘man-in-the-middle’ attack)
• Spoofing an authentication form or redirecting to a targeted phishing page
• Making screenshots of the desktop
• Logging keystrokes

Understanding this list of threats makes it possible to create a secure payment scenario:

1. A user opens an online banking resource in the browser.
2. The antivirus solution detects this and scans the operating system for critical vulnerabilities. An example is the Safe Money solution, which is designed to protect payment data and which fully implements this concept using a knowledge base incorporated into the antivirus product.
3. Simultaneously, the anti-phishing module checks the URL against a database of trusted resources. The integrated software solution, which protects payment information, does this by requesting domain name information from a knowledge base.
4. The antivirus solution checks the certificate used to establish a secure connection.
5. If the certificate can be found in the database of trusted certificates, the antivirus solution launches the browser process and establishes a secure HTTPS connection with the requested URL. The browser process is monitored by the antivirus software, which protects it from being manipulated by other applications.
6. The user enters payment transaction details (card number, CVV2/CVC2, personal data etc.) using a secure keyboard input, which guarantees that the scan code of each key pressed is safely transferred to the browser.

The Silver bullet

Banks and payment systems actively protect their users. Sophisticated multi-factor authentication, the use of additional devices (tokens, chipTANs, etc.), various warnings of possible fraud – all this is designed to protect the customer’s money. However, cybercriminals keep coming up with new and equally sophisticated ways of stealing payment information and additional transaction authorization codes.
That’s why it is very important to implement 360-degree protection on the client side, securing user’s computer, communication channel and ensuring it connects to the right server. This is exactly the principle used in our Safe Money technology inside Kaspersky Internet Security. It provides a comprehensive solution for protecting against online theft, offering bulletproof protection against any malicious activity of banking malware.

EC3 Arrested two Ukrainian for Selling Access to 21,000 Hacked Servers

The European Cybercrime Centre (EC3) at Europol has supported Spanish National Police in arresting two Ukrainian criminals in Madrid who sold cybercriminals access to a huge number of compromised computer servers for anonymising their Internet activities. They are also suspected of laundering the illicit proceeds of police ransomware.
Operation Ransom II – the second of this kind after one in Málaga (Spain) in February 2013 – was the culmination of an extensive investigation of over a year, corroborating the fact that police ransomware is still a big threat to EU citizens.
On 9 July, Spanish National Police arrested the two criminals and searched their house. One of them was caught red-handed, running virtual machines and chatting with other cybercriminals. Along with numerous electronic devices and digital evidence, around EUR 50,000 in cash and several thousand euros in e-currency were seized during the search.
Their sophisticated money laundering facility was processing around EUR 10,000 daily through various electronic payment systems and virtual currencies.
The 21,000 compromised servers of companies located in 80 countries (1,500 of them in Spain) had a common feature whereby access settings were via a remote desktop (RDP). With this setup, the cybercriminal could access all information contained on the servers, using full administrator privileges for the system, i.e. absolute control.
The criminals ran an online shop where the compromised machines were ‘sold’ to 450 of their cybercriminal ‘customers’ who were able to choose the location (country) of their preferred servers.
This Spanish National Police investigation was supported from the early stages by Europol specialists, who organised and hosted a coordination meeting in April 2013. Europol then facilitated the exchange of criminal intelligence with other EU Member States, delivered analytical reports, and supported the operation on the spot with a mobile office and technical advice.
Europol will receive data on the compromised computers so it can be analysed and distributed to law enforcement authorities, who in turn can notify those server owners affected by the criminals’ activity.
According to Troels Oerting, Head of EC3, the development and sophistication of malware will continue and the threat will remain high. It is important for citizens to understand that they should never pay any ransom.