Sophisticated Trojan loots business bank accounts
 

http://www.computerworld.com/action/...intsrc=hm_list



Sophisticated Trojan loots business bank accounts
German-speaking hacker crew hitting banks in U.S., U.K., Spain and Italy


December 13, 2007 (Computerworld) -- A German hacker crew is looting commercial bank accounts in four countries using a custom-built Trojan put in place by expertly crafted and extremely focused phishing attacks, a security researcher said today.

The malware's most distinguishing feature, said Don Jackson, a senior security researcher with SecureWorks Inc., is its ability to mimic the steps the human account owner would take to move money.

A variant of the Prg Banking malware, the new Trojan has stolen hundreds of thousands from accounts at some of the biggest banks in the U.S., the U.K., Spain and Italy, said Jackson. "This is not widespread, but it is very dangerous. They've already stolen more than $200,000 from the accounts we've monitored, but this has really flown under the radar."

Jackson also said he has found at least four servers that contain Prg configuration files and bogus versions of legitimate banking sites, as well as caches of data harvested by the Trojan.

The cleverness and technical know-how of the attackers was almost breathtaking. "If you were on the bank side of this connection [with the Trojan], it would appear to be a person on the other end running the account," Jackson said. "It would seem as if someone was clicking the keys on the virtual keyboard and sending wire transfers."

According to Jackson, the hackers -- who speaks German, though they may not reside in Germany proper -- mined the vast amount of data collected previously by a less powerful generic version of Prg for evidence of commercial banking accounts, including specific URLs of offshore banks or indications of wire transfers.

The crew targeted commercial accounts, said Jackson, both because those accounts typically contain bigger balances and because they usually have the built-in ability to conduct wire transfers. Once they break into a business account, the hackers can quickly plunder it by using wire transfers to move its monies to hacker-controlled accounts.

With victim accounts picked, the hackers then create what Jackson called "very convincing" phishing e-mails and send them to the account owners, who have been identified using data stolen earlier. "They'll usually have the bank account number, and the first and last name of its owner," said Jackson, as well as security details, such as whether the account is protected by a one-time password. "The e-mail will claim that the user needs to download a new one-time password or soft token, but when the user clicks on the link and reaches the phish site, the Prg Trojan is downloaded instead."

From there, the highly automated account thief takes over. The malware alerts the hacker when the account owner is actually online with his or her bank, "piggybacking" on the session to silently steal the username and password without actually duping the user into entering it. Then using its ability to simulate keystrokes, the Trojan walks through all the steps a human being would take to, for instance, wire funds to another account. An account can be emptied in seconds.

"That's a very clever part of the Trojan," said Jackson. "How it downloads JavaScript from the command-and-control server so it looks like the [account owner] is accessing the account, not a bot." While less-sophisticated malware heads straight to a money transfer page without first appearing to "visit" the pages a real person would view before reaching the transfer page, Prg visits the bank's pages in order, as a person would. Because most anti-fraud looks for automated, non-human behavior, Prg won't trigger a fraud alert.

Each bank site has had customized code written for it, Jackson added, to make updating the Trojan-controlled PCs easier. If the hackers need to change the destination account -- because it's been spotted and frozen by local law enforcement, say -- a new one can be fed to the Trojans from the server.

"Fewer than 20 banks have been hit by this so far," said Jackson, "but they include some of the biggest banks in the U.S., U.K., Spain and Italy.

He came close to praising the criminals. "To me, the automation of this is very very crafty."

The surest defense against the Prg Trojan, Jackson concluded, is to be suspicious of any e-mail received from a bank. "Even if you recognize the sender, you should confirm that the sender sent that message before clicking on any links."

:helpme:helpme:helpme:helpme

Interesting ..

I thought this was interesting until i got to the end
where it says this

That's a very clever part of the Trojan," said Jackson. "How it downloads JavaScript from the command-and-control server so it looks like the [account owner] is accessing the account, not a bot." While less-sophisticated malware heads straight to a money transfer page without first appearing to "visit" the pages a real person would view before reaching the transfer page, Prg visits the bank's pages in order, as a person would. Because most anti-fraud looks for automated, non-human behavior, Prg won't trigger a fraud alert



Actually this is something any spider writer would do, regardless of being sneaky or trying to emulate a person... In fact in todays authenticated world, the programmer almost has to follow these steps, because most httpd-auth systems have been replaced with software / session based handling..

Giving way to much credit for something that is really simply... know what url is there,follow it.. lol

Damn hackers..

Bad people are often the smartest ones

No one here has to worry about that, because they're all broke asses.

word to banks... CAPTCHA lol

this article sounsd fishy to me, or perhaps a conspiracy, the more i think about this, the more I laugh and cry about internal corruption.

For starters, we have LIMITS we put on accounts to protect against transferring out XXXX funds...

Next we have email notifications

Next we have captcha that should be in place on all these parts.

Next we have $10k limits that require a filing which would alert any bank

and a few more I aint thought of yet...... I simply don't believe this, or our financial world is run by blithering idiots.

the whole automation thing is a moot point... once they've got the login details they could just as easily manually move the funds around. it's the login details that are the key.

yes but inside is more captcha or should be, i have to fill in 1-2 captcha's today just to get the phone company out to repair my phone line.... after being logged in my account... so how are these bots bypassing that???? they are not

Damn those meddling kids!

/waves fist

If they are that smart, they should operate a legit business.

Lock 'em up for a while, that will make them see the error of their ways.

People deserve it. I think banks should regularly send out phishing e-mails and every time people click on them, it should take $100 out of their account and give it to a children's charity, while at the same time displaying a message on the screen informing the customer of the loss and the fact that they are a moron. Then, they should not be allowed to access their account again at all for any reason until they have taken a class on how not to be a dumb stupid AOL user while online.

Anymore, I don't click ANY links in e-mails unless I just created and account thats needs confirmed or unless I requested it.

thank god i don't live in those countries

sorry guys, wrote it when I was drunk and in a foul mood, if any of you has any money missing from your bank accounts please send me you bank details and I'll compensate you straight away



email me at:
iissofuckingdumbitaintevenfunnay
at
fbi.org

every time i read something like this, they go into details about how they get in the account etc. And then it says '..the hackers transfer the money to their own account'. And it always stops there. Id like to know what happens next, isnt it as simple as following the money to easily catch the hackers? Because one way or another eventually they have to get the money to their real accounts to actually use the cash, no?

smart fuckers...

:2 cents::1orglaugh

:1orglaugh:1orglaugh:1orglaugh

Yeah, I wonder if they make up this crap, so people are more aware of phishing scams? I guess it sinks in your brain when you hear it like this on how much they got and a little story behind how it was done..

But that's the thing, you can't just waltz in and open up a bank account
without some kind of identification. They make it sound like these people have hundreds of bank accounts. How do they get the money out of accounts? Taking out $50k or plus cash by just saying gimme gimme? LOL

Fishy.. Phoney.. Or Internal Corruption

This is why everybody needs identity theft protection. Buy it from me. :winkwink:

Yeah, they should just post their passwords too.

Anyone who uses any online banking system without a challenge-response
authentication method for every transaction deserves to get robbed.

Yeah, thats next product for America's suckers. Identity Theft insurance. What the fuck is wrong with people? Why not have STD insurance? You get an STD, they pay to fix it. Because we all know that individual responsibility has nothing at all to do with avoiding STDs.

Thats even worse than buying health insurance. You don't absolute control over if you get sick or not, but you *do* have absolute control over if your identity gets stolen. They should make more insurance products like this... so that dumb people who know they are dumb can saddle someone else with the bill. :1orglaugh

Hmm, I dont think you really have a whole lot of control over identity theft. If you blatantly do dumb things like visit sites sent to you in spam messages, or just throw out papers with personal info in the garbage without shredding your asking for it...

but even by having a credit card, your info gets traded around so much by big companies its unreal. Companies (and even the govmnt) lose personal data all the time.. seems to happen pretty frequently.

Yeah, I suppose. Though I don't consider someone lifting a CC number from somewhere and using it to be identity theft. Thats just credit card fraud. To me, identity theft is where someone takes over your name and opens new accounts in your name and stuff like that. Cases of that are far more rare than people like to think. The media likes to whip up identity theft fears and I think they have far too broad of a definition of what constitutes identity theft.

Great questions. I've wondered the same.