Cybercriminals have developed banking Trojans that can target a very specific region and that are more likely to slip under the scrutiny of most anti-virus systems that are commonly known to protect these banking networks from cyber attacks and various exploits.
According to a study by transaction security firm Trusteer, average detection rates for regional malware vary between zero and 20 percent at best. Trusteer markets browser security add-ons to banks, which offer them to end-consumers as a way of reducing the risk of malware and viruses on PCs resulting in banking fraud.
Overall, Trusteer cites two pieces of regional malware targeted at U.K. banking consumers. Silon.var2 crops up on one in every 500 computers in the U.K. compared to one in 20,000 in the U.S.
Another strain of malware, dubbed Agent-DBJP, was found on one in 5,000 computers in Britain compared to one in 60,000 in the United States and Canada.
Trusteer says that the cybercrooks behind the attacks are using U.K.-centric spam lists and compromised websites to spread the malware, and all without raising any red flags with most security firms. It compares this process to the shift from mass assaults to targeted strikes in corporate espionage-motivated attacks such as Operation Aurora, which struck Google and other high-tech firms in 2009.
"Unlike known malware kits such as Zeus, Torpig and Ambler which simultaneously target hundreds of banks and enterprises around the world and are on the radar of all security vendors, regional financial malware such as Silon.var2 and Agent.DBJP are highly targeted," said Mickey Boodaei, Trusteer's chief exec.
"In the U.K. each malware campaign would usually focus on three to seven banks and target them for a period of six to nine months and then morph and change the list of targets, using a new more advanced version of the malware.”
Overall, the Zeus Trojan is the most common agent of financial fraud on a global basis. The cybercrime toolkit is highly customisable and widely available through underground carder and cybercrime forums. Trusteer has identified two U.K.-specific Zeus botnets, designed to infect only U.K.-based Windows and harvest login credentials of only British banks from these compromised systems.
“Silon, DBJP and other regional financial malware have been identified through Trusteer's Flashlight service and analysis and investigation results have been shared between participating banks,” explained Amit Klein, CTO of Trusteer.
"If a bank in a specific region experiences fraud from a new piece of regional malware there is an 80 percent chance that other banks in the same region will experience the same kind of attack in the near future and incur similar losses from this malware," Klein added.
Regionally-targeted malware has also cropped up in South Africa and Germany over recent months. A strain of malware called Yaludle, almost unseen outside Germany, has been used to successfully target the online banking credentials of German surfers.
Trusteer is urging banks in the U.K. to share information on targeted attacks locally as well as working with regulators and local law enforcement agencies to shut down command and control servers associated with this regionally-targeted malware.
The security company also wants to persuade more banks to use its Rapport secure browsing software as a way of providing an extra layer of defence against banking fraud.
Trusteer's Rapport browser lock-down technology is offered as a voluntary download by 50 banks globally, including NatWest and HSBC in the UK.
The technology is offered alongside a remote forensics service, called Flashlight, designed to allow banks to diagnose whether a client's PC has been infected with malware following incidents of suspected fraud.
Flashlight allows banks to collect samples, identify cybercrime command servers and block further attacks.
Overall, banking fraud has increased significantly not just in the U.K. but globally and the trend is growing in most countries that are surveyed by Internet security firms in more than 35 countries.
According to a study by transaction security firm Trusteer, average detection rates for regional malware vary between zero and 20 percent at best. Trusteer markets browser security add-ons to banks, which offer them to end-consumers as a way of reducing the risk of malware and viruses on PCs resulting in banking fraud.
Overall, Trusteer cites two pieces of regional malware targeted at U.K. banking consumers. Silon.var2 crops up on one in every 500 computers in the U.K. compared to one in 20,000 in the U.S.
Another strain of malware, dubbed Agent-DBJP, was found on one in 5,000 computers in Britain compared to one in 60,000 in the United States and Canada.
Trusteer says that the cybercrooks behind the attacks are using U.K.-centric spam lists and compromised websites to spread the malware, and all without raising any red flags with most security firms. It compares this process to the shift from mass assaults to targeted strikes in corporate espionage-motivated attacks such as Operation Aurora, which struck Google and other high-tech firms in 2009.
"Unlike known malware kits such as Zeus, Torpig and Ambler which simultaneously target hundreds of banks and enterprises around the world and are on the radar of all security vendors, regional financial malware such as Silon.var2 and Agent.DBJP are highly targeted," said Mickey Boodaei, Trusteer's chief exec.
"In the U.K. each malware campaign would usually focus on three to seven banks and target them for a period of six to nine months and then morph and change the list of targets, using a new more advanced version of the malware.”
Overall, the Zeus Trojan is the most common agent of financial fraud on a global basis. The cybercrime toolkit is highly customisable and widely available through underground carder and cybercrime forums. Trusteer has identified two U.K.-specific Zeus botnets, designed to infect only U.K.-based Windows and harvest login credentials of only British banks from these compromised systems.
“Silon, DBJP and other regional financial malware have been identified through Trusteer's Flashlight service and analysis and investigation results have been shared between participating banks,” explained Amit Klein, CTO of Trusteer.
"If a bank in a specific region experiences fraud from a new piece of regional malware there is an 80 percent chance that other banks in the same region will experience the same kind of attack in the near future and incur similar losses from this malware," Klein added.
Regionally-targeted malware has also cropped up in South Africa and Germany over recent months. A strain of malware called Yaludle, almost unseen outside Germany, has been used to successfully target the online banking credentials of German surfers.
Trusteer is urging banks in the U.K. to share information on targeted attacks locally as well as working with regulators and local law enforcement agencies to shut down command and control servers associated with this regionally-targeted malware.
The security company also wants to persuade more banks to use its Rapport secure browsing software as a way of providing an extra layer of defence against banking fraud.
Trusteer's Rapport browser lock-down technology is offered as a voluntary download by 50 banks globally, including NatWest and HSBC in the UK.
The technology is offered alongside a remote forensics service, called Flashlight, designed to allow banks to diagnose whether a client's PC has been infected with malware following incidents of suspected fraud.
Flashlight allows banks to collect samples, identify cybercrime command servers and block further attacks.
Overall, banking fraud has increased significantly not just in the U.K. but globally and the trend is growing in most countries that are surveyed by Internet security firms in more than 35 countries.
No comments:
Post a Comment