Advance of Bank Trojan Nov 2005
Mar 29, 2015
Advance of Bank Trojan
Nov 2005
2 – 2002 Symantec Corporation, All Rights Reserved
Current threat from Bank Trojans
Steals online banking information; typically usernames and passwords.
PWSteal.JGinko targets Japanese banks. (Trojan-Spy.Win32.Banker.vt [Kaspersky Lab], PWS-Jginko [McAfee], TSPY_BANCOS.ANM [Trend Micro])
These Trojans work closely and actively with Internet Explorer.
3 – 2002 Symantec Corporation, All Rights Reserved
Submission increase
Symantec gets almost 2 million submissions per year.
The rate of submissions is increasing.
Are Bank Trojan submissions increasing?
4 – 2002 Symantec Corporation, All Rights Reserved
PWSteal.Bancos submissions
Why have submissions decreased?
5 – 2002 Symantec Corporation, All Rights Reserved
Bancos submissions vs Total Symantec submissions.
0
500
1000
1500
2000
2500
3000
6 – 2002 Symantec Corporation, All Rights Reserved
How samples are collected
User submissions
Honey pot
Web site routine patrol(Adware, Spyware)
Brightmail
BBS
7 – 2002 Symantec Corporation, All Rights Reserved
Japanese Banks VS Bank Trojan
PWSteal.Bancos originally targeted Brazilian Banks.
Then, support was added for German and English Banks.
PWSteal.Jginko targets only Japanese Banks.
PWSteal.Jginko monitors 27 domains.
PWSteal.Bancos.T monitors 2746 domains.
8 – 2002 Symantec Corporation, All Rights Reserved
PWSteal.Jginko domains
resonabank.anser.or.jp, btm.co.jp, ebank.co.jp
japannetbank.co.jp, smbc.co.jp, yu-cho.japanpost.jp
ufjbank.co.jp, mizuhobank.co.jp
shinseibank.co.jp, iy-bank.co.jp
shinkinbanking.com, shinkin-webfb-hokkaido.jp
shinkin-webfb.jp
And more, more, more
9 – 2002 Symantec Corporation, All Rights Reserved
Other Bank Trojans also target rural banks
82bank.co.jp, akita-bank.co.jp
all.rokin.or.jp, toyotrustbank.co.jp
hyakugo.co.jp, chibabank.co.jp
fukuibank.co.jp, gunmabank.co.jp
hirogin.co.jp, hokugin.co.jp
joyobank.co.jp, nishigin.co.jp
And more, more, more
10 – 2002 Symantec Corporation, All Rights Reserved
Security measures taken by Japanese Banks recently
Software Keyboard
Strong password requirements
Challenge and response with one-time encryption key
Prevent phishing mail
Login restricted by IP address
SSL
11 – 2002 Symantec Corporation, All Rights Reserved
Advantage of Trojan over KeyLogger
These Trojans are not KeyLogger.Trojans
Stealth techniques can be used
Intercepts transaction information
Silent download
Silent update
12 – 2002 Symantec Corporation, All Rights Reserved
Bank Trojans are not KeyLogger.Trojan
Old KeyLoggers log key strokes and send logged data.
Difficult to know which application the user was using
Logs user error (passeo[Back Space][Back Space]word )
Difficult to know when the user changes to a different input field
13 – 2002 Symantec Corporation, All Rights Reserved
Stealth techniques used by Bank Trojans
Works with Internet Explorer.
Firewall does not stop HTTP transaction of Internet Explorer. (BHO, Inject, layered service provider)
Injects itself into other process
Rootkit may hide files or protect them from security application
Hide packet traffic from system to avoid detection
14 – 2002 Symantec Corporation, All Rights Reserved
Intercept transaction
These Trojans can hook specific procedure calls
These Trojans can inject itself into an application
HTTPS is not secure if the data is intercepted before and after it is encrypted
15 – 2002 Symantec Corporation, All Rights Reserved
Silent download/ Silent update techniques
Trojans may close Alerts from Windows Firewall
Delete Zone.Identifier settings
Add itself to Authorized Applications list, bypassing the firewall
16 – 2002 Symantec Corporation, All Rights Reserved
Technique: Key Logging
17 – 2002 Symantec Corporation, All Rights Reserved
Technique: Key Logging(2)
18 – 2002 Symantec Corporation, All Rights Reserved
Technique: Inject
Taskmanager can enumerate process
DLLs are never enumerated by taskmanager.
If IEXPLORE.EXE calls loadlibrary?
VirtualAllocEx
WriteProcessMemory
GetProcAddress
CreateRemoteThread
19 – 2002 Symantec Corporation, All Rights Reserved
Technique: BHO
A Browser helper object is an additional software component that is loaded when Internet Explorer starts.
When a BHO sends a data, It looks like the data is sent by Internet Explorer.
The BHO can’t be seen with Task manager.
20 – 2002 Symantec Corporation, All Rights Reserved
Loading BHO
How Internet Explorer loads and initializes helper objects.
21 – 2002 Symantec Corporation, All Rights Reserved
Technique: BHO (2)
22 – 2002 Symantec Corporation, All Rights Reserved
Technique: Intercept transaction
23 – 2002 Symantec Corporation, All Rights Reserved
Secure Socket Layer is secure?
Secure
Not SecurePickup data
Encrypt data
24 – 2002 Symantec Corporation, All Rights Reserved
Technique: Intercept transaction (2)
25 – 2002 Symantec Corporation, All Rights Reserved
Technique: Intercept transaction (3)
26 – 2002 Symantec Corporation, All Rights Reserved
Technique: Intercept transaction (4)
27 – 2002 Symantec Corporation, All Rights Reserved
Technique: Intercept transaction (5)
DWebBrowserEvents2, IHTMLDocument2
Onmouseover
User push “A” or “A” filled to field.
Onsubmit
28 – 2002 Symantec Corporation, All Rights Reserved
Technique: Silent download
29 – 2002 Symantec Corporation, All Rights Reserved
Technique: Silent update
30 – 2002 Symantec Corporation, All Rights Reserved
Technique: Silent update (2)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
Value: ":*:Enabled:"
31 – 2002 Symantec Corporation, All Rights Reserved
Steal password
32 – 2002 Symantec Corporation, All Rights Reserved
Challenge and response
Send user name
Send user name
Answer “Challenge”Answer random “Challenge”
Send one-time password
Accepted
Calculate one-time password by “Challenge” and send it
Answer fake error page Transfer money
Thank You!
Hiroshi [email protected]