Actu
David Emm, Kaspersky: Inside a banking Trojan drop-zone
February 2011 by David Emm, Senior Technology Consultant, Kaspersky
Cybercriminals will try anything to get their hands on other people’s money. The most effective way to do this is to assume a victim’s identity in order to get access to their online funds. Identity thieves masquerade as the victim by providing legitimate login and password details to online accounts.
But how do scammers get hold of this personal information in the first place? Cybercriminals have a powerful tool in their arsenal: the Trojan. They use Trojan programs like an offline burglar would use a crowbar - to force their way in and get their hands on the personal information they need to profile their victims, gain access to their online accounts and steal their money. And all this without their victims even suspecting that their data has been stolen.
It is fairly easy to pick up a malicious program when surfing the Internet, unless you take precautions that is. Since today’s operating systems and applications are so complex, they often have a few weak spots that aren’t obvious to the untrained eye. However, these weak spots can and do lead to critical errors when the application is used in a way that the programmer didn’t foresee. And these errors can be used to launch a malicious program on the victim’s computer.
Anyone who clicks on links in e-mails or instant messages without thinking twice about it, or who visits an unknown (or sometimes a well-known, but hacked) website is in danger of downloading malware onto their computer. This malware then sits on their computer and silently does whatever it’s instructed to do by the cybercriminal controlling it. In order to get the victim to accept the malware’s actions as those of a normal, legitimate program, the Trojan will either inject its code into system services or disguise itself as an important system service.
Since malware today is typically unobtrusive, it will remain in place indefinitely unless the victim installs Internet security software, ’spying’ on everything done by the victim.
One of the most prolific threats to be found on the computers of unfortunate victims today is a Trojan spy program called Zeus [identified by Kaspersky Lab as Zbot]. Zeus first appeared in 2007 and since then there have been tens of thousands of variants. Since it’s easy to configure, easy to use and enables theft of all manner of personal data, it has become one of the most widespread and best-selling of all spyware programs available on the Internet’s black market.
The ’drop-zone’ is the server used by cybercriminals to hoard the ’loot’ taken from victim computers. Here’s a quick overview of the things the Trojan steals?
1. All the data that the computer ‘remembers’ for you [i.e. when you check the ‘Remember my password’ box] – including your login name, your password and any other kind of data entered into an automated field on a web site.
2. Any confidential data that you type in a web form – password, PIN, credit card number, etc.
3. Even confidential data that you enter using a virtual keyboard – Zeus takes a screenshot whenever you use the left mouse button, to identify the keys you have clicked on.
4. Any data transferred via your web browser. If you attempt to open a web site that has already been logged by Zeus’s configuration file, the Trojan may modify the website’s code before you even see it in the browser window – e.g. by adding additional fields where you’re asked to enter additional information that, for example, a bank would never normally ask for.
5. Security certificates used by a bank to verify who you are when you log in to its web site.
6. And even if you don’t bank, shop or socialize online, and have nothing that the cybercriminals are interested in, they can still use your computer for unlawful purposes – for example, to distribute spam or as part of a Distributed Denial of Service attack.
