Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/10/2014
04:44 PM
50%
50%

Using Attackers' Tactics To Battle Banking Trojans

At the upcoming RSA conference, Trustwave researchers will discuss using obfuscation to break the functionality of banking Trojans, such as ZeuS

Sometimes becoming like your enemy isn't a bad thing.

RSA Conference 2014
Click here for more articles about the RSA Conference.

In a world where malware authors use obfuscation to mask their malicious intent, security researchers may do well to do the same. It is this idea Trustwave researchers Ziv Mador and Ryan Barnett are planning to build on in their upcoming presentation at the RSA Conference in San Francisco next month.

According to Mador, Trustwave's director of security research, the presentation is about leveraging the tactics of attackers in ways that can help an organization's defense -- starting with taking the concept of obfuscation and turning it against the attacker. The ultimate goal, the researchers explain, is to break the Web injection functionality of Trojans, such as ZeuS.

"ZeuS' Web injects functionality happens by hooking into various Windows processes, including wininet.dll," says Barnett, lead security researcher at Trustwave. "This provides raw access to the HTTP data as if it is going across the network. It is at this point, before the data reaches the actual Internet Explorer Web browser process, that ZeuS attempts to modify the HTTP data.

"What we show is that by using even basic HTML/[JavaScript] obfuscation -- we used a basic Caesar Cipher -- it can break the Web injects. Our payloads are automatically decoded by the Web browser and rendered appropriately to the end user. In order to get access to the deobfuscated version of the HTML, banking Trojans would need to hook directly into the Web browser itself and have access to the DOM data."

Even if the Trojan runs within the browser, the obfuscation can protect it, Mador adds, unless it is configured to run after the deobfuscation loop executes.

"Most banking Trojans are not programmed that way," he says. "I would add that exploit kits often use dynamic variable names to randomize the content between different web requests. For example, random variable names are used as randomization seeds for the obfuscation. Web fraud detection code can use similar techniques for protecting itself. For example, the Web inject is configured to remove the protective code from certain location in the page. By randomizing the content of the Web page the same way, Web injects is expected to break. Improving the banking Trojans to remove them from random locations in the page adds complexity to the authors of banking Trojans."

There are some examples of banking Trojans that work as plugins for Mozilla Firefox or Google Chrome that may be able to access the DOM and circumvent the technique, Barnett concedes.

"Web fraud detection vendors have software that can work as extensions/plugins for the user's Web browser," he says. "This is another area where security researchers/vendors can reverse-engineer banking Trojan plugins to better detect and prevent them from working by monitoring and protecting registering these hooks."

In some ways, the idea is similar to the concept of a Russian Matryoshka doll, where a doll is placed inside a larger doll, Barnett says. In this case, the HTML of the bank login page is placed inside a virtual Russian doll, which provides a layer of obfuscation ZeuS is not currently prepared to handle.

"[ZeuS] is looking for that raw HTML, and if it doesn't see it, the Web inject does not work," he says. "So it breaks it."

"What we're saying is look to tactics ... attacker groups are using," he adds. "Perhaps you can use that in a different way, or apply it in a different area."

The presentation is scheduled for Feb. 26. Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
1/11/2014 | 12:28:22 PM
re: Using Attackers' Tactics To Battle Banking Trojans
there is no use to play with band-aids. the actual problem in many cases is un-authorized programming, often called 'malware'

two rules

1. an o/s should never permit itself to be modified by an application program.
2. customers and users must have the ability to restrict what an application program can access.

these are old rules. protected mode originated in System/360 in 1964 and was then enhanced with RACF in 1974. protected mode became available in x86 with the 80386.
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...