Attacks/Breaches
1/10/2014
04:44 PM
50%
50%

Using Attackers' Tactics To Battle Banking Trojans

At the upcoming RSA conference, Trustwave researchers will discuss using obfuscation to break the functionality of banking Trojans, such as ZeuS

Sometimes becoming like your enemy isn't a bad thing.

RSA Conference 2014
Click here for more articles about the RSA Conference.

In a world where malware authors use obfuscation to mask their malicious intent, security researchers may do well to do the same. It is this idea Trustwave researchers Ziv Mador and Ryan Barnett are planning to build on in their upcoming presentation at the RSA Conference in San Francisco next month.

According to Mador, Trustwave's director of security research, the presentation is about leveraging the tactics of attackers in ways that can help an organization's defense -- starting with taking the concept of obfuscation and turning it against the attacker. The ultimate goal, the researchers explain, is to break the Web injection functionality of Trojans, such as ZeuS.

"ZeuS' Web injects functionality happens by hooking into various Windows processes, including wininet.dll," says Barnett, lead security researcher at Trustwave. "This provides raw access to the HTTP data as if it is going across the network. It is at this point, before the data reaches the actual Internet Explorer Web browser process, that ZeuS attempts to modify the HTTP data.

"What we show is that by using even basic HTML/[JavaScript] obfuscation -- we used a basic Caesar Cipher -- it can break the Web injects. Our payloads are automatically decoded by the Web browser and rendered appropriately to the end user. In order to get access to the deobfuscated version of the HTML, banking Trojans would need to hook directly into the Web browser itself and have access to the DOM data."

Even if the Trojan runs within the browser, the obfuscation can protect it, Mador adds, unless it is configured to run after the deobfuscation loop executes.

"Most banking Trojans are not programmed that way," he says. "I would add that exploit kits often use dynamic variable names to randomize the content between different web requests. For example, random variable names are used as randomization seeds for the obfuscation. Web fraud detection code can use similar techniques for protecting itself. For example, the Web inject is configured to remove the protective code from certain location in the page. By randomizing the content of the Web page the same way, Web injects is expected to break. Improving the banking Trojans to remove them from random locations in the page adds complexity to the authors of banking Trojans."

There are some examples of banking Trojans that work as plugins for Mozilla Firefox or Google Chrome that may be able to access the DOM and circumvent the technique, Barnett concedes.

"Web fraud detection vendors have software that can work as extensions/plugins for the user's Web browser," he says. "This is another area where security researchers/vendors can reverse-engineer banking Trojan plugins to better detect and prevent them from working by monitoring and protecting registering these hooks."

In some ways, the idea is similar to the concept of a Russian Matryoshka doll, where a doll is placed inside a larger doll, Barnett says. In this case, the HTML of the bank login page is placed inside a virtual Russian doll, which provides a layer of obfuscation ZeuS is not currently prepared to handle.

"[ZeuS] is looking for that raw HTML, and if it doesn't see it, the Web inject does not work," he says. "So it breaks it."

"What we're saying is look to tactics ... attacker groups are using," he adds. "Perhaps you can use that in a different way, or apply it in a different area."

The presentation is scheduled for Feb. 26. Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Brian Prince is a freelance writer for a number of IT security-focused publications. Prior to becoming a freelance reporter, he worked at eWEEK for five years covering not only security, but also a variety of other subjects in the tech industry. Before that, he worked as a ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
1/11/2014 | 12:28:22 PM
re: Using Attackers' Tactics To Battle Banking Trojans
there is no use to play with band-aids. the actual problem in many cases is un-authorized programming, often called 'malware'

two rules

1. an o/s should never permit itself to be modified by an application program.
2. customers and users must have the ability to restrict what an application program can access.

these are old rules. protected mode originated in System/360 in 1964 and was then enhanced with RACF in 1974. protected mode became available in x86 with the 80386.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5208
Published: 2014-12-22
BKBCopyD.exe in the Batch Management Packages in Yokogawa CENTUM CS 3000 through R3.09.50 and CENTUM VP through R4.03.00 and R5.x through R5.04.00, and Exaopc through R3.72.10, does not require authentication, which allows remote attackers to read arbitrary files via a RETR operation, write to arbit...

CVE-2014-7286
Published: 2014-12-22
Buffer overflow in AClient in Symantec Deployment Solution 6.9 and earlier on Windows XP and Server 2003 allows local users to gain privileges via unspecified vectors.

CVE-2014-8896
Published: 2014-12-22
The Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 allows remote authenticated users to modify ...

CVE-2014-8897
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

CVE-2014-8898
Published: 2014-12-22
Cross-site scripting (XSS) vulnerability in the Collaboration Server in IBM InfoSphere Master Data Management Server for Product Information Management 9.x through 9.1 and InfoSphere Master Data Management - Collaborative Edition 10.x through 10.1, 11.0 before FP7, and 11.3 and 11.4 before 11.4 FP1 ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.