theDocumentId => 743525 BackSwap Banking Trojan Shows How Malware Evolves

Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Malware

6/1/2018
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

BackSwap Banking Trojan Shows How Malware Evolves

The newly discovered BackSwap baking Trojan is designed to avoid the security protections that vendors and businesses have created to stop these types of malware attacks.

While attention has increased on newer malware, such as cryptomining and ransomware, older types of malicious software and the attackers behind them have been quietly updating the different ways that they can evade detection.

A malware banker Trojan named BackSwap has been observed by Michal Poslusny of ESET that functions in a unique manner.

Most major banking trojans -- Dridex, Ursnif, Zbot, Trickbot, Qbot -- have used injection of malicious code inside the browser's processes to do their stealing.

This lead the antivirus product makers to scan for process injection attempts by malware, and they have become good at recognizing these types of attacks.

(Source: Flickr)
(Source: Flickr)

Browser makers also made it harder for malware to infect a page's content if such injections were successful.

These efforts made usual techniques less effective, and in need of tweaks in response to every browser update.

Now, BackSwap has come up with three different techniques to bypass all of this.

The first is that the malware hooks key window message loop events that exist inside of Microsoft Windows in order to inspect values of the window objects for banking activity. This is done by searching for URL-like patterns, such as "https" strings, as well as other terms that can be related to a bank's name.

The Trojan then springs into action when it finds the user loading bank sites. The action it takes is not code injection, rather it is a simulation of a key press.

One technique the Trojan uses will simulate the key presses necessary to open the browser’s developer console. Information is then "typed" into the console to give the attacker control of what the user sees. The browser window is also made invisible during this process and it might seem to a user that their browser simply froze for a moment. This keeps the user unaware that an attack is in progress.

There is another technique some malware variants use.

The malicious script is executed directly from the address bar, through JavaScript protocol URLs. The bar that is brought up -- "javascript" -- is first "typed" in, the malware script is then "pasted" in, and then is executed by "pressing" the return key. At the end of the process, the address bar is cleared removing any trace of the compromise.

ESET research finds that the attack works on Google Chrome, Mozilla Firefox and Internet Explorer, but that other browsers could be included with tweaks to the malware.


Now entering its fifth year, the 2020 Vision Executive Summit is an exclusive meeting of global CSP executives focused on navigating the disruptive forces at work in telecom today. Join us in Lisbon on December 4-6 to meet with fellow experts as we define the future of next-gen communications and how to make it profitable.

For right now, BackSwap has support for altering the web portals of only five Polish banks -- PKO Bank Polski, Bank Zachodni WBK S.A., mBank, ING and Pekao. It seems only a matter of time before this kind of malware spreads to other banks, since the technique is so stealthy and so effective.

ESET notes that: "We have notified the affected browser vendors about the innovative script injection technique." That' s good, because the malware takes specific steps to avoid the safeguards that security pros have already put in place to stop automated pasting into developer consoles and status bars.

Security is always a back and forth effort. The good guys try to mitigate, and the malwarers always come up with something new to get around them.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37436
PUBLISHED: 2021-07-24
Amazon Echo Dot devices through 2021-07-02 sometimes allow attackers, who have physical access to a device after a factory reset, to obtain sensitive information via a series of complex hardware and software attacks. NOTE: reportedly, there were vendor marketing statements about safely removing pers...
CVE-2021-32686
PUBLISHED: 2021-07-23
PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In PJSIP before version 2.11.1, there are a couple of issues found in the SSL socket. First, a race condition between callback and ...
CVE-2021-32783
PUBLISHED: 2021-07-23
Contour is a Kubernetes ingress controller using Envoy proxy. In Contour before version 1.17.1 a specially crafted ExternalName type Service may be used to access Envoy's admin interface, which Contour normally prevents from access outside the Envoy container. This can be used to shut down Envoy rem...
CVE-2021-3169
PUBLISHED: 2021-07-23
An issue in Jumpserver 2.6.2 and below allows attackers to create a connection token through an API which does not have access control and use it to access sensitive assets.
CVE-2020-20741
PUBLISHED: 2021-07-23
Incorrect Access Control in Beckhoff Automation GmbH & Co. KG CX9020 with firmware version CX9020_CB3011_WEC7_HPS_v602_TC31_B4016.6 allows remote attackers to bypass authentication via the "CE Remote Display Tool" as it does not close the incoming connection on the Windows CE side if t...