New web attack immediately siphons stolen data

Powered by SC Magazine
 

New attack steals data from any site.

Researchers have detected a "new man-in-the-browser" (MITB) attack method that uses malware capable of stealing users bank or other sensitive information entered on websites.

As opposed to traditional MITB scams – where locally-installed malware activates when users visit predefined websites – this technique allows criminals to draw victims' data from an unlimited pool of sites.

Trusteer discovered the threat in late August and posted a blog this week that details the scam.

Senior security strategist George Tubin told SC that malware used in "universal" MITB attacks processed information like credit card numbers immediately, rather than afterward, as in a traditional MITB scenario.

When using this new attack method, fraudsters don't have to parse through huge amounts of data or text collected over time, which leaves victims less opportunity to change their credit card details, passwords or other captured information.

“It doesn't matter what websites [victims] go to, it only matters if they use their credit card,” Tubin said.

“The likelihood of success is significantly higher using this type of technique versus the traditional man-in-the-browser. When they get the card information, it's going to be fresher information.”

Trusteer spotted a video used by cyber criminals to market the uncommon and still emerging attack method.

Zeus and SpyEye were examples of crimeware kits used in the universal MITB attacks. The malware often is loaded onto victims' machines through common phishing tactics or by taking advantage of unpatched browser vulnerabilities in drive-by download attacks.

“Browser security has never been done properly,” Tom Kellermann, vice president of cyber security at anti-virus firm Trend Micro told SC. “[Attackers] are creating modules that fully automate the MITB process you used to have to do manually.”

In June, Trend Micro researchers released a report on a new technique, called an “automatic transfer system” (ATS), being used to commit financial fraud. This also was used to launch MITB attacks and to instantly intercept users' login details, while going undetected by victims.

This article originally appeared at scmagazineus.com

Copyright © SC Magazine, US edition


New web attack immediately siphons stolen data
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  4%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  3%
 
A Federal Government agency (ATO, Centrelink etc)
  19%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1869

Vote
Do you support the abolition of the Office of the Information Commissioner?