One of the most common questions that I get during Q&A sessions after a PPT, or in a face-to-face conversation is - "Hello, my name is [name], I represent [random financial institution]. Are we being targeted based on your situational awareness?"
For years, virtually every company, every brand, every financial institution has been targeted, largely thanks to the rise of Crimeware-as-a-Service underground market propositions offering standardized and cybercrime-release friendly 'Web Injects', the result of active pre-sale reconnaissance performed on the E-banking service of the targeted institution. The business model is fairly simple - next to 'pushing' a pre-defined set of 'Web Injects' for some of the largest and well known financial institutions in the World, 'Web Injects' for virtually any SSL/Two-Factor Authentication enabled Web site, can be requested and produced on demand, usually for a static amount of money.
"But we issue two-factor authentication tokens to our customers. Isn't this making any change?"
Sophisticated cybercriminals possessing 'innovative' underground market disrupting forces, have been undermining two-factor authentication for years. An uncomfortable truth that your financial institution of choice wouldn't necessarily want you to know about, as it would most commonly risk-forward the responsibility to you, under a contractual agreement, or actually possess an industry-accepted certification for the operation of such online services, thanks to the introduction of two-factor authentication, and the internal security measures preventing a direct compromise of the financial institution's infrastructure.
With source code for the ZeuS crimeware, as well as Carberp, publicly available for virtually anyone to download, it shouldn't be surprising that cybercriminals have started to release more crimeware, using these prominent releases, in an attempt to quickly capitalize on the source code that's been contributing to a huge percentage of the profitability of the cybercrime ecosystem in general.
What are some of the latest 'innovations" in the world of Cybercrime-as-a-Service, in particular the market segment for "Web Injects"? Are cybercriminals striving to produce ZeuS/Carberp like underground market "products", or are they attempting to disrupt the entire cybercrime ecosystem by offering a standardizing E-banking Web site reconnaissance services, that would work on virtually any publicly obtainable/leaked source code based crimeware/malware release?
That's exactly what the cybercriminal whose underground market proposition I'm about to profile, is doing - offering crimeware-independent standardized on demand "Web Injects", in particular OTP (One-Time-Password), ATS (Automatic Transfer Service), TAN (Transaction Authentication Number) bypassing/hijacking/blocking system, or in those cases where the customer demands - offer "finished crimeware products"?
Sample automatically translated underground market proposition:
I am writing to inject custom-made as well as offer finished products.
The main provisions of the Service:
1. Tools manufactures both private and public products.
1.1 Under the private means software products manufactured "in one hand" with the full right to transfer and resale. The client of the right to require the source code private product. Support for the private software somewhere executed in priority order.
1.2 If the "privacy" of the product is not stipulated in advance that product becomes the default public service and the right to sell it to other customers.
1.3 Prices for private products involve premium of 50% to the price of the underlying / social product.
1.4 Distribution / Transmission of any parts of the code or of the products purchased on the basis of the public, will result in a denial of service on all products purchased from third-party service, followed by filing a complaint in section Black List.1.5 Public products are delivered on an "as is," and do not include its value of any additions or changes.
1.5.1 Any changes to the products are made public as an additional order and measured in accordance with the workload.
1.6 Service does not run on the lease terms. Only a piecework basis!1.7 Service does not give advice about cross-translation, relevance or affine those topics. For providing information about banks / cantor Service is not responsible.2. Service is responsible for the performance of the paid code for the negotiated period.
2.1 If the period of service is not verbalized it enters into force standard warranty period is 10 days from the date of issue of working product.
3. Warranties:
3.1 The Service shall recover from the purchased products for a specified warranty period, for that is technically possible. Free of charge - during the warranty period, and the charge on the expiration of the warranty period. Prices for the repair of products range from $ 10 up to the full cost of the product and depend directly on the volume of the work.
3.2. Service is not responsible for the failure of performance caused by the code:
3.2.1 The introduction of third-party software which prevents full operation. (Rapport)
3.2.2 The introduction of sms / email notifications that can not be disabled by means of injection.
3.2.3 The introduction of this activity exhibiting malicious code (without the possibility of elimination)
3.2.4 The other changes in the source code of banks / sites prevent recovery of the product.
3.3 The Service does not guarantee a return to work ordered acquired products, but only can guarantee the performance of the software according to the negotiated terms of reference.
4. Approximate prices for soft (public foundation)grabber balance of $ 10 (1 unit)popup $ 70 Fake full page from $ 150 repleyser from $ 450 (3 units each include an additional $ 50 .. 100) grabbers data from 150 $ Automated OTP/ATS/TAN from $ 2500
Sample explanation of the service in action, courtesy of the cybercriminal behind it:
Sample screenshots of the service in action:
Sample screenshot of the ATSEngine in action targeting HSBC:
Some of the most recent updates to the system include:
01/11/2012 - Sets fullinfo grabbers for AU (37 banks) / CA (30 banks) / US (40 banks). Data on Holder to SSN / MMN / DOB / DL / DL exp / VBV ...
01/11/2012 - Grabbers CC + VBV (paypal, ebay, amazon, facebook)
01/11/2012 - The system change number and Grabing necessary disk imaging (input issues, balance sheets) for the Gulf santander.co.uk (instant on UK to 10kGBP)
02/11/2012 - Grabber additional data for paypal (DE / UK / AU / with the possibility to add other countries). Collects: Name Holder, Balance, Status (verif / neverif), Account Type, Time of the last entry, as well as rooms full of affection card and / or bank accounts for the AU and the UK, and questions with answers for DE
13/11/2012 - Grabber TANs to ipko.pl
23/11/2012 - Avtozaliv on hsbc.co.uk
23/11/2012 - Grabber cc + cvv + exp + pin. works on all pages on which the algorithm finds on LUHN10 card number and exp field and collects requests PIN
11/29/2012 - intercept system / bypass token to fnb.co.za
Two-factor authentication - indeed, an additional layer of security for your E-banking account, however, everything changes on a crimeware-infected host, and sadly, it changes in favor of the cybercriminal that compromised it.