A Peek Inside a Managed OTP/ATS/TAN Token Bypassing/Hijacking/Blocking System as a (Licensed) Service

One of the most common questions that I get during Q&A sessions after a PPT, or in a face-to-face conversation is - "Hello, my name is [name], I represent [random financial institution]. Are we being targeted based on your situational awareness?"

For years, virtually every company, every brand, every financial institution has been targeted, largely thanks to the rise of Crimeware-as-a-Service underground market propositions offering standardized and cybercrime-release friendly 'Web Injects', the result of active pre-sale reconnaissance performed on the E-banking service of the targeted institution. The business model is fairly simple - next to 'pushing' a pre-defined set of 'Web Injects' for some of the largest and well known financial institutions in the World, 'Web Injects' for virtually any SSL/Two-Factor Authentication enabled Web site, can be requested and produced on demand, usually for a static amount of money.

"But we issue two-factor authentication tokens to our customers. Isn't this making any change?"

Sophisticated cybercriminals possessing 'innovative' underground market disrupting forces, have been undermining two-factor authentication for years. An uncomfortable truth that your financial institution of choice wouldn't necessarily want you to know about, as it would most commonly risk-forward the responsibility to you, under a contractual agreement, or actually possess an industry-accepted certification for the operation of such online services, thanks to the introduction of two-factor authentication, and the internal security measures preventing a direct compromise of the financial institution's infrastructure.

With source code for the ZeuS crimeware, as well as Carberp, publicly available for virtually anyone to download, it shouldn't be surprising that cybercriminals have started to release more crimeware, using these prominent releases, in an attempt to quickly capitalize on the source code that's been contributing to a huge percentage of the profitability of the cybercrime ecosystem in general.
 
What are some of the latest 'innovations" in the world of Cybercrime-as-a-Service, in particular the market segment for "Web Injects"? Are cybercriminals striving to produce ZeuS/Carberp like underground market "products", or are they attempting to disrupt the entire cybercrime ecosystem by offering a standardizing E-banking Web site reconnaissance services, that would work on virtually any publicly obtainable/leaked source code based crimeware/malware release?

That's exactly what the cybercriminal whose underground market proposition I'm about to profile, is doing - offering crimeware-independent standardized on demand "Web Injects", in particular OTP (One-Time-Password), ATS (Automatic Transfer Service), TAN (Transaction Authentication Number) bypassing/hijacking/blocking system, or in those cases where the customer demands - offer "finished crimeware products"?

Sample automatically translated underground market proposition: 
I am writing to inject custom-made as well as offer finished products. 
The main provisions of the Service:

1. Tools manufactures both private and public products. 
1.1 Under the private means software products manufactured "in one hand" with the full right to transfer and resale. The client of the right to require the source code private product. Support for the private software somewhere executed in priority order.
1.2 If the "privacy" of the product is not stipulated in advance that product becomes the default public service and the right to sell it to other customers. 
1.3 Prices for private products involve premium of 50% to the price of the underlying / social product. 
1.4 Distribution / Transmission of any parts of the code or of the products purchased on the basis of the public, will result in a denial of service on all products purchased from third-party service, followed by filing a complaint in section Black List.1.5 Public products are delivered on an "as is," and do not include its value of any additions or changes. 
1.5.1 Any changes to the products are made public as an additional order and measured in accordance with the workload. 
1.6 Service does not run on the lease terms. Only a piecework basis!1.7 Service does not give advice about cross-translation, relevance or affine those topics. For providing information about banks / cantor Service is not responsible.2. Service is responsible for the performance of the paid code for the negotiated period. 
2.1 If the period of service is not verbalized it enters into force standard warranty period is 10 days from the date of issue of working product. 

3. Warranties:
3.1 The Service shall recover from the purchased products for a specified warranty period, for that is technically possible. Free of charge - during the warranty period, and the charge on the expiration of the warranty period. Prices for the repair of products range from $ 10 up to the full cost of the product and depend directly on the volume of the work. 
3.2. Service is not responsible for the failure of performance caused by the code: 
3.2.1 The introduction of third-party software which prevents full operation. (Rapport) 
3.2.2 The introduction of sms / email notifications that can not be disabled by means of injection. 
3.2.3 The introduction of this activity exhibiting malicious code (without the possibility of elimination) 
3.2.4 The other changes in the source code of banks / sites prevent recovery of the product. 
3.3 The Service does not guarantee a return to work ordered acquired products, but only can guarantee the performance of the software according to the negotiated terms of reference. 

4. Approximate prices for soft (public foundation)grabber balance of $ 10 (1 unit)popup $ 70 Fake full page from $ 150 repleyser from $ 450 (3 units each include an additional $ 50 .. 100) grabbers data from 150 $ Automated OTP/ATS/TAN from $ 2500

Sample explanation of the service in action, courtesy of the cybercriminal behind it:

Sample screenshots of the service in action:

Sample screenshot of the ATSEngine in action targeting HSBC:

Some of the most recent updates to the system include:
01/11/2012 - Sets fullinfo grabbers for AU (37 banks) / CA (30 banks) / US (40 banks). Data on Holder to SSN / MMN / DOB / DL / DL exp / VBV ...
01/11/2012 - Grabbers CC + VBV (paypal, ebay, amazon, facebook)
01/11/2012 - The system change number and Grabing necessary disk imaging (input issues, balance sheets) for the Gulf santander.co.uk (instant on UK to 10kGBP)
02/11/2012 - Grabber additional data for paypal (DE / UK / AU / with the possibility to add other countries). Collects: Name Holder, Balance, Status (verif / neverif), Account Type, Time of the last entry, as well as rooms full of affection card and / or bank accounts for the AU and the UK, and questions with answers for DE
13/11/2012 - Grabber TANs to ipko.pl
23/11/2012 - Avtozaliv on hsbc.co.uk
23/11/2012 - Grabber cc ​​+ cvv + exp + pin. works on all pages on which the algorithm finds on LUHN10 card number and exp field and collects requests PIN
11/29/2012 - intercept system / bypass token to fnb.co.za

Two-factor authentication - indeed, an additional layer of security for your E-banking account, however, everything changes on a crimeware-infected host, and sadly, it changes in favor of the cybercriminal that compromised it. Continue reading →

The end of passwords - for sure, but when?

My first blog post "How to create better passwords - why bother?!" back in December, 2005, tried to briefly summarize my thoughts and comments I've been making on the most commonly accepted way of identifying yourself - passwords.

Bill Gates did a commentary on the issue, note where, at the RSA Conference, perhaps the company that's most actively building awareness on the potential/need for two-factor authentication, or anything else but using static passwords for various access control purposes. Moreover, it was again Bill Gates who wanted to integrate the Belgian eID card with MSN Messenger (Anonymity or Privacy on the Internet?) Microsoft are always reinventing the wheel, be it with antivirus, or their Passport service, and while they have the financial obligations to any of their stakeholders, I feel it's a wrong approach on the majority of occasions.

What I wonder is, are they forgetting the fact that over 95% of the PCs out there, run Microsoft Windows, and not Vista, and how many would continue to do so polluting the Internet at the bottom line. My point is that MS's constant rush towards "the next big thing" doesn't actually provides them with the resources to tackle some of the current problems, at least in a timely manner. What do you think? What could Microsoft do to actually influence the acceptance of two-factor authentication, and moreover, how feasible is the concept at the bottom line?

Technorati tags :
security, microsoft, authentication, passwords Continue reading →

How to create better passwords - why bother?!

I have recently came across a practical article on how to create a better passwords, couresy of CSO Magazine. It reminded me of how many times I find myself actually getting into the science of passwords maintenance and creation in order to enforce real-life, cost-effective scenarios, while on the other hand, get myself seriously concerned on how easy it is to have your accounting data abused!

During the years I have written several articles, like this one - Creating and Maintaining Strong Passwords, mainly with the idea to actually provide a pragmatic approach on tackling weak, and prone to be cracked passwords. The result, at least from a sniffing point of view *grin* was that most of my friends lacking security knowledge, were indeed getting concerned by their easy to guess passwords. Later on, they were turning them into entire passphrases with the idea to avoid not having them cracked. That's an example of a "false feeling of security".

And while it was a progress compared to how predictable their passwords really were, strong passwords doesn't address the following issues that I later on covered in another article - Passwords - Common Attacks and Possible Solutions, namely, passwords can be :

- Sniffed
- Recovered
- Unintentionally shared
- Keylogged
- etc.

Recently, both from a CSO's point of view, and the financial industry, two factor authentication, has been gaining a lot of acceptance, in my opinion primary because of its tangibility. It greatly improves the authentication process, given the integrity of the system, and the network itself. And while from an organization's or bank's point of view providing tokens to the entire work force would represent a huge investment, I strongly feel prioritizing in respect to important customers, and executives will play an important role.

On October 12, 2005, the Federal Financial Institutions Examination Council, released its Guidance on Authentication in Internet Banking Environment, thereby enforcing the use of advanced, compared to passwords based only, authentication approaches.

Would it work? I doubt so, but it limits the age-old attacks we are so used to seeing in respect to passwords.

Bruce Schneier has been discussing the dangers of the two factor authenticaion buzz, and as far as online banking is concerned, Candid Wüest has written a very good paper on Today's threats to online banking, namely the techniques discussed fully apply to any type of authentication. Passwords are out of the topic, even two factor authentications has its good and bad sides to it comes to end users' awareness, implementation and configuration.

What are the practical alternatives these days?

Password Safe is a bit unpractical(still works for lots of people out there) in today's interconnected world, namely, a HDD crash for instance would cause a lot of trouble to everyone, let's not mention the "availability" of the data. Just1Key seems to solve this problem to a certain extend. I also recommend you verify the strenght of your passwords by taking advantage of the Password Strenght Meter ComputerWeekly, are also running an article "Security : have passwords had their day?", they sure haven't, at least not on a large scale, the way I've always wanted to see it - One Time Passwords in Everything! Check out RSA's One-Time Password Specifications , the concept in itself has the time frame advantage!

Further reading on the topic can be found at :

The Memorability and Security of Passwords - Some Empirical Results

Passwords you’ll never forget, but can’t recall

One Time Passwords In Everything (OPIE) : Experiences with Building and Using Stronger Authentication

Stealing passwords via browser refresh

A Convenient Method for Securely Managing Passwords

Technorati tags :

passwords,access control,authentication,information security,security,identification

Continue reading →