Manual Unpacking of Malware Samples

This article presents information on manual unpacking of protected malicious Windows executables using the OllyDbg debugger. It also involve in fully rebuild the import table so the file can be restored to its original state and executed. Many anti-virus vendors are categorized UPX, NsPack, ASpack and many other PE packers as malicious software.
UPX, NsPack, ASpack are the most common packers, here I will concentrate more in NSpack 3.7. For this analysis we need good knowledge on few topics: PE file format, Basic on Win32 API and few tools are required like OllyDebug 1.10 , OllyScript Plug-in, OllyDump plug-in, Import ReConstructor.

Analysis of Trojan SilentBanker

SilentBanker is one of the serious threats as most of the banking Trojan does. It uses many variety of techniques such as HTML injection and replacement, cookie stealing, certification stealing. This provides the capabilities of SilentBanker. It also present details on how to detect the Trojan on an infected system. This provides an in depth analysis of Trojan SilentBanker by taking a one of the sample (sdra64.exe) of it. This explains the SilentBanker functionally, characteristic, method of infection and detection, and removal. This also describes the Trojan SilentBanker, the resources and environment used for analysis, the method and techniques used for total reverse engineer and some of the analysis troubles found and their solutions. It also presents some best practices to use while reverse code engineering (Behavioral Analysis). This Trojan is an executable program unlike viruses, Trojans do not replicate itself. They are distributing manually, frequently under the principle that attackers are beneficial or wanted. The execution of these Trojan results in system or security exploitation, and unsuspecting user executes the program with their knowledge. Channel which they spread includes email, malicious or hacked web sites, peer to peer networks, Internet Relay Chat (IRC), and many more.

Information collection : MALWARE ANALYSIS

Now that the preparations are over, we can go ahead with our task. This is the only stage where we have an actual interaction with the binary. A lot of raw information about the binary is collected during this stage which is analyzed in the next stage. Therefore, it is very important to carefully record all the information generated in this stage. The steps in the information collection stage are:

Static analysis

During the static analysis stage, we collect as much information about the binary as possible, without executing it. This involves many techniques and tools. Static analysis reveals the scripts, HTML, GUI, passwords, commands, control channels, and so on. Simple things like the file name, size, version string (right-click>properties>version in Win32), are recorded.

Human-readable strings are extracted from the binary and these strings are recorded. A program like Binary Text Scan can be used for this purpose. These strings reveal a lot of information about the function of the binary.

Resources that are embedded in the binary are extracted and recorded. A program like Resource Hacker can be used for this purpose. The resources that can be discovered through this process include GUI elements, scripts, HTML, graphics, icons, and more.

Dynamic analysis

During this stage, we actually execute the binary and observe its interaction with the environment. All monitoring tools including the sniffing software are activated. Different experiments are done to test the response of the running malware process to our probes. Attempts to communicate with other machines are recorded. Basically a new snapshot of the environment is created like in the baselining the environment stage.

After taking a snapshot of all the changes the binary performs in the system, the binary process is terminated. Now, the differences between the new snapshot and the baseline snapshot are determined. The dynamic analysis step is very similar to the baselining the environment stage. Therefore, the tools are reused for this stage. Winalysis and InstallRite can be used for this purpose. Apart from these tools, Filemon and Regmon from Sysinternals can be used for monitoring the file system and the registry dynamically. These tools are used for observing the changes to the file system and the registry.

This information is recorded and forms the input for the next stage of our analysis. The information generated here can be new files, registry entries, open ports, etc.

Sometimes, the static analysis step has to be repeated once more after doing a dynamic analysis.

Baselining the CONTROLLED environment : Malware ANALYSIS

Baselining the environment is the next major step. "Baselining" means taking a snapshot of the current environment. This is the most vital stage in our analysis. If baselining is not done properly, it has a serious effect on the information gathering stage, which in turn seriously effects our understanding of the binary. If baselining is done efficiently, the information generated during the next stage becomes very accurate and the rest of the stages become easy to execute.

To accomplish our goals, the binary which is to be analyzed is executed in a controlled environment and the changes it makes to that environment are captured. Before executing the binary, a snapshot of the environment is created (baseline) and then after execution another snapshot is created. In theory, the difference between the baseline and the final snapshot gives the changes made by the binary.

The elements of the environment that have to be baselined are:

Victim machine
Some of the elements that are to be baselined in the Victim Machine are:

o Filesystem: The file system on the victim host has to be baselined. There are many programs that can create a snapshot of the file system and after a few changes occur, they can point out the modifications. Some of the programs we can use are Winalysis and Installrite.
o Registry: The registry is the next component that is to be baselined. Most malware applications rely on registry entries. Therefore it is crucial to capture registry modifications. Winalysis as mentioned above is one of the available programs that can be used for registry baselining.
o Running processes: A snapshot of the running processes can be created using a number of programs. Some of them are available from Sysinternals.
o Open Ports: A snapshot of the open ports can be created using the 'netstat' utility. However, it does not list the name of the process that is tied to the port. For this, we can use Fport available from Foundstone.
o Users, Groups, Network Shares and Services are some of the other elements that should be baselined.

Network traffic
The next element that has to be baselined is the network traffic. Even when there is no application running on either of the test machines, there will still be some network traffic. This traffic has to be recorded and the "normal traffic" in our test network has to be defined. This is because when deviations occur in the "normal traffic" pattern, we can assume it to be generated by the binary and perform further testing on it.

Sniffing software that is installed on our "sniffer machine" is used for this purpose. Any sniffing software running in verbose mode is sufficient for our purposes. However, to make our task easier, it is preferable to use a protocol analyzer like Ethereal.

External view

Although we have created a snapshot of the open ports in the victim machine, it is always better to create one more snapshot from an external machine. A port scanner running on our "sniffer machine" can achieve this task for us. It goes without saying that Nmap will be the port scanner of choice for most users.

MALWARE ANALYSIS CONTROLLED environment

The framework proposed is broadly divided into six stages. They are:

1. Creating a controlled environment
2. Baselining the environment
3. Information collection
4. Information analysis
5. Reconstructing the big picture
6. Documenting the results

Creating a controlled environment

The setting up of a controlled and sanitized environment is absolutely essential for analyzing malware. A special "test lab" is created for this purpose. Some essential features of the test lab are:

* At least two machines should be used. One machine is for hosting the malicious binary (victim machine) and the other is for baselining and sniffing the network traffic (sniffer machine). They should be networked in such a way that each of them is able to sniff the other's network traffic.
* The two networked lab machines should be isolated from the rest of the network.
* Fresh copies of Operating Systems should be installed on each of the two machines. It is preferable to have a WinNT kernel family OS on one machine and a *nix based OS on the other. Since we are assuming a Win32 binary, the WinNT machine acts as the "victim host" and the *nix machine is used as the "sniffer machine".
* Tools should be transferred to the relevant machines.
* The binary that is to be examined should be transferred to the relevant machine. Since we are assuming a Win32 binary, it is transferred to the Win32 machine in this case.
* It is highly preferable not to install any other application upon the "victim host" apart from the tools required for analysis.

This is the most basic setup for a malware analysis lab. Apart from this and depending on the situation, more modifications can be carried out. For instance, if the malicious binary tries to communicate with a remote server xyz.com, a DNS server has to be setup in one of the lab machines and a DNS entry for xyz.com has to be created. An excellent paper that discusses the creation of a malware analysis lab is "An Environment for Controlled Worm Replication and Analysis".

We may have to return to this "creating a controlled environment" stage many times during the analysis process. Sometimes, in the light of new information generated during the later stages, the lab will have to be tweaked and modified.

A man-in-the-browser attack

A man-in-the-browser attack happens while a fraudster installs a Trojan on a user’s computer that has the capacity of interrupting and interacting with the user’s online transactions in real-time.
In phishing attack, where the user is redirected to a fake website, most of time this happens by clicking on a link in an e-mail. A man-in-the browser attack occurs simply when the user enters a URL into their browser - mainly of being triggered by a prompt such as an e-mail or other notification.
MitB works like session-hijacking, in which the routing out of funds happens in real-time, and is not concentrated only on stealing credentials such as an online banking username/password or credit card number to use later. A man-in-the-browser attack is a sort of man-in-the-middle attack; however it is done in the browser and it is closer to the user not on the traffic stream. A man-in-the-browser attack is very hard to detect and prevent, for the reason that the action is in fact going on in the user’s machine.


For example, if the customer is trying to make a transfer to an account, the malware might alter the end user account number to the fraudsters account number, and then altering the amount. Likewise, once the bank supports that the transfer has happened; the malware has the capability to change what is viewed by the customer, assuming that their preferred transaction has been carried out.
On the whole, malwares are obtained which permits the fraudsters to simply arrange the software to attack specific banks. The attacker gets these configuration files from some website so to quickly update the newly added banks. One such malware package is called SilentBanker, which had the capability of attacking more than 400 bank websites worldwide. It had a special feature to avoid two-factor authentication. It had the capability to perform both MitM attacks and MitB attack.


The MitB attack is even much more difficult to protect against than MitM. Because the network connection is not being interfered with all the way, the website address and certificate will be exact. Fraud detection systems are also in a weak position. From the bank’s point of view, the customer is visiting from their usual computer and by means of their normal Internet connection. As with MitM, as MitB attacks occur in real time, tokens and mutual authentication can be avoided, because the fraudster has full control over the customer’s computer.

Man In the middle attack

Complicated malware will use a MitM attack; this activates attackers to attack many banks, and assures more return. A MitM attack uses a malicious server which sits between the customer and the bank (the financial organization) .i.e. client and server. Even though the whole thing will give the ordinary impression to the user, once the customer is demanded to authorize a transaction, customer is in fact authorizing a transaction made by the cyber criminal.

The principal of MitM attack initially involves the fake coercing the bank customer to visit a fake banking website. This is generally accomplished by distributing an e-mail, impersonating a bank, requesting the customer to click on a given link, allegedly of the bank website. Another possible approach is tapping with the customer’s internet connection in order that when they attempt to visit the correct website, they in fact are redirected to the fake website.

To the customer, the website will looks the same as the usual bank website. It is even encrypted, so the customer will witness the anticipated lock symbol in their web browser. On the other hand, important information went in will move to the phony bank website and not to the real website. While this information is obtained, particularly written software will hook up to the bank’s real website, impersonate the customer and make fraudulent transactions.


Considering the fact that the fake website has all the information the customer would usually provide, it is not possible for the bank to identify difference between the real customer and the fake. For the reason that the connection to the bank happens right away as soon as the customer enters their account details, any time-dependent one-time password (OTP) will even now be valid. If the bank has carried out shared authentication, the fake website will receive the correct reply from the bank, for example pictures or answers to secret questions, and forward it back to the customer. The customer will see the anticipated reply and as a result send the account details the fraudster requests. At the same time as both the bank and the customer think they are communicating straight, in actual fact the fraudster is free to view and change some of the transmitted information.

Diligent bank customers possibly will be able to recognize fake sites, in view of the fact that their address may be wrong. At the same time as some are encrypted, watchfully inspecting the website certificate might show that the site do not actually belong to whom it claims to. Moreover, as fraudsters might try to connect to the bank website from a computer in the same country as the customer, bank fraud recognition systems might observe doubtful characteristics.


A classical MtiM attack is briefly explained below:


Normally the attacker places himself between two communicating parties’ .i.e. between the customer and the bank, and collects all the information from the bank customer. The data given for the genuine website are passed to the attacker instead, who saves this information, gives this information to the legitimate site, and passes the responses again back to the customer. A schematically illustrated in figure

MitM attacks in the context of crime -based information theft include:

a) A session hijacking attack, in which data is obtained from a customer and passed through to the genuine website until the preferred authentication has been executed, whereupon the session is hijacked.
b) A hostname lookup attack typically called as pharming, in which a website at the anticipated host name, but with the incorrect IP address, passes data from the customer to the genuine website and vice-versa, to provide genuineness and delay finding.
c) A web proxy attack, in which a malicious web proxy obtains all web traffic from a compromised computer and passes it to a genuine website, taking credentials and other confidential information.

Generally MitM is very difficult to detect, because the genuine website still looks to work correctly and there is no warning to give if something is wrong.

Authentication The Pitfall Of Two Factor Authentication

Overview

A lot of banks in the US are busy preparing themselves for new federal requirements on two factor authentication for online banking. This trend has also been adopted by financial institutes in many other countries. Two factor authentication is definitely a good way to improve security level of online banking. With online authentication attacks like phishing hitting major banks around the world, traditional user name and password only authentication seems to be seriously lacking.

In talking to other security professionals, everyone seems to be excited about the two factor authentication systems such as the one-time password (OTP), soft and hard tokens. However, it should be noted that two factor authentication is not the "end-all" and "be-all" of authentication solution that will stop phishing and other attacks in their tracks.

Potential effects of two factor authentication

In the short term, two factor authentication will cut down the phishing and other online banking attacks. By adding the second factor of authentication, attackers will have a more difficult time trying to grab the full credentials from unsuspecting victims. This is the primary benefit that everyone expects when implementing two factor authentication. The early adopters of an extra factor in authentication will see a drastic decrease in attacks simply because the attackers just move on to attack the weaker ones.

In the long run, after every bank has moved on to two factor authentication, phishers and attackers will eventually catch on and will start attacking the online applications protected by two factor authentication. This might happen faster than most people think. With regulations requiring the banks to have two factor authentication, it is possible to see a massive deployment of two factor authentication system within couple of years. With two factor authentication being the norm, it is possible that within a year of wide scale two factor authentication deployment in a country, the attackers could already be fluent in attacking the online banking clients using two factor authentication.

Methods of attacks

Let's review some of the methods attackers can use to break the protection offered by two factor authentication. Remember, these are only some of the possible scenarios, the rest is up to imagination.

Trojans

Trojans are pretty common these days and we are already seeing some trojans such as Bankers trying to steal username and password from victims. These trojans generally steal credentials by keylogging or fake login forms and then send the credentials to a collection site for later exploitation by the attackers. With a full two factor authentication system, username, password and the passcode of second factor are not going to be useful at a later time (unlike the username and password only system). At the surface, it would look like the trojans are not effective anymore. Unfortunately, this is not the end to the trojans, there are still attack avenues left for the trojan attackers.
Remote control is a possibility, if the attacker is able to remotely control the victim's computer and wait until the user logins to their online bank, the attacker can easily execute transaction right in front of the victim. Techniques used by existing trojans such as keyboard/mouse disabling and IE window name monitoring (alert the attacker) can aid the attacker in such attack.
Another possible trojan attack method is through automated transactions submitted by the trojan. The trojan would have to detect the user logging in and then submit the transaction using the user’s session ID. This requires quite a bit of prep work since every bank's online system is different but with some careful planning, it would still work well.

Phishing

Phishing!? Yes, phishing can still work but only limited to certain types of second factor authentication and the attack process isn't simple. First, phishers would send out email out phishing email like they normally do (in the past) in order to entice submission of credentials over a look-alike website. The phishers also ask for the second factor information. I will use the example of a hard token solution generating a pseudo random strings periodically. The phisher asks for the token string and the token passcode as well as the user name and password. Right after the victim enters the form info, the phisher's script at the collection point gets to work. Immediately after collecting the credential information, the info entered by the user is used to login to the online bank and the fraud transaction is immediately executed.
The process to immediately execute the fraud transaction can pose some challenges to the phishers, eg. script the correct automated fraud transaction, have the money courier lined up ready to go. The above scheme relies on a weak second factor. If the bank employs a challenge response two factor system, the phishers might have trouble. Overall, phishing will be made more difficult by two factor authentication.


Man in the middle

In the phishing scenario, challenge response type of second factor seems to be problematic to the phishers. However, that really isn't stopping all the attackers. The desperate ones can still leverage Man in the middle type of attack. There are a few ways for man in the middle attacks to work. One is to put up a look-alike malicious site which is basically a proxy to the actual bank's website. When the victim login with proper credentials, the attacker can simply ride on that established online banking session. Notice that even challenge-response type of token would work in this case because the attacker (or the man in the middle) is passively observing the connection between the bank and the victim. The challenge will reach the victim, who will then send in the response. The attack simply proxies the traffic until the session is establish and then sends in the fraud transaction.

So, two factor authentication doesn't work?

We have showed a few ways in which the two factor authentication by itself does not offer sufficient protection for online banking. The pitfall is in the lack of protection from the two factor authentication against real time impersonation attack. Although two factor authentication is not perfect, this is not a good excuse for not deploying two factor authentication system. All cases we mentioned above render the life of an attacker a whole lot more difficult. When the attack is more complicated and difficult, the likelihood of an attack reduces.

Instead of using two factor authentication as the only solution against the security issues with online banking authentication, the financial institutes and government regulators should look into educating the general public about the proper way to safeguard their online transactions. The financial institutes should also start to investigate more ways for the clients to easily identify the legitimate website versus the look-alike. To further protect the financial institute and the clients, it is important to look into improving the real time fraud detection system on the backend so malicious transactions get flagged before they even happen.

Conclusion

As long as there is money to be made, the attack against online banks will not stop. Making it more difficult by using two factor authentication is a good way to cut down on some of the attacks. The more work required to attack, the less likely we are going to see a phishing kit for $20. It's also interesting that the folks from Kaspersky are noticing a shift of cyberattack targets towards the government sector, they are guessing the profit made from individual user is not satisfactory to the attackers anymore.

It is important to note that two factor authentication by itself might not offer the level of protection some people keep dreaming about. Any system has its own deficiency. In the online banking authentication system, we need more than one technology with many accompanying backend processes to ensure it meets the security expectation of clients.

Trojans and toolkit

Trojans are the hope of cyber fraud and are still beginning to control its present. Trojan automated what had before been made by hand; it just downloads a victim’s stored data or records the keystrokes, rather than rely upon user to enter his or her information into a phishing pages fields.

Malicious code targeting financial institutions can be broadly classified two categories: target code and generic, kit based Trojan . Whereas malicious code author design particular Trojan horses to target only financial institutions with login system and with extra sophisticated design rather than standard user name and password, less sophisticated pieces of malicious code such as generic keystroke logging Trojan and generic from grabbing Trojan also cause financial burdens on institutions.

There are many special classes of Trojan, marked by their behavior function, not on their design or distribution scheme.

Keystroke logging

Few information stealing software such as keyloggers or keystrokes, which records each typed on victim’s keyboard. Keystroke logging creates huge amounts of data that includes spaces, backspace and line breaks keys. The authors have included keystroke logging in Trojan and Remote Administration Tools (RAT) toolkits . A lot of additional varieties of Trojans have a standard keyloggers that collects huge amount of stolen data, even though if the attacker is not targeting specific site.

HTML Injection

This HTML injection attack is a method for the attacker to perform on the fly phishing attack. The victim real banking web site and HTML added code is injected into the page after the page is finished loading. However, HTML injections are not a novel method to stealing credentials and other personal information. This permits attack to encapsulate field that are actually not a part of standard format but leaves valuable information (Figure 1 & Figure 2).

Pharming

Pharming attacks are quite alike to the phishing attacks in that they are intended to obtain private information form victims by pretending to be trusted source and demand for information. The diversity involving pharming and phishing is that pharming attack resolves the victims DNS to a malicious server when trying to visit a genuine website, as contrasting to a phishing attack, which needs that victims be tricked by social engineering into visiting fake website.

MX Logic defined pharming as a malicious web direct. This definition demands that something to altered on the victim’s computers, like local DNS server or HOSTS files. The description has included DNS cache poisoning, where attacker spoils DNS server’s cache so that all lookups to the server react with a malicious address. If DNS cache poisoning, which is just exploiting a vulnerabilities found in DNS server execution, it is believed as pharming, then any other vulnerabilities found in DNS server used for the similar purpose will be most likely also be defined as pharming

• Pharming Working
  

Though pharming has benefit of usually not requiring social engineering but still it is more complicated and for this reason it requires more skill. Phishing can be executed with minimal understanding and some time with automated toolkits. Pharming even though it has a variety of methods, at all times requires at least one technical step.

Cache poisoning, which targets the largest number of users needs successful exploitation of DNS server or gateways or routes and a server with a catch all DNS entries for every web site. Altering HOSTS file, involves that attacker do these alters via malicious code or compose and changes the system manually.

The quantity of information and attempt to produce a pharming attack exceeds the possible profit of pharming individual websites. For the reason that the percentage of DNS servers that are really vulnerable is very small, targeting them with individual websites in not likely to produces amount of stolen information develops in phishing attack. On the other hand, enthusiasm to perform pharming attack might increases as anti-phishing software’s becomes more widespread. On top it, if exploitable vulnerabilities are detected that affects the majority commonly used DNS server, pharming attack possibly will increase. Attackers take some time to set up individual website to duplicate companies if they can fraudulent sufficient DNS servers to affects large number of users.

• DNS Spoofing

This is most frequently used type of phishing. Even if there are lots of variations of this approach, the core is the injection of the pharming page’s URL into the resolution procedure. It can be done either in customer machine or in DNS server. The determined domain thus appears to be the one of the user planned to visit, but is it certainly the pharming page. Depending on the pages trustworthiness to original, there is little user can do to keep away from being fooled by this attack types.

• DNS Cache poisoning

This technique involves injecting false information to the DNS server, which route internet traffic by matching domain name with IP address at web hosts, allowing hackers to redirect users to bogus website. Successful DNS poisoning attack are very common and permit malicious web site to spoof trusted web brands. Pharming attack could use DNS cache poisoning to redirect request to genuine financial site to look- alike fake site.

Types of banking attacks

Figure 1 : Phishing Process (From Anti-phishing Working Group)

• Social engineering

Social engineering is not a technological attack; it is a method by which human weaknesses in information security system are exploited. It is a process where attacker develops belief within you, guessing to be a person or organization you recognize or trust. Frequently, Social engineering attacks are carried out by means of common communication technologies .i.e. phone or email.
These attacks are easy to launch, up till now the most hard to avoid. Phishing is mainly general
examples of social engineering attacks. The goal is to obtain your financial login credentials. Criminals then utilize your credentials to access your bank account and steal your money, or other possible is to sell your banking login credentials to other criminals.

• Phishing

One of the most common remote attract against financial online services is called phishing. Spoofed messages which supposedly come from financial organization and which are created in such a way that the user gives confidential information.
Phishing is not directly only against customer anymore. Phishing is normally processed through instant messaging or e-mail and it repeatedly redirects the users to go into particulars fake website whose look and feel are almost the same as the genuine one. In a typically phishing operation (see figure 1 above) perpetrators use a verity of tactics to obscure the fake web site making it to look like a genuine web site.
It is very difficult to detect the fake websites; it requires great skill to detect. Phishing is an example of social engineering techniques which is used to trick users and trap the poor usability of current web security technologies.

There are quite a few different theories about the origin of word “phishing”. Some analysts believed the term is an acronym for “password harvesting fishing” and other believed as “hacking spelling” of the word “fishing” to “phreaking”. HoneyNet project has published a paper called as “Know your Enemy: Phishing”, this give a comprehensive guide to present day pushing attacks.

In past few years, the most common methods developed:

• Spoofed E-mail Address:

Phishers uses many variety of techniques and shareware tools so that the phishing e-mails appears legitimate, for example: customerservies@TARGETEDCOMPANY.COM

• Spoofed URLs:

Many techniques had originated to spoof URLs. One technique requires using JavaScript that covers URL windows at top of the users’ browser with graphic or text. Others use browser exact vulnerabilities to confuse the URL. Both results in valid URL being displayed instead of fake URL. On top it, it is likely to have URL that contains encoded characters that resembles American Standard code for Information Interchanges (ASCII), which can also be done with International Domain Names (IDNs) to make address display nearly identical to web site being spoofed.

• Similar URLS:

In this case, fake website has a URL that sounds alike to that of targeted website. This was initially was very ordinary exercise but in falling out of season due to increasing complicated and improved efforts by companies to purchase such a domain name.

• Combination attacks:

HoneyNet Project says that many attackers make use of other grouping methods of attacks. For Example: attack can happen through hijack server add in with port redirection functionality that forward to malicious web site and use botnet to send email designed to tempt recipients to fake a website.

• Phishing through port redirection:

Port redirection service is installed in server. This redirects the guest to a different server that has the malicious content in a challenge to make the phishing harder to trace.

• Phishing using only IP address:

Rather considering URL, the web site uses IP address. This might confuse non technical user, who might trust a website recognized as a string of numbers as a opposed to a web site with a doubtful URL.

• Pop-Up windows:

While using pop-up windows, phishers forwards the user to a web site that opens the genuine bank’s website with fake pop-up window over it. This holds the field for entering the user’s login and password

Attack Trends in Online Banking System

Introduction



This section provides a brief explanation of the methods presently used by cyber criminals to attack targeted online banks and financial institutions in particular. It inspects common trends and capture how malicious programs targeting online bank are designed to avoid detection by anti virus solutions.



This section additionally deals with phishing, pharming , HTML injection, and few other technical steps which cyber criminals may possibly take when initiating an attack (such as redirecting traffic, man-in-the-middle many more).



This section is written with the intention of providing new future security professionals a more comprehensive understanding of the ways in which financial institutions and/or online banks can be attacked by cyber criminals.

Detection Techniques

Idealistic systems to defend against malware have to cover few steps such as: detection, identification, prevention and recovery.

Detection: Determines that a give program is probable malicious
Identification: Classifying a given program as matching to or linked to an identified piece of malware.
Prevention: Blocking a malicious program from executing hostile functions.
Recovery: Getting rid of a malicious program from a system and/or fixing any damage it has caused.

A good number of accepted practical systems at the current time falls in category of signature based malware scanners. Signatures are the unique data patterns that malware scanners use to detect viruses as they scan your files or data. Signature based scanning is a procedure whereby a unique `signature or rules' is computed for a given virus or other malicious program . This is done by the manufacturers of antivirus products, who provide their software with signatures that frequently updated. When the antivirus product scans a program it looks for malicious activities which match signatures. The disadvantage of this technique is that it can only notice malicious activities that have beforehand signature generated.

A new Signature should be created for every new malware and even for every variant of an already existing malware. This is a time-consuming exercise, thus bring the basic problem with Signature-based Malware detection. A malware which is specially developed for a particular attack cannot be detected in principle. The antivirus software companies collect sample of malware and create a signature. By that time a certain level of damage will be done.
To address this problem, IDS Intrusion Detection System was introduced. The IDS is able to identify harmful behavior and therefore belongs to the class of "Behavior Blockers". All active programs in the system are constantly monitored. It stops the potentially damaging behavior activities as soon it is noticed and alert notification is generated. This prevents further execution of a mistrustful program without Signatures.
Behavior Blockers, an additional technology is becoming increasingly popular, the HIPS Host-based Intrusion Prevention System approach. These tools give notification of attempts to control many system interfaces such as autostarts, device drivers, the network, etc., but they do not offer any exact information as to whether an action is actually harmful or not. This is kind of personal Firewall apart from windows firewall initially generates numerous (false) alarms until the software has been suitably qualified.
Windows Firewall cannot distinguish between malicious traffic and legitimate ones. Windows update is mostly to patch several vulnerabilities in Windows and underlying applications. It is not a mechanism to detect a malicious piece of software. Extend of threat con varies from malware to malware. Few set of malwares are exclusively targeting banks as per the predefined list the malware authors can offer. They can imitate the websites, for example altering the hosts file or modifying the DNS entry, so when a user visits a specific bank website instead of going to the legitimate website he is redirected to phished website.

Spam

The correct beginning of the word spam, frequently used to recognize and degrade unwelcome e-mail. A lot of experts at present believe that spam e-mails are making a huge traffic .i.e. up to more than 70% of all e-mail traffic on the Internet.


“Spam is unsolicited e-mail on the Internet. From the sender’s point-of-view, it’s a form of bulk mail, often to a list obtained from a spambot or to a list obtained by companies that specialize in creating e-mail distribution lists. To the receiver, it usually seems like junk e-mail. It’s roughly equivalent to unsolicited telephone marketing calls except that the user pays for part of the message because everyone shares the cost of maintaining the Internet. Spammers typically send a piece of e-mail to a distribution list in the millions, expecting that only a tiny number of readers will respond to their offer. Spam has become a major problem for all Internet users.”

A spambot (spam robot) is a kind of software robot that lives on web. It takes out all possible e-mail addresses it come across and logs a file. Sometimes, the spambot’s e-mail address file is collected and adds to largest part e-mail delivery lists.
Nevertheless the big e-mails list that send spam, those receivers are always combined in their dislike for e-mails of that type. Other than some very small percentage of the population that such e-mail targets actually bites at whatever’s existing.

Adware and Pop-Ups

Spyware does a job of secretly following and reporting the user’s activities or data where as adware’s job is to get the advertising to users’ desktop.

“Adware is any software application in which advertising banners are displayed while the program is running. The authors of these applications include additional code that delivers the ads, which can be viewed through pop-up windows or through a bar that appears on a computer screen. The justification for adware is that it helps recover programming development cost and helps to hold down the cost for the user.
Adware has been criticized because it usually includes code that tracks a user's personal information and passes it on to third parties, without the user's authorization or knowledge. This practice has been dubbed spyware and has prompted an outcry from computer security and privacy advocates, including the Electronic Privacy Information Center.”

Spyware

Before we start talk about spyware, it is very much necessary to know meaning of the term. Spyware is something that invites itself and takes up place on a computer, generally uninvited guest, which can inform on the behavior, action and preferences of the computer’s users, or reveal some secret information with reference to data stored on a computer. In other words, it can also be defined as, it spots on what the computer is intended for and probably for what it holds, to report on its findings to outsiders.

“Spyware is any technology that aids in gathering information about a person or organization without their knowledge. On the Internet (where it is sometimes called a spybot or tracking software), spyware is programming that is put in someone’s computer to secretly gather information about the user and relay it to advertisers or other interested parties. Spyware can get in a computer as a software virus or as the result of installing a new program. Data collecting programs that are installed with the user’s knowledge are not considered to be spyware if the user fully understands what data is being collected and with whom it is being shared. However, spyware is often installed without the user’s consent, as a drive-by download, or as the result of clicking some option in a deceptive pop-up window.

The cookie is a well-known mechanism for storing information about an Internet user on their own computer. However, the existence of cookies and their use is generally not concealed from users, who can also disallow access to cookie information. Nevertheless, to the extent that a Web site stores information about you in a cookie that you don’t know about, the cookie mechanism could be considered a form of spyware.”

By considering these different meaning, we can conclude some important points such as:

• Collect information about the user with his/her permission
• With no user’s knowledge, it might be operated to third parties.
• It might occasionally alter the behavior of a user’s computer without user’s permission.

Capabilities of Spyware
While other, more delicate signs exists that spyware or other useless software has intruded on your system, the most familiar and visible indications such as:

a) Performance slows down
If your system running slowly with no good reason, it might just be that the overhead of recording your actions or delivering loads of ads are putting down the performance. Not as good as yet, spyware or adware can make a previously steady system vulnerable to crashing.

b) Something new or unanticipated shows up
Either in your desktop or web browser, it possibly be something from a new home or search page, to a toolbar, to a piece of software. Be appreciable it is something can be seen.

c) An increase in ads, pop-ups, or advertising
Every so often, you will be overcame with ads and it is simple to make out that something wrong; intensity might just go up a little, or you will get that closing one ads provokes one more to become visible, ads infinitum.

Malware Characteristics

The characteristics that each class of malware can demonstrate are frequently alike. For example, a virus and a worm may both use the network as a transport media. However, the virus will search for files to contaminate while the worm will just try to copy itself. The subsequent part explains the characteristics of malware.

a) Malware is multifunctional and standard:

There are numerous varieties of malware that can be used together or individually to accomplish a malicious actor’s goal. New features and additional capabilities are easily added to malware to modify and improve its functionality and impact. Malware know how to place itself into a system, compromise the system, and then download extra malware from the Internet that supplies added functionality. It can bypass security measures such as firewalls and anti-virus PROTECTION, and it can use encryption to OVERRIDE detection or cover its means of operation .

b) Malware is user-friendly:

Malware is obtainable online at nominal price thus making it potential for anyone to acquire. There is a strong underground market for its sale and purchase. Moreover, malware is user-friendly and allows attackers with an ability to initiate most sophisticated attacks outside their skill rank.


c) Malware is determined and capable:

Malware is progressively harder to identify and remove and is efficient at defeating built-in information security counter-measures. Some classes of malware know how to defeat strong forms of multi-factor authentication and others have been able to challenge the strength of digital certificates.

d) Malware capable to impact a range of devices:

Since malware is nothing more than a piece of software, it can affect a range of devices, such as personal computers or Personal Digital Assistants (PDAs) to servers all over different types of networks . All these devices, together with the routers that permit traffic to move all over the internet to other end points, are potentially vulnerable to malware attacks.

e) Malware is part of cyber attack system:

Malware is being used both as a primary form of cyber attack and to maintain additional forms of malicious action and cybercrime such as spam and phishing. On the other hand, spam and phishing can be used to promote distribute malware.

f) Malware is money-making:

Malware is no more simply a fun game for script kiddies or a field of study for researchers. Today, it is a dangerous business and source of income for malicious actors and criminals all over the world. Malware, jointly with other cyber tools and techniques, supplies a low cost, reusable technique of conducting highly profitable cybercrime.

Malicious software categories

Nowadays, computer users and network operators have to struggle and vaccinate themselves against an ever rising different variety of methods of attack which can infect or target specific networks or machines in a co-ordinated attack. The following are the simple and straightforward classification of some malware categories:

Worm

Computer worms are self-replicating computer programs. A worm uses self-propagating malicious code that can automatically spread itself from one computer to different computers through network connections. Unlike a virus, a worm doesn’t attach itself to an existing program. Worms spread through the network connectivity, exploiting vulnerabilities in computer systems and find the other vulnerable systems.

So the next question in order to have a more clear definition of the malware: “without the help of carrier can the code replicate?” .i.e. can the code infect an executable file? If “YES”, then the code is regarded as some sort of worm.

A worm can be harmful, such as overwhelming network bandwidth or acquiring local system resources, perhaps causing a DoS attack (denial of service). Some worms can execute and spread without user interference, while others require users to execute the worm code in order
to spread.
The majority of worms try to copy itself onto a host computer and then use the computer network to replicate. For example, the Sasser worm relies on a service vulnerability to initially
infect a system, and then uses the infected system’s network connection to replicate. If the latest security updates are installed, or there are firewalls in the LAN environment to block the network ports the worm uses, the attack might not succeed.

Trojan horse

A Trojan horse or Trojan is a program or file that a user permits or invites onto his system, thinking that the program or file is usual software. But actually, the program or file contains malware that attempts to take control over the system or provide a way for an outsider to reach
in. Trojan horses are not self-replicating which differentiate them from viruses and worms. Once a Trojan horse has been installed on a target computer it can be possible for a hacker to access it remotely and execute operations. The types of operations that a hacker can carry out are limited by user privileges on the target computer and the design of the Trojan horse itself.

A few additional terms to be considered when referring to Trojan horse behavior are recognized
and explained below:

• Backdoors or Remote Access Trojans(RATs)

A few Trojan horse programs permit the hacker or data thief to have control over a system remotely. Such programs are called Remote Access Trojans (RATs) or backdoors. Examples
of RATs include Back Orifice, Cafeene, and SubSeven.

• Rootkits

Rootkits are collections of software programs that a hacker or data thief can use to have unauthorized access to remote computer systems and start attacks. Rootkits have the capability of altering the existing OS’s softwares so that an attacker can hide himself. This rootkit program may use different techniques like: monitoring keystrokes, altering system log files, creating a backdoor into the system, and initiating attacks against other computer systems on the network. Rootkits are usually structured into a set of tools that are tuned to exclusively target a specific operating system. The first rootkits were noticed in the early 1990s, and at that time the Linux and Sun operating systems were the main targets. At present, rootkits are available for all possible operating systems, which include the Microsoft Windows platform.

Virus

The virus code is written to convey purpose of replicating itself. It tries to spread and infect computer to other without the permission or knowledge of owner by attaching itself to a host program. It has the capabilities of damaging hardware, software, or data present in computer system. When the host system is executed, the virus code also runs, infecting new hosts and every now and then delivering an additional payload.

If the malicious code appends a copy of itself to a file, boot sector, or document of a disk drive in order to duplicate it is believed a virus. This malicious code may be a copy of original virus or it could be customized version of original virus . As referred previously, a virus will frequently have a payload that it might drop on a local computer, such as a Trojan horse, which will then execute one or more malicious acivities, such as deleting user data. However, a virus that only duplicates itself and has no payload is still a malware problem because the virus itself may damage data, take up system resources, and take more network bandwidth as it replicates.

Malware definition

Malware is a universal name for a piece of software injected into computer system to induce harm to that system or other systems, or to undermine them for use other than that proposed by their owners. Malware can get remote access control to information system, record and forward data from the controlled system to a third party without the users’ authorization or knowledge. Information systems which have been compromised are able to perform illegal security actions which can harm the information system, or otherwise affect the data and system integrity.
Viruses, worms, trojan horses, backdoors, keystroke loggers, rootkits or spyware and different types of malware are described in the next section. These terms correspond to the functionality and activities of the malware (e.g. a virus is self spreading, a worm is self replicating). Malware research analyst’s experts generally cluster malware into two classes: family and variant. “Family” refers to the distinct or original piece of malware; “variant” refers to a different version of the original malicious code.

So how do we differentiate between a computer virus and a worm? How are these different from Trojan horses?

Malware In Action

Introduction
This chapter explains the rise and evolution of computer viruses, from the first comparatively simple and straightforward viruses to the latest malicious softwares that exist these days. The chapter also describes varieties of known malware types and techniques, and gives information about how malware spreads and the risks it places to organizations of any size.
This chapter has several objectives:

• Evolution of computer virus
• Defining Malware and characteristics
• Differences between worm, virus, Trojan , spyware and, their characteristics
• Detection techniques

This chapter doesn’t explain malware elements by capturing some sample of malware. Still, it does offer an important first step in trying to know the various elements that constitute malware. This chapter will also briefly discuss and define additional things which are not malware, such as adware, spyware, spam.

Evolution of computer viruses

The most familiar mistake people do when the subject of a computer virus comes up is to mention a worm or Trojan horse as a virus. Although the words virus, worm, and Trojan are frequently interchangeable, they are not precisely the same. Viruses, worms and Trojan Horses are all malicious programs that have the capability to harm the computer, but there are conflicts between the three. A virus has the capability of travelling form one computer to another by attaching itself to a program or to a file, leaving infection as it travels. It works exactly like a human virus. For more details on this topic. Most of time all the viruses are attached to an executable files .It cannot infect our computer unless it has been executed.
Worms on the other hand are a kind of network viruses, which replicate on network. A worm has the capability of executing itself automatically on a remote machine without human interaction. Worms are typically standalone applications without a host program. The main danger with a worm is that it is capable to replicate itself on our system, so that it can send out many copies of itself creating big destructive effects.

It is not astonishing that the evolution of computer viruses is directly linked to the achievement and development of the Internet. The contrast between the internet and a living creature is that they constantly fight against viruses. As the Internet has developed, so has the environment of the threat. Viruses have bred new forms of malicious life that flourish on the computer technology of Internet connectivity, voice and data communications. These new threats can quickly recreate and spread themselves (worms) to attack their hosts. Self-governing threats have joined in the form of coalesced threats that join to recognize,
disenable, or demolish any vulnerable carrier hosts . So from where did it all start? The computer worm label was conceived following from the publishing of “The Shockwave Rider”, a science fiction novel published in 1975 by John Brunner. Afterwards researchers from Xerox PARC, Jon AHupp and John F Shock published a paper in 1982. Xerox was the first Computer Worm. This was not able to spread because of lack of internet infrastructure.
In the late 80’s there was a virus called Brain (1986), which infected the boot sector of floppy disks which were the primary method of transmitting files between computers. This virus was written in assembly language, and propagation was very slow because it depends upon physically carrying the infected disk form one computer to other. These viruses’ fall in a class called “Boot Sector Viruses”. The virus is transmitted when the PC boots up. By the early 90s, famous viruses like Stoned, Jerusalem, and Cascade started to flow . In the middle to late 90’s, the landscape started to alter with the development of the Internet and personal computer use, the rise of networking, and the adoption of electronic mail systems. A worm
called “big impact worms” started to reach the public in different ways. The use of email added highprofile mass-mailer worms such as Melissa (1999), “I Love You” (2000), Anna Kournikova (2001), SoBig (2003) and Mydoom (2004) that made the headlines and entered the public awareness. These types of worms doubled their number of victims every few hours, quickly reaching zenith activity less than 20 hours of being released. This marked the parallel rise in controlled, sometimes synchronized attacks. The volatile development of online financial transactions resulted in enlarged security events and in the appearance of novel types of malicious software and attacks.
Today, we are not dealing with viruses, but also with worms, Trojan horses, backdoors, rootkits, HTTP exploits, privilege escalation exploits, and buffer overflow exploits. These threats make out and target upon vulnerabilities in applications and software programs to carry and spread attacks. The ultimate goal of most of the attackers tends to focus on financial gain. These new trends explain why malware is now a worldwide multi-million dollar criminal industry.
Also mentions how the phishing Trojan technique executes, how it overcomes a few authentication schemes and how some banks and security firms are extenuating the threat with more complex authentication and fraud detection schemes. To end with, this report will inspect the potential mitigation techniques.