Browser-based malware robs UK bank accounts

Stuart Corner
Wednesday, 11 August 2010 15:41

Business IT - Security

A highly sophisticated attack on a large UK financial institution mounted via the browsers of its online banking customers, and discovered by M86 Security, highlights just how hard it will be in the future for banks to maintain the integrity of their online banking systems.

According to an M86 white paper, "In July 2010, an organised network of cybercriminals launched a complex, multi-level scheme that targeted online customers of a large UK financial institution. Based on information M86 Security Labs found on the malicious command & control (C&C) server, we assume that close to £675,000 was stolen from the bank between July 5 and August 4, 2010, and approximately 3,000 customer accounts were compromised."

M86 says that the cybercriminals used multiple techniques to spread a Trojan to as many PCs as possible to target the online customers of a specific bank. These techniques included: infecting legitimate websites with malware, creating fraudulent online advertisement websites and publishing malicious advertisements among legitimate websites.

Then, once the Trojan, Zeus v3, was successfully installed on victims' when victims logged into their online banking accounts, it intercepted all their communications with the online banking site, communicated with its command and control server and initiated transfers from customers' accounts, via money mules, to the cyber-thieves.

The Trojan used various techniques to remain under the radar of common anti-fraud detection systems. These techniques included encrypting its communications with its command and control server using SSL. M86's security researchers were, however, able to break this encryption and thus to determine the amounts being transferred in each transaction, and the nature of the attack.

Banks in Australia use additional security that would, it seems, prevent attacks like this. The Commonwealth Bank, for example, requires a random code sent by SMS to be entered on the website before money can be sent to a new account, but this is not an ironclad protection.

CONTINUED