SpyEye Trojan defeating online banking defenses
By Jeremy Kirk
Banks are facing more trouble from SpyEye, a piece of malicious software that steals money from people's online bank accounts, according to new research from security vendor Trusteer.
SpyEye is a particularly nasty piece of malicious software: it can harvest credentials for online accounts and also initiate transactions as a person is logged into their account, literally making it possible to watch their bank balance drop by the second.
In its latest versions, SpyEye has been modified with new code designed to evade advanced systems banks have put in place to try and block fraudulent transactions, said Mickey Boodai, Trusteer's CEO.
Banks are now analyzing how a person uses their site, looking at parameters such as how many pages a person looks at on the site, the amount of time a person spends on a page and the time it takes a person to execute a transaction. Other indicators include IP address, such as if a person who normally logs in from the Miami area suddenly logs in from St. Petersburg, Russia.
SpyEye works fast, and can automatically and quickly initiate a transaction much faster than an average person manually on the website. That's a key trigger for banks to block a transaction. So SpyEye's authors are now trying to mimic -- albeit in an automated way -- how a real person would navigate a website.
"They used to pay less attention to the way they execute transactions on the bank's website and now they are really trying to show normal user patterns," Boodai said. "
Boodai said he has little idea of how successful SpyEye's new evasion code is, although Trusteer does collect intelligence from banks that have distributed its browser security tool, Rapport, to their customers. Trusteer has also noticed that SpyEye in recent months has expanded the number of financial institutions it is able to target in an increasing number of countries.
New target countries include Russia, Saudi Arabia, Bahrain, Oman, Venezuela, Belarus, Ukraine, Moldova, Estonia, Latvia, Finland, Japan, Hong Kong and Peru. What that means is that more criminal groups around the world are purchasing the SpyEye toolkit, Boodai said.
Financial institutions continue to increase their security spending to protect online transactions, said Avivah Litan, an analyst at Gartner who regularly consults banks on security issues.
Even to her, financial institutions are coy about revealing how hard they've been hit, but "everyone refers to Zeus or SpyEye -- some as common as the word 'teller'" Litan said.
Police have had some limited successes. In April, a 26-year-old Lithuanian and a 45-year-old Latvian were charged with conspiracy to cause unauthorized modifications to computers, conspiracy to defraud and concealing proceeds from crime for allegedly using SpyEye. A third, 26-year-old man whose nationality was not revealed was bailed pending further questioning.
SpyEye is actually a botnet with a network of command-and-control servers hosted around the world. As of Tuesday, some 46 command-and-control servers were online, according to the SpyEye Tracker, a website dedicated to gathering statistics about the malicious software.
That is sharply up. In May, there were just 20 or so active servers responding to computers that were infected with SpyEye, said Roman Hüssy, who runs the site.
"SpyEye is growing quite well," he said.
Source Code For SpyEye Trojan Published; More Exploits On The Horizon, Researcher Says
Once costly code for data-stealing Trojan is now available to the masses, Damballa reports
By Tim Wilson
The source code for SpyEye, an infamous data-stealing Trojan, has been published on the Web and could easily be adapted and used by any savvy cybercriminal with virtually no cost or chance of getting caught, a researcher said Monday.
"One of the most dangerous Swiss Army knives in malware is now available to billions," said Sean Bodmer, senior threat intelligence analyst at security vendor Damballa.
According to a blog posted by Bodmer on the Damballa website, the SpyEye builder patch source code (release 1.3.45) was leaked by French security researcher Xyliton, part of the Reverse Engineers Dream (RED) Crew.
"He was able to locate a copy of SpyEye builder 1.3.45 and created a walkthrough/tutorial that enables the reader [once in possession of SpyEye builder] to crack the hardware identification [HWID] which has been secured using VMProtect, a licensing tool that locks an installation of software to a particular physical device," the blog says.
The SpyEye malware kit has been widely used in cyberspace for some time now, but it generally was sold at a price of around $10,000 -- not a price paid by the average script kiddie, Bodmer observes. Now, with the crack, the kit is being sold inexpensively on hacker forums.
"What this means is that anybody can use it," Bodmer says.
Perhaps just as important, the "crack" enables malware developers to avoid the attribution that was previously associated with the high-priced toolkit, Bodmer states. Where previous exploits using the kit could often be traced back to the original buyer of the toolkit, there have already been some SpyEye exploits spotted that have no attribution, he says.
"This will make it more difficult to track SpyEye botnets back to the source," Bodmer says.
SpyEye, which incorporated elements of the popular Zeus Trojan earlier this year, was already ranked as one of the top three threats on the Web this year, Bodmer says, infecting some 2 million devices. "Now I expect that number to climb," he says, possibly even displacing TDL and rogue antivirus threats, which occupy the other two spots in the top three.
"SpyEye has been on everyone’s priority list of threat discussions for quite some time, and is now going to become an even more pervasive threat," Bodmer says. "The same thing happened when the Zeus kit source code was released in March 2011.
"Damballa Labs has been tracking dozens of new Zeus bot operators since the leak earlier this year -- and now that SpyEye has been outed, it is only a matter of time before this becomes a much larger malware threat than any we have seen to date," the blog states. "So for the next few months, please hold onto your seats people… this ride is about to get very interesting."