Bypassing malware detection mechanisms in online banking
•Download as PPTX, PDF•
1 like•435 views
The document outlines a presentation given by two pentesters on bypassing malware detection mechanisms in online banking. It discusses how malware works by interacting with browsers and stealing credentials. It then summarizes common malware detection methods used by banks and their limitations. Several vulnerabilities in typical detection architectures and implementations are presented. The document concludes that while behavioral detection systems are promising, the underlying HTTP and JavaScript infrastructure poses challenges and recommends rethinking architecture and implementation. It also provides recommendations for banks and vendors on improving security.
Recommended
More Related Content
Similar to Bypassing malware detection mechanisms in online banking
Similar to Bypassing malware detection mechanisms in online banking (20)
More from Jakub Kałużny
More from Jakub Kałużny (8)
Bypassing malware detection mechanisms in online banking
- 1. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Jakub Kałużny Mateusz Olejarka Bypassing malware detection mechanisms in online banking
- 2. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • Pentesters @ SecuRing • Ex-developers • Experience with: — E-banking and mobile banking systems — Multi-factor and voice recognition authentication — Malware post mortem Who are we? @j_kaluzny @molejarka
- 3. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • Intro — Why this topic? — How it’s done? — Will it blend? • Vulnerabilities • Conclusions • Q&A* Agenda
- 4. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Intro
- 5. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • AVs are not reliable • Users are lazy • Market gap for new solutions • A lot of money Why this topic ?
- 6. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • Interaction with browser — Web injects — Other? • What it does — Steals credentials — Changes transaction data — Automates attacks How malware works? zeus spyeye carberp citadel zitmo vbclip banatrix carbanak eblaster bugat torpig hiloti gozi
- 7. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Aim: Detect malware presence What is online malware detection ? BACKEND WEB SERVER BROWSER USER MALWARE HTTP TRANSACTIONS signatures fingerprint User/browser behaviour fraud detection system Action: drop or mark as compromised (JS)
- 8. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Malware detection methods: • HTTP response signature • Browser fingerprint • User/browser behavior • Server-side behavioral methods • Fraud detection system What are the limits ? marketing magic auditability
- 9. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • We do not represent any vendor • We want to show — architecture failures — implementation errors • We want to talk about what can be done What is the purpose of this report?
- 10. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Vulnerabilities
- 11. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleOur approach BACKEND WEB SERVER BROWSER USER MALWARE HTTP TRANSACTIONS feed analyze JS analyze traffic analyze response
- 12. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style HTTP traffic First idea clean machine action system infected machine action
- 13. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style HTTP traffic + JS analysis Going through… clean machine action system infected machine action + js analysis: • Different paths • Different subdomains • Different data format (e.g. base64) • Encryption (e.g. rsa)
- 14. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleAlmost there… clean machine action system infected machine action
- 15. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleIf it bleeds, we can kill it clean machine action system infected machine action BYPASSED!
- 16. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleArchitecture problem user action systemanti malware magic red light green light Words of wisdom: adverse inference
- 17. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleMalware spotted! user action systemanti malware magic red light Who sends the alert ? login: user1 time: … behaviour: suspicious login: user2?
- 18. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleFirst things first user action systemanti malware magic red light JavaScript slowing your page ? BYPASSED!
- 19. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleSecurity by obscurity malware detection JavaScript eval Simple obfuscation – base64, hex rsa encryption signatures reasoning engine Web Service rsa public key
- 20. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleSignatures server-side browser server website A please HTML + JS malware detection Fragments of website A Hey, your website A is webinjected ! regexp for website A
- 21. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title styleSignatures client-side browser server website A please HTML + JS malware detection Hash of web injects signatures content web injects signatures Leaks your malware signatures The output is your weakness
- 22. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Conclusions
- 23. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • Buy an anti-malware box? • Better call your crew • Trust, but verify • Ask for technical details Conclusions - banks
- 24. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • Online malware detection is a good path, behavioral systems are a future of ITsec • But they are still based on the old HTTP + HTML + JS stack • Think about architecture and implementation Conclusions – vendors
- 25. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style • Recommendations for potential anti-malware buyers – paper, work in progress • Interested? -> malware@securing.pl or antimalware@securing.pl What’s next?
- 26. • Click to edit Master text styles — Second level • Third level — Fourth level » Fifth level Click to edit Master title style Thank You Q&A*
Editor's Notes
- Poziom zaawansowania polskich bankowości
- Malware related task are on the rise Huge media coverage of malware related topics They steal real money (we’ve seen it!) Emerging market of anti-malware solutions Statistics
- Limitation for each method Bots can simulate everything There are no 100% malware-proof solutions But at least they should be properly implemented
- Pay shitload of money for a malware detection box (top secret military grade i can’t tell you about technology)? Better call your crew Do not trust vendors. Test your countermeasures. Hybrid approach Strategy, not snake oil
- Don’t bullshit a bullshitter
- Robimy to?