New data-theft attack technique can run across web

Share this article:

Researchers have detected a "new man-in-the-browser" (MITB) attack method that uses malware capable of stealing users bank or other sensitive information entered on websites.

As opposed to traditional MITB scams – where malware sitting on victims' computers is used to monitor a list of targeted websites and then pounces when users visit those sites – this technique allows criminals to draw victims' data from an unlimited pool of sites.

Trusteer discovered the threat in late August and posted a blog this week that details the scam.

George Tubin, senior security strategist at Trusteer, told SCMagazine.com on Wednesday that malware used in what the company dubbed "universal" MITB attacks pinpoints desired information, like credit card numbers, entered on any website -- and processes it immediately, rather than afterward, as in a traditional MITB scenario.

When using this new attack method, fraudsters don't have to parse through huge amounts of data or text collected over time, which leaves victims less opportunity to change their credit card details, passwords or other captured information.

“It doesn't matter what websites [victims] go to, it only matters if they use their credit card,” Tubin said. “The likelihood of success is significantly higher using this type of technique versus the traditional man-in-the-browser. When they get the card information, it's going to be fresher information.”

Trusteer researchers have not spotted many incidents of this technique being used, as it is still emerging, but did provide a video used by cyber criminals to market the attack method.

Zeus and SpyEye are examples of crimeware kits used in the universal MITB attacks. The malware often is loaded onto victims' machines through common phishing tactics or by taking advantage of unpatched browser vulnerabilities in drive-by download attacks.

“Browser security has never been done properly,” Tom Kellermann, vice president of cyber security at anti-virus firm Trend Micro, told SCMagazine.com on Wednesday. “[Attackers] are creating modules that fully automate the MITB process you used to have to do manually.”

In June, Trend Micro researchers released a report on a new technique, called an “automatic transfer system” (ATS), being used to commit financial fraud. This also was used to launch MITB attacks and to instantly intercept users' login details, while going undetected by victims.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

WikiLeaks makes FinFisher surveillance software available to public

Copies of controversial surveillance software, called "FinFisher," were made available for public scrutiny by WikiLeaks.

Researcher challenges reports that BlackPOS variant struck Home Depot

Nuix believes the malware found on Home Depot's systems belongs to a different threat family.

Documents reveal NSA plans to map every internet connected device in the ...

Documents provided by Edward Snowden reveal that the NSA is looking to build a near real-time map of every single internet-connected device in the world.