Phishin’ Hole | TechSNAP 113

chris

9 years ago

We’ll go inside some clever bank malware, a dedicated server provider our very own Allan uses discovers a backdoor…

Plus: Picking the right virtual machine storage, a big batch of your questions, and much much more!

Thanks to:

GoDaddy.com

Use our code tech249 to score .COM for $2.49!

32% off your ENTIRE first order just use our code go32off3 until the end of the month!

Direct Download:

RSS Feeds:

Support the Show:

Purchase anything at Amazon.com
Purchase anything at Think Geek using this link
Purchase anything at Newegg using this link
Contribute directly on our donation page or check out our advertising options and reach millions of amazing people!
Grab our Chrome Extension and auto-tag your shopping session for us!

Show Notes:

Get TechSNAP on your Android:

Browser Affiliate Extension:

Jupiter Broadcasting Affiliate Extensions for Chrome and Firefox

Inside the Malware

Security researcher Sherri Davidoff profiles the Blackhole exploit kit
Walking us step by step through what the malware does once your computer is infected
It starts with a simple phishing email, in this example just a plain email that says “Hi, as promised your photos.” with a link
The unsuspecting user follows the link, and nothing much seems to happen and they continue about their day
In actuality, their computer has not been infected with the Blackhole exploit kit
A few days later, while visiting the website of their bank, the user is prompted by the page to verify their identity. Over a short period of time, the attack, using a man-in-the-browser attack, was able to gain:
- The victim’s name
- Phone number
- Answers to security questions
- RSA token
The attacker then used this information to wire themselves $49,500 out of the victim’s bank account
However, because this was a large corporate account, the bank requires a second person to authorize such a transfer
The attacker used the MITB attack to ask the victim for the name of that second person, which the user entered
The attacker then asked for the email address of the second person, however the user got suspicious, called the bank and the account was quickly frozen
Once the blackhole exploit kit is installed on a computer, it loads updates and then continues to phone home once every 20 minutes, using a simple HTTP POST request
The researcher also managed to capture a Man-In-The-Browser attack on video, when attempting to login to the BankofAmerica site, the infected computer injects a page after the user submits the login form, but before the information is actually sent to the bank
The injected page claims that the bank does “not recognize” your computer and asks you for a number of details, including your debit card number, social security number, date of birth and mother’s maiden name
These details are not sent to the bank, but rather to the attacker, who can use them later to drain your account
In more sophisticated attacks using this technique, the attacker is actually communicating with your system live, in order to take advantage of the information as you enter it, such as passing on to the victim the secret questions they are prompted for when trying to send a wire transfer
This also allows the attackers, in the situation where they are actively monitoring your computer when you are attempting to access your account, to take advantage of temporary information such as the output of your RSA security token

Dedicated server provider Hetzner finds backdoor

Administrators at Hetzner discovered a backdoor on their nagios monitoring server
After further investigation, they discovered that their web interface for managing dedicated servers (called the Hetzner Robot) had also been infected
This means some personal details of customers, including name, email address, phone number, hashed password, last 3 digits of credit card number, credit card type and expiration date
The actual card number is never stored by Hetzner, it is passed directly to the payment processor who returns a unique token that is used to reference that card in the future
However, customers using direct debit (debit note) from their bank account, may have been compromised. While the information is stored encrypted in the Hetzner database, the key may have been compromised
Passwords were SHA256 hashed with a salt, but it does not sound like they used sha256crypt
“The malicious code used in the “backdoor” exclusively infects the RAM. First
analysis suggests that the malicious code directly infiltrates running Apache
and sshd processes. Here, the infection neither modifies the binaries of the
service which has been compromised, nor does it restart the service which has
been affected.”
Hetzner has hired an external security company to do a more indepth investigation
English FAQ