Zeus, SpyEye Trojans Back to Attacking Banks in Real Time

Posted 2012-06-21

By: Robert Lemos





However, cyber-criminals were not daunted. They quickly moved to compromising the browser, monitoring communications and modifying transactions on the fly and hiding them from the victim's view. Known as a man-in-the-browser attack, the technique allows online thieves to continue to steal money but they had to monitor the system to be able to use the time-dependent passcode before it expired.

"Time is critical," said Kellerman. "The reason that two-factor authentication is successful against hackers is because it's time-dependent and it is something you know. Attackers eliminated the time variable because they can do it in real time."

With the capabilities to automate the transfers using custom modules that can anticipate the target bank's security checks, criminals are now back to the good old days, where money can be transferred automatically and in smaller amounts that may not set off the financial institution's alarms. As the developers continue to improve their code, defenders will need to come up with new ways of slowing down the theft.

"It's about a level of sophistication that is consistently growing and outpacing our defensive mechanisms," said Kellerman. "This is not about one attack or one campaign but about full automation for stuff that used to take days and lots of time."

Rocket Fuel