RSA recently discovered a new malware variant they dubbed Prinimalka-Gozi which is reported will be used in a massive coordinated attack on US banks. Trusteer's analysis of Prinimalka-Gozi does indicate that it is a distant relative of the Gozi malware. According to the company's findings, the installation and HTML injection designation method it uses resembles Gozi. However, many implementation details such as the format of the HTML injection, certain configuration elements and the machine code injected into the browser process appear to be completely different than those of Gozi.
According to the RSA report regarding the planned Trojan Attack campaign, criminals will first steal the victim’s online banking credentials and account balance, and clone their computer using “A novel virtual-machine-synching module”. Later botmasters will prioritize their targets according to account balances. Lastly, a session will be initiated from the cloned remote computer and proxied through the victim’s machine to take on the genuine (victim) IP address when authenticating to the online banking site.
Krebs on Security posted a detailed article on this cybercriminal campaign which is being called "Project Blitzkrieg” by its alleged mastermind vorVzakon. The article provides the following quote from a blog post by vorVzakon: “The goal – together, en-masse and simultaneously process large amount of the given material before anti-fraud measures are increased”.
Why existing anti-fraud measures fail to prevent this attack?
Back in 2005, the FFIEC through its “Authentication in an Internet Banking Environment” guidance mandated that banks enhance their security controls beyond the static username-and-password authentication scheme for online banking login. Yet, many US banks still use static credentials. High operational costs and poor user experience have deterred many US banks from implementing strong authentication. Instead, banks have deployed other server based anti-fraud measures like device fingerprinting.
The new device cloning feature included in Prinimalka-Gozi (i.e. “virtual-machine-synching module”) is specifically designed to aid in evading device fingerprinting fraud prevention solutions. This feature allows fraudsters to create a cloned computer with settings identical to those of the victim’s device – including the same device fingerprint. It also allows the fraudsters to route/proxy all web communication from the cloned computer through the victim’s device, using the victim’s IP address. The net effect is that both device and IP address seem to belong to the genuine user (victim).
Some device fingerprinting solutions have added features that can alert the bank when a proxy is being used. However, since proxies are also used for legitimate purposes (e.g. in enterprises and public networks) this feature alone will generate many false alarms.
Furthermore, the attack tactics used by Prinimalka-Gozi may change over time. Once the criminals have an end user’s genuine login credentials they do not necessarily have to proxy all communication through the victim’s device. Fraudulent transactions can be submitted from a cloned device on a new IP or a new device. Since many users switch computers and access online banking while traveling, device fingerprinting solutions cannot prevent the submission of all transactions from a new device or location.
Protecting against Project Blitzkrieg
Unlike device fingerprinting and other clientless fraud prevention mechanisms, Trusteer Pinpoint takes a different approach. Trusteer Pinpoint is a clientless solution that combines device fingerprinting, proxy detection and malware infection detection. When a user infected with malware accesses an online banking site protected by Trusteer Pinpoint Malware Detection, it identifies the infection and malware type (e.g. “User Steve is infected with Prinimalka-Gozi”), alerts the bank and flags the user’s credentials as compromised.
Once notified, banks can immediately contact the end user to have them install Trusteer Rapport which will remove the malware. Trusteer Pinpoint Account Takeover Detection also fingerprints the device and checks for the use of proxies. Users accessing the online banking application from a new device, or a proxied device, shortly after malware was detected on their endpoint is a strong indication of account takeover fraud.
For end users that have already installed Trusteer Rapport, we have validated that Rapport protects against the Prinimalka-Gozi malware by removing it from infected machines and preventing data theft (e.g. form grabbing and HTML injection). For endpoints that do not have Trusteer Rapport installed, we have validated that Trusteer Pinpoint identified machines infected with Prinimalka-Gozi.