click to edit master text styles bypassing malware second level · 2018. 5. 11. · click to edit...

• Click to edit Master text styles

— Second level

• Third level— Fourth level

» Fifth level

Click to edit Master title style

Jakub Kałużny

Mateusz Olejarka

Bypassing malware detection mechanisms in online banking


— Second level


» Fifth level


• Pentesters @ SecuRing

• Ex-developers

• Experience with:

— E-banking and mobile banking systems

— Multi-factor and voice recognition authentication

— Malware post mortem

Who are we?

@j_kaluzny @molejarka


— Second level


» Fifth level


• Intro

— Why this topic?

— How it’s done?

— Will it blend?

• Vulnerabilities

• Conclusions

• Q&A*

Agenda


— Second level


» Fifth level


Intro


— Second level


» Fifth level


• AVs are not reliable

• Users are lazy

• Market gap for new solutions

• A lot of money

Why this topic ?


— Second level


» Fifth level


• Interaction with browser

— Web injects

— Other?

• What it does

— Steals credentials

— Changes transaction data

— Automates attacks

How malware works?

zeus

spyeye

carberp

citadel

zitmo

vbclip banatrix

carbanak

eblasterbugat

torpig

hiloti

gozi


— Second level


» Fifth level


Aim: Detect malware presence

What is online malware detection ?

BACKENDWEB

SERVERBROWSER

USER

MALWARE

HTTP TRANSACTIONS

signatures

fingerprint

User/browserbehaviour fraud detection system

Action: drop or mark as compromised

(JS)


— Second level


» Fifth level


Malware detection methods:

• HTTP response signature

• Browser fingerprint

• User/browser behavior

• Server-side behavioral methods

• Fraud detection system

What are the limits ?

marketingmagic

auditability


— Second level


» Fifth level


• We do not represent any vendor

• We want to show

— architecture failures

— implementation errors

• We want to talk about what can be done

What is the purpose of this report?


— Second level


» Fifth level


Vulnerabilities


— Second level


» Fifth level

Click to edit Master title styleOur approach

BACKENDWEB

SERVERBROWSER

USER

MALWARE

HTTP TRANSACTIONS

feed analyze JS

analyze traffic

analyze response


— Second level


» Fifth level


HTTP traffic

First idea

clean machineaction

system

infected machine

action


— Second level


» Fifth level


HTTP traffic + JS analysis

Going through…

clean machineaction

system

infected machine

action

+ js analysis:

• Different paths• Different subdomains

• Different data format (e.g. base64)• Encryption (e.g. rsa)


— Second level


» Fifth level

Click to edit Master title styleAlmost there…

clean machineaction

system

infected machine

action


— Second level


» Fifth level

Click to edit Master title styleIf it bleeds, we can kill it

clean machineaction

system

infected machine

action

BYPASSED!


— Second level


» Fifth level

Click to edit Master title styleArchitecture problem

useraction

systemantimalware

magic

red light

green light

Words of wisdom: adverse inference


— Second level


» Fifth level

Click to edit Master title styleMalware spotted!

useraction

systemantimalware

magic

red light

Who sends the alert ?

login: user1time: …behaviour: suspicious

login: user2?


— Second level


» Fifth level

Click to edit Master title styleFirst things first

useraction

systemantimalware

magic

red light

JavaScript slowing your page ? BYPASSED!


— Second level


» Fifth level

Click to edit Master title styleSecurity by obscurity

malware detection JavaScript

eval

Simple obfuscation – base64, hex

rsa encryption

signatures

reasoning engine

Web Service

rsa public key


— Second level


» Fifth level

Click to edit Master title styleSignatures server-side

browser server

website A please

HTML + JS malware detection

Fragments of website A

Hey, your website A is webinjected !

regexp for website A


— Second level


» Fifth level

Click to edit Master title styleSignatures client-side

browser server

website A please

HTML + JS malware detection

Hash of web injects signatures content

web injects signatures

Leaks your malware signatures

The output is your weakness


— Second level


» Fifth level


Conclusions


— Second level


» Fifth level


• Buy an anti-malware box?

• Better call your crew

• Trust, but verify

• Ask for technical details

Conclusions - banks


— Second level


» Fifth level


• Online malware detection is a good path,behavioral systems are a future of ITsec

• But they are still based on the old HTTP + HTML + JS stack

• Think about architecture and implementation

Conclusions – vendors


— Second level


» Fifth level


• Recommendations for potential anti-malwarebuyers – paper, work in progress

• Interested? -> [email protected] or [email protected]

What’s next?

mailto:[email protected]

mailto:[email protected]


— Second level


» Fifth level


Thank You

Q&A*

click to edit master text styles bypassing malware second level · 2018. 5. 11. · click to edit...

Documents