Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
A Russian-speaking botmaster is offering a hosted service that allows fraudsters to steal banking credentials without hassle of complex infrastructure.
The outsourced service allowed fraudsters to rent a botnet and gain direct access to victims without the need to setup or maintain the infrastructure. Malware could then be delivered straight to victim machines.
The vendor's bot, compiled from a known banking trojan that spread through social networks, was seemingly large and diverse enough for the man-in-the-middle service.
Customers could issue a specific payload to be delivered to victims chosen according to their country and banking institution. The payload would be injected into a banking session where account information could be stolen and sent to the customer.
The attacks would be coupled with live support from the botmaster operator.
Clients could also attempt to hijack the target machine using an additional remote control component provided by the vendor.
However the service had drawbacks including limited use of bots, that it targets only one victim at a time, and the need for the vendor to be available during the attacks, according to RSA's fraud expert Limor Kessem who received an email from the vendor spruiking the scheme.
“Another side to this service offer is that the fraudster has to be available in real time to those demanding his assistance, unlike man-in-the-browser attacks and automated scripts,” Kessem said. “Hands-on fraud schemes are time-consuming and can only target one victim at a time.”
Alternatively, fraudsters have for years purchased Remote Desktop Protocol credentials.
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.