Home > Resources > Whitepapers > ZARATHUSTRA: Extracting WebInject Signatures from Banking Trojans

ZARATHUSTRA: Extracting WebInject Signatures from Banking Trojans

Modern trojans are equipped with a functionality, called WebInject, that can be used to silently modify a web page on the infected end host. Given its flexibility, WebInject-based malware is becoming a popular information-stealing mechanism. In addition, the structured and well-organized malware-as-a-service model makes revenue out of customization kits, which in turns leads to high volumes of binary variants. Analysis approaches based on memory carving to extract the decrypted webinject.txt and config.bin files at runtime make the strong assumption that the malware will never change the way such files are handled internally, and therefore are not future proof by design. In addition, developers of sensitive web applications (e.g., online banking) have no tools that they can possibly use to even mitigate the effect of WebInjects. WebInject-based trojans insert client-side code (e.g., HTML, JavaScript) while the targeted web pages (e.g., online banking website, search engine) are rendered on the browser. This additional code will capture sensitive information entered by the victim (e.g., one-time passwords) or perform other nefarious actions (e.g., click fraud or search engine result poisoning). The visible effect of a WebInject is that a web page rendered on infected clients differs from the very same page rendered on clean machines. We leverage this key observation and propose an approach to automatically characterize the WebInject behavior. Ultimately, our system can be applied to analyze a sample automatically against a set of target websites, without requiring any manual action, or to generate fingerprints that are useful to determine whether a client is infected. Differently from the state of the art, our method works regardless of how the WebInject module is implemented and requires no reverse engineering. We implemented and evaluated our approach against live online websites and a dataset of distinct variants of WebInject-based financial trojans. The results show that our approach correctly recognize known variants of WebInject-based malware with negligible false positives.

Spotlight

Cavu Networks

Worry-free Computer Services for businesses in and around Seattle, Bainbridge Island, and Poulsbo, Wa. Cavu Networks is dedicated to providing dependable Computer Services to businesses that want to increase efficiency and their bottom lines. With our holistic approach to Network design, delivery and support you can rest easy, knowing that your technology is safe, secure and running smoothly. Our experienced professionals provide you with IT consulting which is of high-value.

OTHER WHITEPAPERS

Zero Trust Maturity Model

whitePaper | April 28, 2023

The Cybersecurity and Infrastructure Security Agency (CISA) leads the nation’s effort to understand, manage, and reduce cybersecurity risk, including by supporting Federal Civilian Executive Branch agencies in evolving and operationalizing cybersecurity programs and capabilities. CISA’s Zero Trust Maturity Model (ZTMM) provides an approach to achieve continued modernization efforts related to zero trust within a rapidly evolving environment and technology landscape. This ZTMM is one of many paths that an organization can take in designing and implementing their transition plan to zero trust architectures in accordance with Executive Order (EO) 14028 “Improving the Nation’s Cybersecurity” § (3)(b)(ii),1 which requires that agencies develop a plan to implement a Zero Trust Architecture (ZTA). While the ZTMM is specifically tailored for federal agencies as required by EO 14028, all organizations should review and consider adoption of the approaches outlined in this document.

2023 Cloud Security Trends | Sponsored by AWS Marketplace

whitePaper | January 18, 2023

In the past few years, major cloud providers are improving their security controls for customers and increasing visibility into their security solutions. Emerging trends such as endpoint detection and response and Zero Trust have focused the security community on the capabilities and services of both cloud and solution providers.

API Security: Best Practices for Vulnerability Mitigation

whitePaper | June 6, 2023

API Security: Best Practices for Vulnerability Mitigation provides a hands-on approach to mitigate security vulnerabilities in APIs. The paper emphasizes the importance of implementing security measures that protect the API and underlying infrastructure. The paper identifies various security vulnerabilities that can arise in APIs and provides detailed guidelines for securing them. These guidelines cover authentication, authorization, input validation, output encoding, error handling, logging, and auditing.

Security Protocol and Data Model (SPDM) Architecture White Paper

whitePaper | September 26, 2022

This white paper presents an overview of the SPDM architecture, its goals, and a high-level summary of its use within a larger solution. The intended target audience for this white paper includes readers interested in understanding the use of SPDM to facilitate security of the communications among components of platform management subsystems.

Threat Connect Cyber Survey Report

whitePaper | January 4, 2022

Whether you are in financial services, farming, or public infrastructure, the security threat to organizations has never been greater. Today, almost every company is a technology company in some shape or form and this can be a soft underbelly - open to attack. Cyber risk is the fastest-growing risk faced by businesses globally. A wide range of statistics and sources make it clear that attackers have become even more proficient over recent years, using automation to exploit vulnerabilities at an accelerated pace and frequency. Threats are even more widespread and complex than before.

Adobe Primetime Advertising Security Overview

whitePaper | December 30, 2022

At Adobe®, we take the security of your digital experience and assets seriously. Security practices are integrated into our internal software development processes, operations, and tools. Our cross-functional incident response teams are proactive and nimble in preventing, detecting, and responding to incidents. Furthermore, our collaborative work with partners, leading researchers, and other industry organizations helps us stay updated with the latest threats, vulnerabilities, and security best practices; thereby enabling us to continually build security into the products and services we offer and regularly incorporate advanced security techniques into our product and service offerings.

ZARATHUSTRA: Extracting WebInject Signatures from Banking Trojans