ESET’s security experts recently discovered a new type of banking Trojan, BackSwap Bank Trojan, which uses three new technologies to steal funds from bank customers. Technology has never appeared on previous bank Trojans.
Generally speaking, bank Trojans will steal money from bank customers by adopting two main techniques: The first technique relies on changing local by intercepting requests related to bank websites and redirecting users to “clone sites” through proxies. DNS and Internet options settings where the attacker collects login credentials and acts as a middleman between the user and the bank; the second technique relies on injecting malicious code into the web page through the browser’s JavaScript console or directly when the user accesses the bank account Inject malicious code into the address bar.
Security experts said that the former technology has rarely been adopted, and the latter technology is currently the mainstream technology used by many popular banking Trojans, including Dridex, Ursnif, Zbot, Trickbot, and Qbot.
Although this technology has been popular with cybercriminals since its appearance, it has been very effective. However, after years of development, antivirus software vendors have modified their applications to scan for process injection attempts and have been able to detect these events well.
On the other hand, browser vendors have also made similar changes to their products to prevent bank Trojans from easily being able to eavesdrop on browser internal functions, which often allow Trojans to be inserted into the page content.
Nowadays, process injection technology is even more of a headache for the bank Trojan developers, because they must check and modify the injected code after each browser update. This is because the constant modification of the browser vendors can always make some of their previously written Malicious code becomes meaningless.
ESET revealed it discovered the BackSwap trojan, which came with three new techniques that are completely different from all previous trojans.
The first technology implemented by BackSwap allows Trojan horse programs to detect when users access online banking services. Malicious code uses a native Windows mechanism called “message loop.” Using this mechanism, an attacker can monitor the website that the user is currently visiting through a browser.
Security experts point out that the current version of BackSwap can be used for most popular browsers, such as Google Chrome, Mozilla Firefox, and Internet Explorer.
Once it detects that the browser is accessing and loading a bank-related website, BackSwap uses one of the following two techniques to tamper with the loaded content. For both technologies, the Trojan horse does not inject malicious code into the browser’s process but simulates keystrokes to execute JavaScript injections appropriate to the bank.
In the initial release (that is, the second technique), BackSwap inserts a malicious script into the clipboard and simulates pressing the key combination for opening the browser developer tool (CTRL + SHIFT + J in Google Chrome, Mozilla Firefox CTRL + SHIFT + K) and then simulate pressing CTRL + V to paste the contents of the clipboard into the browser developer tools and simulate pressing ENTER to execute this content (ie malicious script). Finally, BackSwap simulates pressing the key combination again to close the developer tools.
In the latest version (ie, the third technology), this technology has changed. BackSwap no longer interacts with the browser developer tools but instead executes malicious scripts directly from the browser address bar via the JavaScript protocol. It simulates pressing Ctrl + L to select the address bar, then simulates pressing DELETE to clear the URL field, by calling SendMessageA in the loop, typing “types” in “javascript:”, and impersonating the malicious script by pressing CTRL + V The code is pasted after the “javascript:” string. Finally, execute the script by simulating ENTER. At the end of this process, the address bar will be cleared to eliminate any signs of intrusion.
Security experts believe that the three new technologies used by BackSwap are easy to implement and very effective. They are likely to be adopted by other malicious software within a short period of time. The good news is that BackSwap currently only supports the alteration of the portals of five Polish banks – PKO Bank Polski, Bank Zachodni WBK SA, mBank, ING and Pekao.
Although BackSwap does not currently pose a global threat, ESET has stated that it has informed all major browser vendors about the three new technologies and hopes that they will adopt a targeted strategy in the launch of the new version. When these technologies are used by other malicious software, the damage caused by such attacks is mitigated.
