Marketing Malware - cyber tools now more sinister . . .

TODAY’s cyber tools are more sinister, and a family of spyware and spynets has been upgraded to specifically target a financial institution or groups of institutions in a particular geographic area. Microsoft’s Richard Boscovich explains how the industry is fighting back . . .

BANK and financial Institutions are being targetted with increasing frequency by cyber criminals, who have stolen hundreds of millions of dollars from customer accounts.
It is estimated that in just one attack, using a malware known as Citadel, losses amounted to US$500 million over 18 months.
In October, the mastermind of Citadel, a 22-year-old Russian, Dimitry Belorossov, was sentenced to more than four years in prison after pleading guilty to conspiring to commit cybercrime by developing the notorious banking malware.
The sophisticated banking Trojan software infected up to 11 million computers worldwide. The US agency, the FBI, led the investigation, with Belorossov arrested in Spain.
The FBI said Belorossov provided “online assistance” in developing improvements and alterations to Citadel through postings on an underground hacker forum established to discuss his Citadel botnet.
The Citadel case illustrates just how blatant cyber criminals have become in openly marketing their malware. More significantly, cybercrime has become an industry of growing sophistication.
Banks are in the front line of the attacks. The anti-virus software company, Kaspersky, reported earlier this year that, in a campaign known as Carbanak, hackers attacked 100 banks located in 30 countries, including Australia, and stole up to US$1billion in what has been described as the largest bank heist ever.
Richard Boscovich, Assistant General Counsel of Microsoft’s Digital Crimes Unit, told ATI: “Over the past 12 months or so we have seen an evolution in how cyber criminals run their malware. They are running a more controlled model. Previously, they ran their financial Trojans from a very dispersed model, where they were just selling kits on the Internet.”
Citadel raised the level of sophistication to new heights. Boscovich says Citadel is sold as a base kit for a few thousand dollars.  It comes with a licensee key, and if buyers want more functionalities, for US$500 each they can buy modules for real time interception and obfuscation technology.  Citadel ran a hotline to answer questions, a webpage and a chat room through which buyers of the malware could pose problems and ask for direction. Boscovinch says they could also suggest improvements for both software and malware.
Before Citadel came Zeus and Spyeye, used by hackers to steal information on bank account holders.
Boscovich says the recent trend is to have more targetted attacks. “What I mean by that is that we have seen a family of malware and spynets upgraded. These include Shylock, which specifically targets a particular financial institution or groups of institutions in a particular geographic area.”
Shylock’s targets were UK financials. By the time Shylock was tracked down by multinational law enforcement agencies, including Europol, last year, it had already affected at least 30,000 Windows PCs across the world and stolen funds from victims’ online banking accounts.
“We think the principal code-writers of malware with this kind of sophistication are a relatively finite group, criminals who do this type of work,” says Boscovich.  “Then, there are people who purchase the malware, and those who resell it. These are much bigger groups that basically transcend jurisdiction.
“The development of malware has become pretty much international, although we still see the most sophisticated versions coming from Eastern Europe.  We are also seeing the developers coming from the US, the UK and Brazil.
Says Boscovich: “We are seeing more people starting to purchase codes for illegal purposes, and that is a very disturbing trend.
“Are we winning the war? That is kind of asking the same question as whether we can stop crime. What you can do is slow it down, make it more difficult, disturb the business model. It is expensive to operate the malware.”
He says the objective is to literally rip apart the malware infrastructure and to take away command of the affected computers.
Development of malware has made the task of protecting users harder for companies like Microsoft. In the past, says Boscovich, all that Microsoft had to do was to hit hacking with an anti-virus programme. Today’s cyber tools are more sinister.
He says: “We have started working with law enforcement agencies around the world to really get the message out there that our mission is to work with public and private partners to destroy malware infrastructure.”
Since 2010, Microsoft has been involved in seven major cases to take down botnets and to disrupt malware.  (A botnet, also known as a zombie army, is a number of Internet computers that have been optioned to forward transmissions, including spam and viruses, to other computers on the Internet, but without the knowledge of their owners.)
Microsoft’s most recent operation was several months ago against the botnet Simda. Microsoft is currently working on another
operation, details of which Boscovich did not disclose.
Cybercrimes are committed for profit, the malware having been written to steal money or credentials. Cyber criminals are more than hackers, who use different techniques — some not so sophisticated, others more sophisticated. Hackers exploit technical vulnerabilities in software.
Distributed denial of service (DDOS) attacks on banks are sometimes smoke screens for cyber criminals.
Boscovich says that when a bank is DDOSed, its primary function is to stay online for both customers and transactions. “It could well be that the DDOS attack is meant to distract the IT department of the bank, where people try to
infiltrate the IT codes. Or they want to have a DDOS attack that is big enough to come out in the news.”
When news breaks that a certain bank has suffered a DDOS attack, it gives the criminals an opportunity to send out spam email to customers to check their bank account. “When you read in the news that your bank has suffered a DDOS attack and you see an email, you would think that it must be a legitimate email and when you click on the link provided, you download malware.”
Today, Boscovich says, there is an holistic and more proactive approach to IT security to protect systems from attack.
Downloading updates, even for a brand new software, is the only way to protect your computer against attacks, he says.
Software companies now anticipate attacks, Microsoft, for example, puts its products through a very rigorous testing process including attacks to look for vulnerabilities and to make sure the system is as secure as possible.
“We do constant updates. We used to have our Patch Tuesdays (second Tuesday of the month). With Windows 10, we update all the time. If something has to be addressed we do it right away.
So we are accelerating the process to make sure that the operating system is always secure. That is a real step forward.”