Transaction Generators: Root Kits for Web By: Collin Jackson, Dan Bonch, John Mitchell Presented by Jeff Wheeler

Outline Current Phishing Attacks –Focused on stealing user credentials Response –Stronger Authentication and back end analytics Anticipated Attack Vector –Transaction Generator Malware Countermeasures –CAPTCHA, Randomized Transaction Pages, Transaction Confirmation

Current Phishing Attacks Steal User Credentials –Directing users to a spoofed web page –Key-logging

Crimeware-spreading URLs infecting PCs with password-stealing code rose 93 percent in Q1, 2008 to 6,500 sites. (apwg_report_Q1_2008)

The number of unique keyloggers and crimeware-oriented malicious applications detected rose to 430 in March (apwg_report_Q1_2008)

Response to Phishing Methods –Transaction authentication –Site-to-user authentication –Challenge questions –Device identification –Knowledge-based authentication (KBA) –Out-of-band authentication –Hardware tokens –Software and toolbar tokens –Transaction signing –CAP / EMV

Transaction Generator Malware Allows criminals to manipulate user accounts directly without stealing user credentials or subverting authentication mechanisms To the web site, a transaction generator looks identical to a legitimate transaction A transaction generator can hide its transactions

What does a Transaction Generator Do? Quietly sits on a user computer User authenticates Session cookie issued –Reside in application environment, and are fully accessible by malware Transaction Generator creates transactions

Additional work of a stealth Transaction Generator Hide transactions from users –Amazon purchase for blender Malware hides all references on order history page to anything containing the word blender –Credit card purchase to Amazon Hide all purchases from Amazon on recent transactions for the blender purchase amount Transactions are hidden through the malware, the site providing information is unaware the user does receives incorrect information

Uses of a Transaction Generator Pump and dump stock schemes –Boost the price of penny stocks Purchasing goods –When one blender is not enough Election system fraud –Voting at home systems Financial theft –Bill pay to transfer money

Countermeasures CAPTCHA –Create code to compute response –Use ChaCha type network of solvers Randomized Transaction pages –Increase difficulty of hiding unauthorized transactions Transaction Confirmation

Confirmation agent is isolated from malware, either via VM or separate hardware A browser extension to function as a relay between the confirmation agent and the remote site Verification via key exchange Security relies on 2 properties –The agents secret key must be isolated from malware –Malware must be prevented from injecting mouse clicks into the agents dialog

Ideal Solution Prevent malware from getting into the browser