Common types of attacks on online banking
Online banking is very popular nowadays, because it allows users easy access to banking services. To access online banking users use Web browsers or mobile phones. And here come some threats, as users can be attacked via Web or via mobile phone in various ways. In this blog post I will assume that server side is secure (without any vulnerabilities) and enumerate and explain most common threats on user side. Those types of attacks can be classified as:
- Credential Stealing attack where attacker gains users login credentials using malicious software such as sniffers and keyloggers or through phishing. Additional verification such as two factor authentication helps in eliminating these threats.
- Channel Breaking attack involves manipulating the data when intercepting the communication channel between the bank server and user. It is also called man in the middle attack and it is still widely used because it is hard to prevent. User is, using social engineering, easily tricked into installing malicious software which enables full control to the attacker.
Some threats that are considered to be the most prevalent and the most dangerous to the financial services industry are explained here.
Phishing & Pharming
Phishing attacks are based on creating fake websites leading users to think they are visiting the legitimate website as usually. They are spread mostly using fake emails which look like a real company or which look like the bank sent them, but containing attackers website link. User has no indication that something is wrong but all information is sent to attacker.
In case of pharming, user sees the correct URL in browser because redirection is done by reconfiguration of users network settings.
Nowadays, banks use OTP authentication so even if attacker captures OTP data, there is only a short time period in which the data can be used. Because of that, they developed a new real time phishing attack which immediately initiates another secret session on the banks website with users stolen credentials.
Man in the Browser
While man-in-the-middle attack occurs at the protocol layer, this one infects only users browser with malware (Trojan) to "silently" modify transaction without asking the victim for anything. In MITB attack when user initiates transaction, the attacker modifies data such as transfer destination bank account and/or amount. On transaction confirmation, user doesnt notice the data changes because attacker modifies the bank server response so the user is tricked and authorizes the transaction. OTP authentication is not important to this type of attack and it is normally, without any suspicious, entered by user.
Source: "Secure Internet Banking Authentication", IEEE Security & Privacy, March/April, 2006.
One of the most famous malware is Zeus built in 2007. that runs only on versions of Windows operating systems. It is sold as ready to use tool, making it easy for novices to make and spread their malware.
Mobile malware
Mobile phones today are no different than standard computers so mobile malwares are able to monitor data that is transmitted through the device to banks server. The additional function of mobile malwares is capability to read users SMS and send it to attackers C&C server. Since many banks use OTP sent via SMS to the mobile device to authenticate logins and transactions, with this feature attacker can always use victims mobile banking account since he has access to it.Attackers are using same social engineering techniques to infect online users like convincing them to install a newly required security application.
Recently, in 2014., a new sophisticated malware has been detected, in a malicious app "Google Service Framework", called HijackRAT that is capable of:
- stealing and sending SMS messages (in case of re-routing OTP token messages)
- stealing contacts
- initiating malicious app updates
- scanning for legitimate banking apps installed and replacing them with fakes utilities
- disabling any mobile security software that might be installed.
In the end, there are many other types of threats which function in the same way with more or less advanced controls. Because of this, banking security must evolve and some of the security options are:
- Device fingerprinting: ability to look at a combination of identifiable computer or mobile hardware/software attributes and IP address.
- Transaction signing: requires the user to digitally sign each transaction using signing solutions such as public key infrastructure (PKI).
- Behavioral analytics: represents a way to detect pattern anomalies and suspicious activities by monitoring user session.
download file now