RSA recently discovered a new malware variant it dubbed Prinimalka-Gozi, which reportedly will be used in a massive, coordinated attack on U.S. banks called Project Blitzkrieg. After analyzing Prinimalka-Gozi, IBM Security determined that it is a distant relative of the Gozi malware. According to our findings, the installation and HTML injection designation method it uses resembles Gozi. However, many implementation details such as the format of the HTML injection, certain configuration elements and the machine code injected into the browser process appear to be completely different than those of Gozi.

According to the RSA report regarding the planned Trojan attack campaign, criminals will first steal victims’ online banking credentials and account balances and then clone their computers using a novel virtual-machine-syncing module. Later, botmasters will prioritize their targets according to account balances. Last, a session will be initiated from the cloned remote computer and proxied through the victim’s machine to take on the genuine (victim) IP address when authenticating to the online banking site.

Krebs on Security posted a detailed article on this cyber criminal campaign, named Project Blitzkrieg by its alleged mastermind, “vorVzakon.” The article provides the following quote from a blog post by VorVzakon: “The goal — together, en-masse and simultaneously process large amounts of the given material before anti-fraud measures are increased.”

Why Existing Anti-Fraud Measures Fail to Prevent Project Blitzkrieg

Back in 2005, the Federal Financial Institutions Examination Council mandated that banks enhance their security controls beyond the static username and password authentication scheme for online banking login in its “Authentication in an Internet Banking Environment” guidance. However, many U.S. banks still use static credentials. High operational costs and poor user experience have deterred many U.S. banks from implementing strong authentication. Instead, banks have deployed other server-based anti-fraud measures, such as device fingerprinting.

The new device-cloning feature included in Prinimalka-Gozi (i.e., virtual-machine-syncing module) is specifically designed to aid in evading device-fingerprinting fraud prevention solutions. This feature allows fraudsters to create a cloned computer with settings identical to those of the victim’s device — including the same device fingerprint. Fraudsters can also route or proxy all Web communication from the cloned computer through the victim’s device by using the victim’s IP address. The net effect is that both the device and IP address seem to belong to the genuine user (victim).

Some device-fingerprinting solutions have added features that can alert the bank when a proxy is being used. However, since proxies are also used for legitimate purposes (e.g., in enterprises and public networks), this feature alone will generate many false alarms.

Furthermore, the attack tactics used by Prinimalka-Gozi may change over time. Once the criminals have an end user’s genuine login credentials, they do not necessarily have to proxy all communication through the victim’s device. Fraudulent transactions can be submitted from a cloned device on a new IP or a new device. Since many users switch computers and access online banking while traveling, device-fingerprinting solutions cannot prevent the submission of all transactions from a new device or location.

Protecting Against Project Blitzkrieg

Unlike device fingerprinting and other clientless fraud prevention mechanisms, IBM Security takes a different approach with a clientless solution that combines device fingerprinting, proxy detection and malware infection detection. When a user infected with malware accesses an online banking site protected by IBM Security Trusteer Pinpoint Malware Detection, it identifies the infection and malware type (e.g., “User Steve is infected with Prinimalka-Gozi”), alerts the bank and flags the user’s credentials as compromised.

Once notified, banks can immediately contact the end users to have them install IBM Security Trusteer Rapport, which will remove the malware. IBM Security Trusteer Pinpoint Criminal Detection also fingerprints the device and checks for the use of proxies. Users accessing the online banking application from a new device — or a proxied device — shortly after malware was detected on their endpoint is a strong indication of account takeover fraud.

For end users who have already installed Trusteer Rapport, we have validated that Trusteer Rapport protects against the Prinimalka-Gozi malware by removing it from infected machines and preventing data theft, such as form grabbing and HTML injection. For endpoints that do not have Trusteer Rapport installed, we have validated that Trusteer Pinpoint identified machines infected with Prinimalka-Gozi.