October 1, 2014 By Etay Maor 4 min read

In my last article, I discussed how cybercriminals defeat multifactor authentication. While different forms of authentication measures will continue to be used, we know today that advanced malware overcomes these by spoofing the victim’s behavior, proxying through the victim’s device or just downright asking the victim for his or her passwords using social-enginnering techniques.

Roughly 10 years ago, security vendors started working on solutions to the authentication issue and, thus, authentication risk engines were born. Today, there is a wide variety of risk engine flavors to choose from. Leading vendors offer what they call adaptive authentication platforms that offer multiple deployment models, integration options, application programming interfaces and management platforms that all have one very basic weakness: The solution was designed for the 2005 fraud threat landscape.

Today’s fraudsters have used a wide variety of tools and techniques to build all kinds of new fraud methods specifically intended to evade these adaptive solutions. The following is a look into how these risk engines are designed and the root cause for their failure in detecting today’s cybercriminals:

Why Statistical Models Are Failing

The three main issues with statistical-based risk engines are as follows:

  1. They increase investigation time and have an operational impact.
  2. They negatively impact the customer experience.
  3. Worst of all — and the root cause for the previous two issues — they provide inaccurate risk scores.

When statistical risk-based authentication models were introduced, they were based on the assumption that fraud could be prevented using simple authentication. This assumption allowed these products to identify a relatively high percentage of transactions as risky and perform elevated authentication for all of them. As threats have become more sophisticated and bypassing two-factor authentication has become common for cybercriminals, stopping fraud now requires more decisive action, such as putting the transaction on hold and manually reviewing high-risk and high-value transactions. Most traditional risk engines use a pure statistical model for risk scoring, such as Naïve Bayesian, Decision Trees and Neural Networks.

However, these statistical models rely heavily on device identification as their detection method. They lack visibility into risk factors and pre-login activity, such as the user visiting a phishing site or getting infected with advanced malware. They use a limited subset of the population and possible events as their learning platform and are designed to identify historical fraud tactics instead of protecting the account against the actual method of operation (modus operandi) used by the attacker.

The statistical models are inaccurate and operate in a predictive/pattern-based mode, tuned to generate alerts for a given percent of users. This results in a high rate of false positives and false negatives. Once this ratio is established, changes to the model are difficult and slow, constituting a significant barrier to rapid and effective handling in the evolving and constantly changing fraud landscape.

Cybercriminals Can Look Like Normal Users

Let’s take a look at one example where a traditional risk engine has little to no chance of detecting the cybercriminal’s attack.

Citadel malware has been around for several years. In addition to offering traditional Trojan tools such as a keylogger, screen scraper and HTML injection, Citadel also offers two very interesting modules: a Virtual Network Connection (VNC) option and a video-capturing option. The video-capturing option lets attackers make videos of the victim’s login process. Why would cybercriminals trouble themselves with making videos? This is a very easy way to learn about users’ behavior and how they interact with online banking sites. This allows cybercriminals to imitate and emulate victims’ behavior when trying to take over an account.

Combine the knowledge of how the user interacts with the website along with stolen credentials and the ability to proxy through the victim’s machine, and the attack is likely to be a success. The VNC module takes this idea a step further. The attacker can comfortably wait until a user has authenticated the online banking session, and as soon as the victim has entered his or her bank account, the cybercriminal VNCs into the targeted device (the user will see a message “from the bank” asking to pause for security reasons) and takes over the authenticated session using the victim’s machine.

This type of attack was so successful that new Citadel variants have a way to ensure VNC capabilities remain persistent on the targeted device even if the Citadel malware is removed, and the malware is also used to target enterprises and corporations as well as online banking victims.

Risk Engines: Is There a Better Way?

So what’s next? How can we fight back against the latest threats?

It seems that GameOver Zeus, Tinba, Gozi, Citadel and other types of Trojan malware are getting the best of us, so we need a new way to prevent these sophisticated attacks. An evidence-based criminal detection solution that is founded upon visibility to current threats, correlation of risk factors across multiple channels and attack vectors and the continuous research of future trends is the answer we need to combat the new world of Web fraud techniques.

By combining data from multiple account access points (such as online and mobile) along with additional threat detection systems (such as malware detection and phishing detection), an organization can benefit from a holistic solution that helps detect fraud across multiple vectors, devices and fraud techniques that may put the account at risk. This is all performed without burdening the end user with additional authentication requests while also minimizing false positive rates to assure the bank’s security team is not overloaded with investigating legitimate accesses.

Fraud teams are seeking a new approach to risk-based authentication solutions due to their typically inaccurate risk scores and their negative impact on both operations and end users. The next-generation approach to fraud prevention needs to use evidence-based fraud indicators to more accurately and effectively detect fraudulent transactions while improving the end-user experience and reducing the operational impact.

More from Fraud Protection

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Remote access detection in 2023: Unmasking invisible fraud

3 min read - In the ever-evolving fraud landscape, fraudsters have shifted their tactics from using third-party devices to on-device fraud. Now, users face the rising threat of fraud involving remote access tools (RATs), while banks and fraud detection vendors struggle with new challenges in detecting this invisible threat. Let’s examine the modus operandi of fraudsters, prevalence rates across different regions, classic detection methods and Trusteer’s innovative approach to RAT detection through behavioral analysis. A rising threat As Fraud detection methods become more and…

Gozi strikes again, targeting banks, cryptocurrency and more

3 min read - In the world of cybercrime, malware plays a prominent role. One such malware, Gozi, emerged in 2006 as Gozi CRM, also known as CRM or Papras. Initially offered as a crime-as-a-service (CaaS) platform called 76Service, Gozi quickly gained notoriety for its advanced capabilities. Over time, Gozi underwent a significant transformation and became associated with other malware strains, such as Ursnif (Snifula) and Vawtrak/Neverquest. Now, in a recent campaign, Gozi has set its sights on banks, financial services and cryptocurrency platforms,…

The rise of malicious Chrome extensions targeting Latin America

9 min read - This post was made possible through the research contributions provided by Amir Gendler and Michael  Gal. In its latest research, IBM Security Lab has observed a noticeable increase in campaigns related to malicious Chrome extensions, targeting  Latin America with a focus on financial institutions, booking sites, and instant messaging. This trend is particularly concerning considering Chrome is one of the most widely used web browsers globally, with a market share of over 80% using the Chromium engine. As such, malicious…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today