When cyber criminals use Man-in-the-Browser (MitB) malware to commit online fraud, financial institutions are not their only targets. Dating, e-commerce, hospitality and travel sites are also being attacked, as is the gaming industry. While some cyber criminals focus on hacking into gaming company networks — for example, the PlayStation Network, Club Nintendo, Ubisoft and Konami — others use sophisticated malware to steal client credentials.

Target: Steam

The IBM Trusteer security team recently identified a new configuration of the Ramnit malware, which uses HTML injection to target Steam, the largest digital distribution platform for online gaming. In this attack, Ramnit successfully circumvents the site’s password encryption while defeating server-side detection of the attack.

With an estimated 50-70 percent market share, more than 2,000 titles and over 54 million active users, Steam is the perfect target for malware attacks. This is not the first time the platform has been targeted by cyber criminals, either; phishing attacks and credential-stealing malware have been targeting Steam users for several years now. Ramnit, however, uses much more advanced techniques to collect data and evade detection.

The IBM Trusteer security team identified the following code in Ramnit’s configuration file:

When a user accesses the Steam community log-in page and enters his or her username and password, the form is encrypted using the site’s public key. To overcome this client-side encryption, Ramnit injects a request for the password, which allows it to capture the data in plain text. The injection of this element, denoted as “pwd2,” can be seen in the second part of the code shown above:

Intuitive Malware

While this simple technique is good for overcoming the client-side encryption, it also raises an issue: Steam’s server is not expecting to receive this new element (“pwd2”) when the form is submitted, so it doesn’t know what to prevent. In fact, some security solutions detect MitB malware by looking for forms with injected elements. For example, if a form with a username and password is filled out by the user and sent to the website, the security product will scan to look for unknown elements that may indicate HTML injection malware. If the form arrives at the website with a username, password and credit card number, this will trigger an alarm indicating the user was a victim of a MitB attack.

To avoid detection, Ramnit simply makes sure the server never sees the injection by removing the injected element prior to the form being sent to the website. This can be observed in the first part of the code:

Why do cyber criminals go through all the trouble of injecting an element and then removing it when they can simply collect the data using Ramnit’s key-logging capability? The answer is simple: By using form grabbing, the cyber criminal can easily index the collected data. When a key-logger is used, there is no indication of which characters denote the username, which belong to the password and which ones are just irrelevant keystrokes. In such a case, someone needs to manually separate the wheat from the chaff.

While Ramnit uses MitB malware and evasion techniques to steal sensitive data from Steam and other organizations, Trusteer Rapport and Trusteer Pinpoint Malware Detection can detect, mitigate and remediate Ramnit infections. The IBM Tusteer security team continues to investigate new malware variants, understand their techniques and capabilities, and update its solutions in order to provide effective protection against the latest threats.

View on-demand webinar: Cybercriminals Never Sleep