August 19, 2013 By Etay Maor 3 min read

When cyber criminals use Man-in-the-Browser (MitB) malware to commit online fraud, financial institutions are not their only targets. Dating, e-commerce, hospitality and travel sites are also being attacked, as is the gaming industry. While some cyber criminals focus on hacking into gaming company networks — for example, the PlayStation Network, Club Nintendo, Ubisoft and Konami — others use sophisticated malware to steal client credentials.

Target: Steam

The IBM Trusteer security team recently identified a new configuration of the Ramnit malware, which uses HTML injection to target Steam, the largest digital distribution platform for online gaming. In this attack, Ramnit successfully circumvents the site’s password encryption while defeating server-side detection of the attack.

With an estimated 50-70 percent market share, more than 2,000 titles and over 54 million active users, Steam is the perfect target for malware attacks. This is not the first time the platform has been targeted by cyber criminals, either; phishing attacks and credential-stealing malware have been targeting Steam users for several years now. Ramnit, however, uses much more advanced techniques to collect data and evade detection.

The IBM Trusteer security team identified the following code in Ramnit’s configuration file:

When a user accesses the Steam community log-in page and enters his or her username and password, the form is encrypted using the site’s public key. To overcome this client-side encryption, Ramnit injects a request for the password, which allows it to capture the data in plain text. The injection of this element, denoted as “pwd2,” can be seen in the second part of the code shown above:

Intuitive Malware

While this simple technique is good for overcoming the client-side encryption, it also raises an issue: Steam’s server is not expecting to receive this new element (“pwd2”) when the form is submitted, so it doesn’t know what to prevent. In fact, some security solutions detect MitB malware by looking for forms with injected elements. For example, if a form with a username and password is filled out by the user and sent to the website, the security product will scan to look for unknown elements that may indicate HTML injection malware. If the form arrives at the website with a username, password and credit card number, this will trigger an alarm indicating the user was a victim of a MitB attack.

To avoid detection, Ramnit simply makes sure the server never sees the injection by removing the injected element prior to the form being sent to the website. This can be observed in the first part of the code:

Why do cyber criminals go through all the trouble of injecting an element and then removing it when they can simply collect the data using Ramnit’s key-logging capability? The answer is simple: By using form grabbing, the cyber criminal can easily index the collected data. When a key-logger is used, there is no indication of which characters denote the username, which belong to the password and which ones are just irrelevant keystrokes. In such a case, someone needs to manually separate the wheat from the chaff.

While Ramnit uses MitB malware and evasion techniques to steal sensitive data from Steam and other organizations, Trusteer Rapport and Trusteer Pinpoint Malware Detection can detect, mitigate and remediate Ramnit infections. The IBM Tusteer security team continues to investigate new malware variants, understand their techniques and capabilities, and update its solutions in order to provide effective protection against the latest threats.

View on-demand webinar: Cybercriminals Never Sleep

More from Banking & Finance

PixPirate: The Brazilian financial malware you can’t see

10 min read - Malicious software always aims to stay hidden, making itself invisible so the victims can’t detect it. The constantly mutating PixPirate malware has taken that strategy to a new extreme. PixPirate is a sophisticated financial remote access trojan (RAT) malware that heavily utilizes anti-research techniques. This malware’s infection vector is based on two malicious apps: a downloader and a droppee. Operating together, these two apps communicate with each other to execute the fraud. So far, IBM Trusteer researchers have observed this…

New Fakext malware targets Latin American banks

6 min read - This article was made possible thanks to contributions from Itzhak Chimino, Michael Gal and Liran Tiebloom. Browser extensions have become integral to our online experience. From productivity tools to entertainment add-ons, these small software modules offer customized features to suit individual preferences. Unfortunately, extensions can prove useful to malicious actors as well. Capitalizing on the favorable characteristics of an add-on, an attacker can leverage attributes like persistence, seamless installation, elevated privileges and unencrypted data exposure to distribute and operate banking…

DORA and your quantum-safe cryptography migration

5 min read - Quantum computing is a new paradigm with the potential to tackle problems that classical computers cannot solve today. Unfortunately, this also introduces threats to the digital economy and particularly the financial sector.The Digital Operational Resilience Act (DORA) is a regulatory framework that introduces uniform requirements across the European Union (EU) to achieve a "high level of operational resilience" in the financial services sector. Entities covered by DORA — such as credit institutions, payment institutions, insurance undertakings, information and communication technology…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today