Project Blitzkrieg: How to Block the Planned Prinimalka-Gozi Trojan Attack

RSA recently discovered a new malware variant it dubbed Prinimalka-Gozi, which reportedly will be used in a massive, coordinated attack on U.S. banks called Project Blitzkrieg. After analyzing Prinimalka-Gozi, IBM Security determined that it is a distant relative of the Gozi malware. According to our findings, the installation and HTML injection designation method it uses resembles Gozi. However, many implementation details such as the format of the HTML injection, certain configuration elements and the machine code injected into the browser process appear to be completely different than those of Gozi.

According to the RSA report regarding the planned Trojan attack campaign, criminals will first steal victims’ online banking credentials and account balances and then clone their computers using a novel virtual-machine-syncing module. Later, botmasters will prioritize their targets according to account balances. Last, a session will be initiated from the cloned remote computer and proxied through the victim’s machine to take on the genuine (victim) IP address when authenticating to the online banking site.

Krebs on Security posted a detailed article on this cyber criminal campaign, named Project Blitzkrieg by its alleged mastermind, “vorVzakon.” The article provides the following quote from a blog post by VorVzakon: “The goal — together, en-masse and simultaneously process large amounts of the given material before anti-fraud measures are increased.”

Why Existing Anti-Fraud Measures Fail to Prevent Project Blitzkrieg

Back in 2005, the Federal Financial Institutions Examination Council mandated that banks enhance their security controls beyond the static username and password authentication scheme for online banking login in its “Authentication in an Internet Banking Environment” guidance. However, many U.S. banks still use static credentials. High operational costs and poor user experience have deterred many U.S. banks from implementing strong authentication. Instead, banks have deployed other server-based anti-fraud measures, such as device fingerprinting.

The new device-cloning feature included in Prinimalka-Gozi (i.e., virtual-machine-syncing module) is specifically designed to aid in evading device-fingerprinting fraud prevention solutions. This feature allows fraudsters to create a cloned computer with settings identical to those of the victim’s device — including the same device fingerprint. Fraudsters can also route or proxy all Web communication from the cloned computer through the victim’s device by using the victim’s IP address. The net effect is that both the device and IP address seem to belong to the genuine user (victim).

Some device-fingerprinting solutions have added features that can alert the bank when a proxy is being used. However, since proxies are also used for legitimate purposes (e.g., in enterprises and public networks), this feature alone will generate many false alarms.

Furthermore, the attack tactics used by Prinimalka-Gozi may change over time. Once the criminals have an end user’s genuine login credentials, they do not necessarily have to proxy all communication through the victim’s device. Fraudulent transactions can be submitted from a cloned device on a new IP or a new device. Since many users switch computers and access online banking while traveling, device-fingerprinting solutions cannot prevent the submission of all transactions from a new device or location.

Protecting Against Project Blitzkrieg

Unlike device fingerprinting and other clientless fraud prevention mechanisms, IBM Security takes a different approach with a clientless solution that combines device fingerprinting, proxy detection and malware infection detection. When a user infected with malware accesses an online banking site protected by IBM Security Trusteer Pinpoint Malware Detection, it identifies the infection and malware type (e.g., “User Steve is infected with Prinimalka-Gozi”), alerts the bank and flags the user’s credentials as compromised.

Once notified, banks can immediately contact the end users to have them install IBM Security Trusteer Rapport, which will remove the malware. IBM Security Trusteer Pinpoint Criminal Detection also fingerprints the device and checks for the use of proxies. Users accessing the online banking application from a new device — or a proxied device — shortly after malware was detected on their endpoint is a strong indication of account takeover fraud.

For end users who have already installed Trusteer Rapport, we have validated that Trusteer Rapport protects against the Prinimalka-Gozi malware by removing it from infected machines and preventing data theft, such as form grabbing and HTML injection. For endpoints that do not have Trusteer Rapport installed, we have validated that Trusteer Pinpoint identified machines infected with Prinimalka-Gozi.

Share this Article:
Amit Klein

CTO, Trusteer, an IBM company

As Trusteer’s CTO, Amit Klein is responsible for researching and introducing game changing technologies into Trusteer’s products, with particular focus on Turtseer’s enterprise solutions. Prior to that, Mr. Klein established, managed and grew the company’s security group, which is one of the world’s leading financial malware research groups. Prior to Trusteer, Mr. Klein was Chief Scientist at Cyota Inc. (acquired by RSA Security), a leading provider of layered authentication solutions. In this role, Mr. Klein researched technologies that prevent online fraud, phishing, and pharming and filed several patents in those areas. Prior to this, Mr. Klein worked as Director of Security and Research at Sanctum, Inc. (acquired by Watchfire, now part of IBM Security Systems), where he was responsible for the security content of all Sanctum products. Mr. Klein holds a B.Sc. (cum laude) in Mathematics and Physics from the Hebrew University of Jerusalem (through IDF’s Talpiot programme).Mr. Klein is a world-renowned security researcher, having published more than thirty articles, papers and technical notes on the topic of Internet security. He was named CTO of the Year by InfoWorld Magazine and has presented at many prestigious conferences including RSA US, FSISAC, OWASP, Microsoft BlueHat, InterOp USA, AusCERT and CertConf.