Webinjects for Sale on the Underground Market

Cyber criminals have been busy developing webinjects for Zeus and SpyEye to orchestrate and develop malevolent attacks against certain brands. Webinjects are malware configuration directives that are used to inject rogue content into the Web pages of bank websites to steal confidential information from the institution’s customers. It’s not a contained problem, as IBM has discovered that these webinjects are being offered for sale on the online underground market.

The Underground Market: Come One, Come All

Investigations reveal that these shrewd developers are earning a decent income from selling the Zeus/SpyEye webinject services to an increasingly diverse customer base. The really interesting element is that they’re not too concerned whether the customer has the skills to use it. In fact, they’d probably prefer that they didn’t since the developers have gone to the trouble of obfuscating the Zeus/SpyEye webinjects not because they want to confuse malware researchers, but because they want to prevent the piracy of their software.

This means, ironically, that these criminals are actually taking steps to protect their own intellectual property — I suppose they have to do something since they can’t resort to litigation.

Because webinjects can’t be modified by customers, if they need localization for a specific country and language, this can only be carried out by the developers, who are only too willing to do so — for a price:

Because webinjects can

However, resale is rife. Those who have purchased a copy of webinject are openly reselling their version to anyone that wants to steal the same information from victims:

Those who have purchased a copy of webinject are openly reselling their version to anyone that wants to steal the same information from victims

From the advertisements we’ve seen, there are multiple targets, including British, Canadian, American and German banks. The prospective customer can see a detailed description of the type of information that can be stolen from each brand, almost like ordering from a catalog.

Worryingly, the prices are pretty reasonable. According to the website advertisements:

  • One webinject pack…………………………………………………………60 WMZ/LR
  • U.K. webinject pack……………………………………………………….800 WMZ/LR
  • U.S. webinject pack……………………………………………………….740 WMZ/LR
  • Updating/modification of webinjects……………………………………..20 LR each

These prices are in WebMoney/Liberty Reserve units (1 WMZ/LR is equivalent to 1 USD).

On one of the forums, we even found an advertisement for the large pack of webinjects (19 MB) being sold for just $15-20:

On one of the forums, we even found an advertisement for the large pack of webinjects (19 MB) being sold for just $15-20.

Anyone with malevolent intentions and a bit of spare cash can bag themselves a bargain on the underground market — you’ve been warned.

View on-demand webinar: Cybercriminals Never Sleep

Share this Article:
Amit Klein

CTO, Trusteer, an IBM company

As Trusteer’s CTO, Amit Klein is responsible for researching and introducing game changing technologies into Trusteer’s products, with particular focus on Turtseer’s enterprise solutions. Prior to that, Mr. Klein established, managed and grew the company’s security group, which is one of the world’s leading financial malware research groups. Prior to Trusteer, Mr. Klein was Chief Scientist at Cyota Inc. (acquired by RSA Security), a leading provider of layered authentication solutions. In this role, Mr. Klein researched technologies that prevent online fraud, phishing, and pharming and filed several patents in those areas. Prior to this, Mr. Klein worked as Director of Security and Research at Sanctum, Inc. (acquired by Watchfire, now part of IBM Security Systems), where he was responsible for the security content of all Sanctum products. Mr. Klein holds a B.Sc. (cum laude) in Mathematics and Physics from the Hebrew University of Jerusalem (through IDF’s Talpiot programme). Mr. Klein is a world-renowned security researcher, having published more than thirty articles, papers and technical notes on the topic of Internet security. He was named CTO of the Year by InfoWorld Magazine and has presented at many prestigious conferences including RSA US, FSISAC, OWASP, Microsoft BlueHat, InterOp USA, AusCERT and CertConf.