FB pixel

New Gozi Trojan can dupe some behavioral biometrics security measures


A new version of the Gozi banking trojan that is currently active in Japan, Spain, and Poland, has the ability to go undetected by some behavioral biometrics security measures, according to a report by Softpedia.

The new Gozi version targets a range of financial organizations including PayPal, CitiDirect BE, ING Bank, Société Générale, BNP Paribas, and the Bank of Tokyo.

This latest version of Gozi is not related to GozNym, another banking trojan that been circulating following last year’s leak of the Gozi source code, according to buguroo Threat Intelligence Lab.

Similar to the original Gozi strain, this new version uses Web injection attacks. GozNym also used Web injection attacks before eventually shifting over to redirection attacks in June.

Web injection attacks use the malicious DLLs loaded in the user’s browser to display overlays on top of a Web page when the victim visits a banking portal supported by the trojan’s modules.

Each Gozi module supports a Web injection package that displays a fraudulent page on top of the original banking portal, enabling a Web injection module to be assigned to each targeted financial institution.

These modules gather login credentials for the banking portal during the login process, but they can also overthrow the payment transfer page.

A few of these Web injection attacks can occur in real time, with the criminal deciding on what ‘mule’ account to redirect stolen money, and for what amount. Buguroo said it detected this kind of behavior in recent Gozi infections.

In other infections involving smaller accounts, the automated Gozi trojan selected a random mule account and fixed payment sum.

However, in cases where the trojan infected high-value targets, a human operator assumed the role and selected which “mule” account to redirect the money, and ultimately attempted to steal a higher sum.

As a defense tactic against banking trojans like Gozi, many banks have implemented behavioral biometrics solutions that record the speed and cadence at which users type and move the cursor between input fields.

Security experts at buguroo say that this new Gozi strain can also record these values to bypass these security measures.

“The malware uses these values to fill the necessary fields to perform the fraudulent transfer in what appears to be an attempt to bypass protection systems based on biometrics of user behavior,” said buguroo, which will deliver a presentation on the new Gozi strain at the Black Hat USA 2016 security conference in Las Vegas.

Article Topics

 |   |   |   |   | 

Latest Biometrics News


Asian banks deploy biometrics and digital ID for security, additional services

As digital identity gains prominence in a financial industry beset by fraud, nations in Asia are enabling banks to lead…


Mobile ID combats fraud, gives holder control of personal data: USPF report

The U.S. Payments Forum (USPF) has published a new white paper entitled “The Role of Mobile IDs in Payments.” Authored…


Wyoming plots mobile driver’s license launch for 2025

Wyoming is moving towards the issuance of digital ID in the form of an optional mobile driver’s license, but it…


EU publishes rollout schedule for AI Act

The European Union has published the final text of the Artificial Intelligence Act, outlining the most important deadlines for complying…


World Bank identifies priority actions for DPI in Equatorial Guinea

A World Bank team has identified immediate actions which the government of Equatorial Guinea should undertake in ramping up its…


Some sort of ID could be ‘inevitable’ for UK: lawmakers

The UK is still debating national identity documents and digital identities, with lawmakers and experts arguing that the creation of…


3 Replies to “New Gozi Trojan can dupe some behavioral biometrics security measures”

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Most Read This Week

Featured Company

Biometrics Insight, Opinion

Digital ID In-Depth

Biometrics White Papers

Biometrics Events