New Gozi Trojan can dupe some behavioral biometrics security measures

A new version of the Gozi banking trojan that is currently active in Japan, Spain, and Poland, has the ability to go undetected by some behavioral biometrics security measures, according to a report by Softpedia.

The new Gozi version targets a range of financial organizations including PayPal, CitiDirect BE, ING Bank, Société Générale, BNP Paribas, and the Bank of Tokyo.

This latest version of Gozi is not related to GozNym, another banking trojan that been circulating following last year’s leak of the Gozi source code, according to buguroo Threat Intelligence Lab.

Similar to the original Gozi strain, this new version uses Web injection attacks. GozNym also used Web injection attacks before eventually shifting over to redirection attacks in June.

Web injection attacks use the malicious DLLs loaded in the user’s browser to display overlays on top of a Web page when the victim visits a banking portal supported by the trojan’s modules.

Each Gozi module supports a Web injection package that displays a fraudulent page on top of the original banking portal, enabling a Web injection module to be assigned to each targeted financial institution.

These modules gather login credentials for the banking portal during the login process, but they can also overthrow the payment transfer page.

A few of these Web injection attacks can occur in real time, with the criminal deciding on what ‘mule’ account to redirect stolen money, and for what amount. Buguroo said it detected this kind of behavior in recent Gozi infections.

In other infections involving smaller accounts, the automated Gozi trojan selected a random mule account and fixed payment sum.

However, in cases where the trojan infected high-value targets, a human operator assumed the role and selected which “mule” account to redirect the money, and ultimately attempted to steal a higher sum.

As a defense tactic against banking trojans like Gozi, many banks have implemented behavioral biometrics solutions that record the speed and cadence at which users type and move the cursor between input fields.

Security experts at buguroo say that this new Gozi strain can also record these values to bypass these security measures.

“The malware uses these values to fill the necessary fields to perform the fraudulent transfer in what appears to be an attempt to bypass protection systems based on biometrics of user behavior,” said buguroo, which will deliver a presentation on the new Gozi strain at the Black Hat USA 2016 security conference in Las Vegas.

Article Topics

banking  |  behavioral biometrics  |  biometrics  |  financial services  |  fraud  |  security