The media often feeds public hysteria with scare stories about online banking fraud and other types of internet scams. While most are rooted in truth, the attacks are often simplistic and easily blocked via a combination of server security measures and user vigilance about sharing personal information. Moreover, financial institutions assure consumers that their latest security precautions and best use education will protect from the majority of devious attackers who wish do plunder bank accounts. But what if there were a trojan/virus/malware so sophisticated that it could steal your money in the middle of a transaction without the customer, bank or even the secure connection method detecting suspicious activity? Enter the Silentbanker.
What is a “Silent Banker”?
The Silentbanker is a sophisticated Trojan horse program that installs itself on a target computer and intercepts confidential information entered during online banking sessions. Stolen information can be then transmitted to the attacker or used to steal money from the victim’s account. There have been several flavours of Silentbanker, with the more recent versions using rootkit software to avoid detection by antivirus programs.
Once installed, Silentbanker can perform several man-in-the-middle attacks on infected computers
- Cookies and authentication certificates can be certified before being encrypted, allowing the attacker to authenticate a login using stolen information. Both simple logins and two-factor authorization can be defeated. Even transaction authentication number (TAN) protection can be targeted
- While processing a money transfer, silentbanker can intervene to change the destination account to the attacker’s account, causing the victim to transfer money to the attacker without any warning
- The Trojan continually updates itself by downloading configuration files containing host names and authentication routines for hundreds of banks worldwide
Silentbanker can work over an SSL connection, making the browser’s verification that the victim is on a “secure” (https://) connection meaningless.
How to detect and Remove Silentbanker
Silentbanker can be manually removed but experts recommend this only be performed by seasoned computer users. As of writing, the following security programs claim to detect and automatically remove Silentbanker:
- Norton Antivirus
- Malwarebytes’ Anti-Malware
How to Protect against Silentbanker and Similar Attacks
The simplest and only 100% effective way to protect against Silentbanker and similar Trojans is to never bank online. This solution is infeasible for some (e.g. those who are a great distance from the nearest branch) and highly inconvenient for others. Moreover, cutting off the online banking channel would not protect the consumer from the myriad of other bank-related fraud schemes that have little or nothing to do with consumer internet usage.
However, there are still actions users can take to greatly reduce the chance of being targeted by Silentbanker and its future derivatives.
1) Use only trusted machines. If possible, use only one private computer to access online banking. This machine should be one the user can scan regularly and install the software mentioned in the other following suggestions. Public computers (kiosks, libraries, Internet cafes, etc) can be very risky depending on the administrators’ security policies. Corporate computers are usually protected by blanket security solutions but the IT department may not be quick enough at rolling out patches and updates.
2) Do not use Internet Explorer for secure web transactions. Silentbanker manifests as a BHO (browser helper object) that only works with IE. Despite the many security patches issued by Microsoft, IE remains susceptible to this type of attack. Alternative browsers include Firefox, Opera and Google Chrome.
3) Install anti-Malware / antivirus software and update it regularly. Please see the article “Challenges of Internet Security – Your Best Weapons” for more information.
4) Install a firewall. Also see the above article for more information.
5) Create a Windows restore point. Once you are sure your computer is free of Silentbanker and similar programs, create a system restore point
- Click on the start button and select Start > All Programs > Accessories > System Tools > System Restore
- Click on the radio button “Create a restore point”. Click on the Next button
- Verify and record the date of the restore point (Windows usually stores several). Click on the Next button
- Confirm the summary information. Click on the Next button
Windows will save all the systems settings and create a restore point. If your machine is infected in the future, enter the same System restore tool and select the “Restore” radio button. Select the date you recorded earlier and Windows will reverse any system changes back to that date, effectively erasing the infection
Two warnings related to #5:
a) Restoring the system to an earlier date will also reverse any software upgrades or installations performed since that date
b) Restoring the system can also restore other viruses and other malware. Windows prevents antivirus systems from cleaning data inside the system restore folder. It is recommended to either (1) BEFORE creating the new restore point, temporarily disable Windows’ restore feature so that the antivirus software can clean older restore data, or (2) Delete all the windows restore points before the “clean” one that was just created
Sphere: Related Content
Recent Comments