Password Stealer is the new 'critical alert'???

Cybercriminals are constantly distributing various types of malware based on their objectives, which are often monetary. While Ransomware is a common means to this goal, holding data for ransom is not the only means of monetizing malware distribution. Companies are constantly trying to gain as much consumer browsing information as possible in order to target advertisements and mine user data; however, information that is intended to be secret-is even more valuable. There is a booming black market for stolen passwords within criminal communities, making malware that obtains these passwords profitable to distribute. The widespread use of software that stores passwords (from browsers for instance), and password management solutions compound the problem even more since a large number of passwords are already sitting on many users’ computers just waiting to be stolen.

The Evolution of Password Theft

Prior to the availability and popularity of storing passwords for convenience, stealing passwords would require infecting a user with malware that logs keystrokes and transmits this data over the network at regular intervals. While this technique is still used, the anomalous network traffic it produces increases the likelihood of discovering the malware before many-if any-passwords would have been stolen. With the advent and increasing usage of saving passwords; however, malware can simply break whatever security mechanism is protecting the passwords and upload them all at once. This makes detection more difficult at the network level since there’s only one burst of traffic to detect before the passwords have been exfiltrated, unlike with keyloggers where periodic transmission creates time and patterns to detect the malicious traffic.

Regardless of the means, once passwords have been stolen they can be monetized based on what they provide access to. Banking passwords are obviously the most easily monetized since criminals can simply attempt to transfer funds from your account to theirs, but even email and social media passwords have value. The majority of email and social networking accounts provide access to a larger number of users that can be spammed or phished directly, plus email addresses for these users may be available, which can also be added to lists and sold to spammers. Hacked email accounts are also commonly used to attempt to scam saved contacts by impersonating the account owner and claiming to be stranded abroad, requiring money to return home. Windows passwords may also be targeted, not only for the potential of re-use with accounts for which the password isn’t saved, but also for potential access to corporate networks and resources when business computers are compromised.

As with malware in general, password stealers have a variety of distribution methods, most of which involves phishing emails containing an attachment or URL. Since it is much easier and more cost-effective to detect malicious attachments on the email server itself than a user’s computer, a variety of different file types and distribution methods are used to try to evade this sort of security, especially the more naive approaches such as simply blocking certain file types. Password stealers may be compressed in any number of archive formats to evade file type blocking-sometimes using fake file extensions that will still allow the file to be opened in the desired archive software.

It is also common, however, to utilize trusted file types to evade server detection and download the malware payload when the user executes the file. Microsoft Word and Excel documents with macros that download password stealers are quite common and can be more difficult to detect than sending the payload itself. While these have the drawback that the macro must be run by the user, social engineering is used to attempt to get the user to do this.

To recap, the techniques being used in these attacks are:

Phishing: Attackers send emails that encourage recipients to open attachments containing malicious content.

Impersonation: Malicious attachments are disguised as official documents such as important tax forms.

Avoiding Detection: Attackers use trusted file types like Word and Excel to hopefully evade server detection.

Take Action:

User Security Training and Awareness - Employees should be regularly trained and tested to increase their security awareness of various targeted attacks. Simulated attack training is by far the most effective form of training.

Layering employee training with an email security solution that offers sandboxing and advanced threat protection should block malware before it ever reaches the corporate mail server. And, for additional protection against messages that contain malicious links, you can deploy anti-phishing protection that includes Link Protection to look for links to websites that contain malicious code. Links to these compromised websites are blocked, even if those links are buried within the contents of a document.

Real-Time Spear Phishing and Cyber Fraud Defense - Barracuda Sentinel is a cloud service that utilizes AI to learn an organization’s communications history and prevent future spear phishing attacks. It combines three powerful layers: an artificial intelligence engine that stops spear phishing attacks in real time and identifies the most high-risk individuals inside the company; domain fraud visibility using DMARC authentication to guard against domain spoofing and brand hijacking; and fraud simulation training for high-risk individuals.

Anshuman Singh
Senior Director Product Management, Application Security, Barracuda Networks