Download April 2011

VIRUS BULLETIN www.virusbtn.com
cannot initiate the authentication because they need the
victim to enter his PIN on the smartcard reader. The only
vulnerability we foresee is race attacks, where the signed
authentication challenge could be intercepted by the
cybercriminals and sent to the bank by them before the
victim. This protocol can probably be improved.
In the future, mobile phones could act as smartcard readers
as long as their SIMs have the capability to store a keypair
and the phone features a secure keyboard.
3. CONCLUSION
In this two-part series, we have shown how cybercriminals
related to the Zeus gang have stolen online banking
credentials, even in cases where the bank sends an mTAN to
the end-user’s mobile phone.
We have provided an in-depth analysis of the malicious
mobile component, Zitmo, which infects Symbian mobile
phones. We have explained how the trojan intercepts all
incoming SMS messages. Using a disassembler tool with
a Symbian remote debugger and configuring a sane phone
to act as the attacker, we have stepped through Zitmo’s
malicious code and revealed the entire process of SMS
interception and handling. This technique even succeeded
in helping us display a debug window the malware authors
had hidden.
We have also covered how the cybercriminals probably
wrote Zitmo. During our research, we noticed a very similar
piece of spyware and found that Zitmo was closely related
to it, with a high percentage of identical routines and strings.
So, the motivation, implementation and inspiration of Zitmo
have all been explained. On a technical note, Zitmo’s reverse
engineering is fully completed. Future work should probably
keep an eye on SpyEye, which is seen as a rising successor to
Zeus. Some other aspects would also be worth investigating
more closely, such as countermeasures or cybercriminality.
Research into countermeasures would mean testing
solutions based on malicious behaviour detection,
firewalling or anti-virus capabilities in real-life
environments. Research could also be conducted on
reviewing challenge-based authentication protocols and
proving them formally against Zeus/Zitmo attacks. As
for cybercriminality, several points are still unknown (or
undisclosed), such as how many online bank accounts were
stolen, how much the cybercriminals traded the accounts
for, and to whom, and of course, the identity of the gang.
ACKNOWLEDGEMENTS
We thank Guillaume Lovet (Fortinet) for his technical
and in-depth review, and Ludovic Apvrille (Telecom
10
APRIL 2011
ParisTech) for useful comments on the article structure.
Finally, we thank David Barroso (s21sec) for kindly sharing
information regarding Zeus and Zitmo.
REFERENCES
[1]
Apvrille, A.; Yang, K. Defeating mTANs for profit
– part one. Virus Bulletin, March 2011, p.6.
http://www.virusbtn.com/pdf/
magazine/2011/201103.pdf.
[2]
Payu, S. Silent Receiving of SMS Messages.
October 2008. http://symbian.devtricks.mobi/tricks/
silent_receiving_of_sms_messages/.
[3]
Barroso, D. ZeuS Mitmo: Man-in-the-mobile.
September 2010. http://securityblog.s21sec.com/
2010/09/zeus-mitmo-man-in-mobile-i.html.
[4]
Tarasov, D. SMS Monitor User Manual.
http://dtarasov.ru/smsmonitor_manual_en.html.
[5]
Apvrille, A. Zitmo Follow Up: From Spyware to
Malware. September 2010. http://blog.fortinet.com/
zitmofollow-up-from-spyware-to-malware/.
[6]
Campbell, I. Symbian OS Communications
Programming. Symbian Press. John Wiley & Sons
Ltd, 2nd edition, 2007.
[7]
BiNPDA. SecMan Security Manager v1.1, 2008.
http://free-mobilesoftware. mobilclub.org/software/
QuickHackKit.php.
[8]
Tarasov, D. Evil-coding Symbian. xakep
magazine, 3, 2009. http://www.xakep.ru/magazine/
xa/123/096/1.asp (in Russian).
[9]
Bose, A.; Hu, X.; Shin, K. G.; Park, T. Behavioral
Detection of Malware on Mobile Handsets. 6th
International Conference on Mobile Systems,
Applications, and Services (MobiSys’08). June
2008.
[10] Xie, L.; Zhang, X.; Seifert, J.-P.; Zhu, S. pBMDS:
A Behavior-based Malware Detection System
for Cellphone Devices. 3rd ACM Conference on
Wireless Network Security (WiSec’10). March
2010.
[11] Yan, G.; Eidenbenz, S.; Galli, E. SMS-watchdog:
Profiling social behaviors of SMS users for
anomaly detection. RAID, volume 5758 of Lecture
Notes in Computer Science, pp.202–223, 2009.
[12] Enck, W.; Ongtang, M.; McDaniel, P. On
Lightweight Mobile Phone Application
Certification. 16th ACM Conference on Computer
and Communications Security (CCS’09).
November 2009.