Cyber criminals have been busy developing webinjects for Zeus and SpyEye to orchestrate and develop malevolent attacks against certain brands. Webinjects are malware configuration directives that are used to inject rogue content into the Web pages of bank websites to steal confidential information from the institution’s customers. It’s not a contained problem, as IBM has discovered that these webinjects are being offered for sale on the online underground market.
The Underground Market: Come One, Come All
Investigations reveal that these shrewd developers are earning a decent income from selling the Zeus/SpyEye webinject services to an increasingly diverse customer base. The really interesting element is that they’re not too concerned whether the customer has the skills to use it. In fact, they’d probably prefer that they didn’t since the developers have gone to the trouble of obfuscating the Zeus/SpyEye webinjects not because they want to confuse malware researchers, but because they want to prevent the piracy of their software.
This means, ironically, that these criminals are actually taking steps to protect their own intellectual property — I suppose they have to do something since they can’t resort to litigation.
Because webinjects can’t be modified by customers, if they need localization for a specific country and language, this can only be carried out by the developers, who are only too willing to do so — for a price:
However, resale is rife. Those who have purchased a copy of webinject are openly reselling their version to anyone that wants to steal the same information from victims:
From the advertisements we’ve seen, there are multiple targets, including British, Canadian, American and German banks. The prospective customer can see a detailed description of the type of information that can be stolen from each brand, almost like ordering from a catalog.
[onespot-mobile-content]
Worryingly, the prices are pretty reasonable. According to the website advertisements:
- One webinject pack…………………………………………………………60 WMZ/LR
- U.K. webinject pack……………………………………………………….800 WMZ/LR
- U.S. webinject pack……………………………………………………….740 WMZ/LR
- Updating/modification of webinjects……………………………………..20 LR each
These prices are in WebMoney/Liberty Reserve units (1 WMZ/LR is equivalent to 1 USD).
On one of the forums, we even found an advertisement for the large pack of webinjects (19 MB) being sold for just $15-20:
Anyone with malevolent intentions and a bit of spare cash can bag themselves a bargain on the underground market — you’ve been warned.
View on-demand webinar: Cybercriminals Never Sleep
CTO, Trusteer, an IBM company