Screen Capture Trojans Penetrate Bank Security

In hopes of fighting Internet fraud, some online banking sites make customers use “virtual keypads” — a method of entering passwords on the screen, generally with a mouse.The system is designed to thwart keystroke-logging programs that capture everything a user types. Now those virtual keypads appear just as vulnerable to snoops.

A Spanish security company, Hispasec Systems, has revealed details of “Trojan horse” programs that can capture video imagery of an unsuspecting person’s computer use. If the user enters a PIN on a bank’s virtual keypad, the dastardly program is a witness.

Like most Trojan horses, the ones detected by Hispasec are slipped onto users’ computers when they visit certain Web sites, often through spam links, said Hispasec researcher Bernardo Quintero. Often, users have no clue if they were hit. When Quintero’s group tested whether more than 30 anti-virus programs would block a recent video-logging Trojan, only six did so.

Gartner Inc. security analyst Avivah Litan said screen-capture programs that attacked virtual keypads emerged as early as 2003, when banks in Brazil fell prey. She said the technique has remained relatively rare because the programs consume a lot of bandwidth and storage, and there have tended to be a lot of easier targets.

But that may be changing. Quintero said Wednesday that a newly detected Trojan combines keystroke-logging and video-capture functions — and instead of recording the entire screen, the program just grabs images of the immediate area near where the user clicks the mouse. The spy receives a smaller file, making the attack easier to pull off.

All this points to an enduring security truth: No single measure — especially one that is apparent to fraud artists — is likely to guarantee safety.

Litan says banks would be wise to focus more resources on behind-the-scenes software that can analyze Web banking sessions to gauge their legitimacy.

“Banks should stop implementing patchwork solutions and get it right the first time,” she said.

source: The Associated Press