Attackers use Ramnit malware to target Steam users
ID: IRCNE2013081933
Date: 2013-08-20
According to "computerworld", a new variant of the Ramnit financial malware is using local Web browser injections in order to steal log-in credentials for Steam accounts, according to researchers from security firm Trusteer.
Ramnit is a computer worm first discovered in 2010 that spreads by infecting executable, HTML and Microsoft Office files on the local computer.
The malware can steal browser cookies and FTP (File Transfer Protocol) credentials stored locally, but it also hooks the browser process in order to modify Web forms and inject rogue code into Web pages, a technique known as a man-in-the-browser (MitB) attack.
The MitB functionality is commonly used by financial malware to trick online banking users into exposing their personal and financial information as well as their online banking credentials.
Security researchers from Trusteer, a company that's in the process of being acquired by IBM, recently identified a new Ramnit variant that targets users of Steam, one of the largest digital distribution and online multiplayer platforms for computer games.
Cybercriminals have targeted Steam accounts by using key-logging malware and phishing attacks before. However, Ramnit uses more advanced techniques like Web injection.
According to Maor, when a user accesses the Steam Community log-in page and enters his or her username and password, the form is encrypted using the site's public key. To overcome this, Ramnit modifies the form in a way that allows it to capture the password in plain text. The user isn't able to tell that anything is wrong, because nothing changes on the log-in page.
When the user fills in the form and submits it, the malware intercepts the request, reads the data from the non-encrypted field and deletes the field before sending the request to the Steam Web server. According to Maor, this can hide the attack from security software that scans for unusual form elements in order to detect malware injections.
In the past, Ramnit has mainly targeted banks, but Trusteer researchers have already seen it being used to target customers of non-banking institutions, organizations and services, Maor said.