Form grabbing
Form grabbing is a form of malware that works by retrieving authorization and log-in credentials from a web data form before it is passed over the Internet to a secure server. This allows the malware to avoid HTTPS encryption. This method is more effective than keylogger software because it will acquire the user’s credentials even if they are inputted using virtual keyboard, auto-fill, or copy and paste.[1] It can then sort the information based on its variable names, such as e-mail, account name, and password. Additionally, the form grabber will log the URL and title of the website the data was gathered from.[2]
History
The method was invented in 2003 by the developer of a variant of a Trojan Horse virus called Downloader.Barbew, which attempts to download Backdoor.Barbew from the Internet and bring it over to the local system for execution. However, it was not popularized as a well-known type of malware attack until the emergence of the infamous banking Trojan, Zeus, in 2007.[3] Zeus was used to steal banking information by man-in-the-browser keystroke logging and form grabbing. Like Zeus, the Barbew Trojan was initially spammed to large numbers of individuals through e-mails masquerading as big-name banking companies.[4] Form grabbing as a method first advanced through iterations of Zeus that allowed the module to not only detect the grabbed form data but to also determine how useful the information taken was. In later versions, the form grabber was also privy to the website where the actual data was submitted, leaving sensitive information more vulnerable than before.[5]
Known occurrences
A spyware named “MP-Formgrabber” makes it possible to grab all browser form data from Firefox, Chrome, Windows Explorer and Opera.[6] Users can download free versions and log in through the panel to inject browsers and decrypt the host to log in to other websites. Another software called Weyland-Yutani BOT was the first software designed to attack Mac OS platform and can work on Firefox. The web injects templates in Weyland-Yutani BOT are different from existed ones such as Zeus and SpyEye.[7]
Countermeasures
Due to the recent increase in key-logging and form-grabbing, Antivirus companies are adding additional protection to counter the efforts of key-loggers and prevent collecting passwords. These efforts have taken different forms varying from Antivirus companies, such as safepay, password manager, and others.[1] To further counter form grabbing, users' privileges can become limited which would prevent them from installing Browser Helper Objects(BHO) and other form grabbing software. Administrators should create a list of malicious servers to their firewalls.[2]
See also
- Keystroke logging
- Malware
- Trojan horse
- Web security exploits
- Computer insecurity
- Internet privacy
- Tiny Banker Trojan
References
- ^ a b "Capturing Online Passwords and Antivirus." Web log post. Business Information Technology Services, 24 July 2013.
- ^ a b Graham, James, Richard Howard, and Ryan Olson. Cyber Security Essentials. Auerbach Publications, 2011. Print.
- ^ *Shevchenko, Sergei. "Downloader.Berbew." Symantec, 13 Feb. 2007.
- ^ *Abrams, Lawrence. "CryptoLocker Ransomware Information Guide and FAQ." Bleeding Computers. 20 Dec. 2013.
- ^ *"Form Grabbing." Web log post. Rochester Institute of Technology, 10 Sept. 2011.
- ^ "MP-Formgrabber Formgrabbing Tools on All Major Browser." Web log post. CasperSpy. Botnet for Cybersecurity Defence, 31 Aug. 2013.
- ^ Kruse, Peter. "Crimekit for MacOSX Launched." Web log post. Canadian Security Intelligence Service, 02 May 2011.