Bypassing Malware Detection Mechanisms in Online Banking
summary
Tests of JavaScript- and server-side detectors against real malware traffic show practical bypasses: feeding protected sites captured infected traffic and then cut traffic to malicious subdomain so the detector never reports an alert; extracting the public RSA key in page JS and forge RSA-signed alerts to confuse analysts; and exploiting client-side reporting by returning the initial array values as clean to hide injections. Behavioral checks also fail when a bot types slowly to mimic humans or when heavy JS loads after login.
AI-written summary · about
chapters (9)
- 0:00Introduction and agenda
- 3:37Market gap for anti-malware
- 5:57Client-side detection methods
- 8:20Limits of current solutions
- 10:22Vulnerability case study
- 13:24Alert system flaws
- 17:05Deep dive into signatures
- 23:40Recommendations for buyers
- 27:50Q&A and concluding thoughts
related talks
52mFlying Under the Radar - New Security Evasion Techniques
52mBreaking Fraud and Bot Detection Solutions
10mState of the Malware
53mProtecting Crypto Exchanges From A New Wave Of MitB Attacks
43mBackground Story of "Operation neutralizing banking malware"
40mHostile JavaScript: Attacking and Defending the Browser
38mCaught My WebApp Cheating on Me!
35mBreaking fraud & bot detection solutions