The arms race goes on and on. The folks at Trusteer recently found an evolved type of malware designed to game financial institutions’ two-factor authentication (2FA) mechanisms on compromised devices. This is Darwin at work, folks – why should attackers try to rob banks, when they can mug everyone who comes out with money? Whatever gun you have, they come back with a bigger one. This is fun, right?

Trusteer’s security team recently analyzed a Ramnit variant that is targeting a UK bank with a clever one-time password (OTP) scam. The malware stays idle until the user successfully logs into their account,..

The most interesting part is the reconnaissance and detailed understanding of the process and transaction types & formats required to successfully perform this attack. This is no smash and grab – it’s a very sophisticated set of technologies used to game a bank’s security controls.

2FA is still a good thing. But don’t think it’s the only thing, and definitely don’t think it makes you secure. Many of us learned that from the RSA hack, but for those who didn’t get the message the first time, your strong authentication isn’t strong enough. At least not all the time…

Photo credit: “Big Guns” originally uploaded by DM