Wikipedia

Infostealer

Incomputing,infostealersare a form ofmalicious software,created to breachcomputer systemsto steal sensitive information—includinglogin details,financial information, and otherpersonally identifiable information.The stolen information is then packaged, sent to the attacker, and often traded on illicit markets to othercybercriminals.

Infostealers usually consist of two parts: the bot framework that allows the attacker to configure the behaviour of the infostealer on the victim's computer, and a management panel that takes the form of a server to which the infostealer sends data. Infostealers infiltrate devices throughphishingattacks, infected websites, and malicious software downloads, includingvideo game modsandpirated software,among other methods. Once downloaded, the infostealers gather sensitive information about the user's device and send the data back to the server.

Infostealers are usually distributed under the malware-as-a-service(MaaS) model, wheredevelopersallow other parties to use their infostealers for subscription fees. This allows people with different levels of technical knowledge to deploy an infostealer. The functionality of infostealers can vary, with some focused ondata harvesting,while others offerremote accessthat allows additional malware to be executed.Stolen datamay then be used inspearphishingcampaigns for other cyber-attacks, such as the deployment ofransomware.

The proliferation of infostealer-as-a-service providers has contributed to an increase in the number ofcybersecurityincidents involving infostealers. The number of stolendata logsbeing sold on the Russian Market, acybercrime forum,has increased significantly since 2022. According toKaspersky's research in mid-2023, 24% of malware offered as a service are infostealers.

Overview

edit
See also:Identity theft

Incybercrime,credential theft is a well-known mechanism through which malicious individuals stealpersonal informationsuch asusernames,passwords,orcookiesto illegitimately gain access to a victim's online accounts and computer. This crime typically unfolds in four stages, with the first being the acquisition of the stolen credentials. Infostealers are a specific type ofmalwarethat are designed for this initial stage. They usually consist of two distinct parts: the bot framework and acommand and control server,often known as the management panel or interface.[1]

The bot framework includes a builder that allows the attacker to configure how the infostealer will behave on a user's computer and what kind of information it will steal. The management interface, usually written in traditionalweb developmentlanguages likePHP,HTML,andJavaScript,[2]is typically hosted on the commercialcloud infrastructure.[3]The management interface primarily functions as aweb serverto which the infostealer sends confidential information. The interface also provides the attacker with information about the status of deployed infostealers and allows the attacker to control their behaviour.[2]

Distribution and use

edit

Infostealers are commonly distributed through the malware-as-a-service(MaaS) model, enabling individuals with varying technical knowledge to deploy these malicious programs. Under this model, three distinct groups typically emerge: developers, malware service providers, and operators. Developers, the most technically skilled, write the infostealer code. Malware service providers purchase licenses for the malware and offer it as a service to other cybercriminals. The operators, who can be developers or service providers themselves depending on their skill level, use these services to performcredential theft.[1]

Once the malware is purchased, it is spread to target victim machines using varioussocial engineeringtechniques.Phishing,includingspear phishingcampaigns that target specific victims, is commonly employed. Infostealers are commonly embedded inemail attachmentsor malicious links that link to websites performing drive-by downloads.[2][4]Additionally, they are often bundled with compromised or maliciousbrowser extensions,infectedgame mods,and pirated or otherwise compromised software.[4]After the stealer is downloaded and run by a victim, it communicates with the attacker'scommand-and-control servers,allowing the attacker to steal information from the user's computer. While most infostealers primarily target credentials, some also enable attackers to remotely introduce and execute other malware, such asransomware,on the victim's computer.[1][5]

Credentials obtained from infostealer attacks are often distributed as logs or credential dumps, typically shared on paste sites likePastebin,where cybercriminals may offer free samples, or sold in bulk on underground hacking forums, often for amounts as low as $10.[6][7]Buyers of these stolen credentials usually log in to assess their value, particularly looking for credentials associated with financial services or linked to other credentials with similar patterns, as these are especially valuable.[8]High-value credentials are often sold to other cybercriminals at higher prices,[9]who may then use them for various crimes, includingfinancial fraud,[10]integrating the credentials intozombie networksand reputation-boosting operations,[10]or as springboards for more sophisticated attacks such as scamming businesses, distributing ransomware, or conducting state-sponsored espionage.[11][6]Additionally, some cybercriminals use stolen credentials forsocial engineeringattacks, impersonating the original owner to claim they have been a victim of a crime and soliciting money from the victim’s contacts.[12][13]Many buyers of these stolen credentials take precautions to maintain access for longer periods, such as changing passwords and usingTor networksto obscure their locations, which helps avoid detection by services that might otherwise identify and shut down the stolen credentials.[12][13]

Features

edit

An infostealer's primary function is to exfiltrate sensitive information about the victim to an attacker'scommand-and-control servers.The exact type of data that is exfiltrated will depend on the data-stealing features enabled by the operator and the specific variant of infostealer used.[14]Most infostealers, however, do contain functionality to harvest a variety of information about the host operating system, as well as system settings and user profiles. Some more advanced infostealers include the capability to introduce secondary malware likeremote access trojansandransomware.[2]

In 2009, researchers at theSymantecRapid Response team released a technical analysis of theZeusinfostealer, one of the first infostealers to be created.[15]They found that the malware automatically exfiltrated all data stored in a computer's protected storage service (which was usually used byInternet Explorerto store passwords) and tries to capture any passwords sent to the computer using thePOP3andFTPprotocols. In addition to this, the malware allowed the researchers to define a set of configuration files to specify a list of web injections to perform on a user's computer as well as another configuration file that controlled which webURLsthe malware would monitor. Another configuration also allowed the researchers to define a set of rules that could be used to test if additionalHTTPrequests contained passwords or other sensitive information.[16]

More recently, in 2020, researchers at theEindhoven University of Technologyconducted a study analysing the information available for sale on the underground credentialblack marketimpaas.ru. As part of their study, they were able to replicate the workings of a version of theAZORultinfostealer. Amongst the functions discovered by the researchers was a builder, which allowed operators to define what kind of data would be stolen. The researchers also found evidence of plugins that stole a user'sbrowsing history,a customisableregex-based mechanism that allows the attacker to retrieve arbitrary files from a user's computer, a browser password extractor module, a module to extractSkypehistory, and a module to find and exfiltratecryptocurrencywallet files.[14]

The researchers also found that the data most frequently stolen using the AZORult infostealers and sold on the black market could be broadly categorised into three main types: fingerprints, cookies, and resources.Fingerprintsconsisted of identifiers that were constructed by probing a variety of features made available by the browser. These were not tied to a specific service but were considered to be an accurately unique identifier for a user's browsers.Cookiesallowed buyers tohijack a victim's browser sessionby injecting it into a browser environment. Resources refer to browser-related files found on a user's operating system, such as password storage files.[17]

Economics and impact

edit

Setting up an infostealer operation has become increasingly accessible due to the proliferation of stealer-as-a-service enterprises, significantly lowering financial and technical barriers. This makes it feasible for even less sophisticated cybercriminals to engage in such activities.[2]In a 2023 paper, researchers from theGeorgia Institute of Technologynoted that the hosted stealer market is extremely mature and highly competitive, with some operators offering to set up infostealers for as low as $12.[18]For the service providers running these stealer operations, the researchers estimated that a typical infostealer operator incurs only a few one-off costs: the license to use the infostealer, which is obtained from a malware developer, and the registration fee for the domain used to host thecommand-and-control server.The primary ongoing cost incurred by these operators is the cost associated with hosting the servers. Based on these calculations, the researchers concluded that the stealer-as-a-service business model is extremely profitable, with many operators achieving profit margins of over 90% with revenues in the high thousands.[19]

Due to their extreme profitability and accessibility, the number of cybersecurity incidents that involve infostealers has risen.[6]TheCOVID-19post-pandemic shift towardsremote and hybrid work,where companies give employees access to enterprise services on their home machines, has also been cited as one of the reasons behind the increase in the effectiveness of infostealers.[20][6]In 2023, research bySecureworksdiscovered that the number of infostealer logs—data exfiltrated from each computer—being sold on the Russian Market, the biggest underground market, increased from 2 million to 5 million logs from June 2022 to February 2023.[20]According toKaspersky's research in mid-2023, 24% of malware offered as a service are infostealers.[21]

References

edit

Citations

edit
  1. ^abcAvgetidis et al. 2023,pp. 5308
  2. ^abcdeAvgetidis et al. 2023,pp. 5308–5309
  3. ^Avgetidis et al. 2023,pp. 5314, 5319
  4. ^abNurmi, Niemelä & Brumley 2023,p. 1
  5. ^Ryan 2021,p. 76
  6. ^abcdNewman 2024
  7. ^Nurmi, Niemelä & Brumley 2023,p. 2
  8. ^Nurmi, Niemelä & Brumley 2023,p. 6
  9. ^Nurmi, Niemelä & Brumley 2023,p. 7
  10. ^abNurmi, Niemelä & Brumley 2023,p. 8
  11. ^Muncaster 2023
  12. ^abOnaolapo, Mariconti & Stringhini 2016,p. 65,70,76
  13. ^abBursztein et al. 2014,p. 353
  14. ^abCampobasso & Allodi 2020,pp. 1669
  15. ^Grammatikakis et al. 2021,pp. 121
  16. ^Nicolas & Chien 2009,pp. 3–4
  17. ^Campobasso & Allodi 2020,pp. 1669–1670
  18. ^Avgetidis et al. 2023,p. 5309
  19. ^Avgetidis et al. 2023,p. 5318
  20. ^abHendery 2023
  21. ^Lyons 2024

Sources

edit


Retrieved from "https://en.wikipedia.org/w/index.php?title=Infostealer&oldid=1254786692"