The VNC module takes this idea a step further. This allows cybercriminals to imitate and emulate victims’ behavior when trying to take over an account.Ĭombine the knowledge of how the user interacts with the website along with stolen credentials and the ability to proxy through the victim’s machine, and the attack is likely to be a success. Why would cybercriminals trouble themselves with making videos? This is a very easy way to learn about users’ behavior and how they interact with online banking sites. The video-capturing option lets attackers make videos of the victim’s login process. In addition to offering traditional Trojan tools such as a keylogger, screen scraper and HTML injection, Citadel also offers two very interesting modules: a Virtual Network Connection (VNC) option and a video-capturing option. Let’s take a look at one example where a traditional risk engine has little to no chance of detecting the cybercriminal’s attack.Ĭitadel malware has been around for several years. Cybercriminals Can Look Like Normal Users Once this ratio is established, changes to the model are difficult and slow, constituting a significant barrier to rapid and effective handling in the evolving and constantly changing fraud landscape. This results in a high rate of false positives and false negatives. The statistical models are inaccurate and operate in a predictive/pattern-based mode, tuned to generate alerts for a given percent of users. They use a limited subset of the population and possible events as their learning platform and are designed to identify historical fraud tactics instead of protecting the account against the actual method of operation (modus operandi) used by the attacker. They lack visibility into risk factors and pre-login activity, such as the user visiting a phishing site or getting infected with advanced malware. However, these statistical models rely heavily on device identification as their detection method. Most traditional risk engines use a pure statistical model for risk scoring, such as Naïve Bayesian, Decision Trees and Neural Networks. As threats have become more sophisticated and bypassing two-factor authentication has become common for cybercriminals, stopping fraud now requires more decisive action, such as putting the transaction on hold and manually reviewing high-risk and high-value transactions. This assumption allowed these products to identify a relatively high percentage of transactions as risky and perform elevated authentication for all of them. When statistical risk-based authentication models were introduced, they were based on the assumption that fraud could be prevented using simple authentication.

Worst of all - and the root cause for the previous two issues - they provide inaccurate risk scores.

They negatively impact the customer experience.They increase investigation time and have an operational impact.The three main issues with statistical-based risk engines are as follows: The following is a look into how these risk engines are designed and the root cause for their failure in detecting today’s cybercriminals: Why Statistical Models Are Failing Today’s fraudsters have used a wide variety of tools and techniques to build all kinds of new fraud methods specifically intended to evade these adaptive solutions.

Leading vendors offer what they call adaptive authentication platforms that offer multiple deployment models, integration options, application programming interfaces and management platforms that all have one very basic weakness: The solution was designed for the 2005 fraud threat landscape. Today, there is a wide variety of risk engine flavors to choose from. Roughly 10 years ago, security vendors started working on solutions to the authentication issue and, thus, authentication risk engines were born. While different forms of authentication measures will continue to be used, we know today that advanced malware overcomes these by spoofing the victim’s behavior, proxying through the victim’s device or just downright asking the victim for his or her passwords using social-enginnering techniques. In my last article, I discussed how cybercriminals defeat multifactor authentication.

Risk engine gistout