New Malware Pretends to Be You by Matching Your Keystroke Characteristics
Cybersecurity researchers have developed a new keystroke impersonation attack that avoids being detected by keystroke-based biometric security solutions.
The idea of using biometrics for security purposes has been around for years. The idea of using a thumbprint, a retina scan, or your voice have been made part of very secure environments. But the idea of giving up something that so-uniquely identifies a person has made some users hesitant.
The idea of using keystrokes – which seems far less intrusive than, say, scanning you eye – has been around for many years as well. Some security products use keystroke characteristics to confidently identify an individual.
The latest research entitled “Malboard: A Novel User Keystroke Impersonation Attack and Trusted Detection Framework Based on Side-Channel Analysis” discusses a new attack that generates and sends malicious keystrokes that mimic the victim user's behavioral characteristics. So, solutions identifying users based on keystroke can be fooled into believing it’s the actual user making requests to access and exfiltrate sensitive data.
The introduction of such malware indicates that a) it’s possible to easily mimic a user, further confounding the detection of external attacks that are leveraging compromised internal credentials and, b) the bad guys will begin to incorporate this kind of capability into their automated attacks as security vendors look to further their ability to identify that the user making a request is actually the requesting user.
The Malboard attack method is just the latest innovative attack method. But, to be effective, the code behind Malboard needs to somehow be present on an endpoint. That means traditional delivery mechanisms such as phishing attacks using malware delivery would be necessary. Users undergoing Security Awareness Training are best-equipped to spot malicious email and web content, lowering the chance of successful attack.
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
Gloss