PDA

View Full Version : New Virus...I'm impressed.


BB63Squid
09-29-2009, 7:40 PM
Banking Trojan steals money from under your nose[/b] (http://news.cnet.com/8301-27080_3-10363836-245.html[b)

Researchers at security firm Finjan have discovered details of a new type of banking Trojan horse that doesn't just steal your bank log in credentials but actually steals money from your account while you are logged in and displays a fake balance.

The bank Trojan, dubbed URLzone, has features designed to thwart fraud detection systems which are triggered by unusual transactions, Yuval Ben-Itzhak, chief technology officer at Finjan, said in an interview on Tuesday. For instance, the software is programmed to calculate on-the-fly how much money to steal from an account based on how much money is available.

The specific Trojan Finjan researchers analyzed targets customers of unnamed German banks. It was linked back to a command-and-control server in Ukraine that was used to send instructions to the trojan software sitting infected PCs. Finjan has notified German law enforcement authorities, Ben-Itzhak said.

"It's a next generation bank trojan," he said. "This is part of a new trend of more sophisticated Trojans designed to evade antifraud systems."

Finjan researchers were able to trace the communications from the code on an infected machine back to the command-and-control server, which was left unsecured, according to Ben-Itzhak. On that server, they saw the LuckySpoilt administration console and were able to see exactly what types of rules the Trojan was written to follow and statistics on victims.

About 90,000 computers visited the sites housing the malware and 6,400 of them were infected, a 7.5 percent success rate, he said. Of those whose computers had the Trojan installed, a few hundred had money stolen from their bank accounts, he added.

During the span of 22 days in mid-August, the criminals behind the Trojan stole the euro equivalent of nearly $438,000, according to the security company.

http://i.i.com.com/cnwk.1d/i/bto/20090929/FinjanCalculations_610x387.png

The Trojan code includes detailed instructions on how the trojan should calculate how much to steal from a victim's bank account.
(Credit: Finjan)

Here's how the trojan works:

Potential victims get their computers infected either by opening an e-mail and clicking on a link to a Web site created to distribute malware or by visiting a site that has been compromised and malware hidden on it.

In this case the malware, a toolkit called LuckySpoilt, exploits a known security hole in the browser, affecting the major browsers, and installs the Trojan on the computer. When the Trojan notices the computer user visiting the site of a targeted bank it springs into action.

While the computer user goes about his or her business on the site, the Trojan looks at the available balance and figures out how much money to steal. The Trojan is given a minimum and a maximum range that is below the amount that triggers antifraud systems and to leave a certain percentage in the account, Ben-Itzhak said.

After performing the calculation, the Trojan then makes the transaction, communicating with the bank site through the browser without the computer user knowing.

"The Trojan is sending requests to the bank and getting replies that your browser doesn't display," Ben-Itzhak said. "You are looking at your account and you don't see any of it."

The Trojan has the money sent to the bank account of a money mule, someone who has an account set up to receive the funds. Money mules are typically people recruited online as "independent contractors" or "financial managers" whose sole purpose is to wire the money placed into their account to someone else, typically out of the country, in exchange for a commission. Because their accounts are used only once or twice, they often do not realize the ruse immediately, Ben-Itzhak said.

Meanwhile, the Trojan hides the theft by erasing it from the report of account activity displayed to the computer user and shows a fake balance--what the amount would be if not for the theft. The victim will not notice something is wrong until a different, uncompromised computer is used to access the account, an ATM is used, or a transaction is denied because of insufficient funds.

The Trojan also keeps a log of the victim's bank account log in credentials, takes screenshots, and snoops on the user's other Web accounts, such as PayPal, Facebook, and Gmail, according to the Finjan report.

This is the first Trojan Finjan has come across that hijacks a victim's browser session, steals the money while the victim is doing online banking, and then covers its tracks by modifying information displayed to the victim, all in real time, Ben-Itzhak said.

SwissFluCase
09-29-2009, 8:09 PM
Nasty! I'll keep an eye out for it...

Regards,


SwissFluCase

1JimMarch
09-29-2009, 8:52 PM
The best cure for this crap:

http://ubuntu.com

locosway
09-29-2009, 9:03 PM
Has this been proven, or is it a proof?

I know my bank will not let me transfer money to accounts outside of my own accounts through the website.

BB63Squid
09-30-2009, 5:31 AM
Has this been proven, or is it a proof?

I know my bank will not let me transfer money to accounts outside of my own accounts through the website.

I am fairly sure it's for real. It looks like the infection rate is slow so more likely than not, standard "best practices" will protect someone from this.

As for banking methods, I can't tell you as I don't know the inner workings of bank procedures.

locosway
09-30-2009, 6:55 AM
I use Linux, so I'm not exactly worried...

bigmike82
09-30-2009, 7:52 AM
Wow, slick little bugger.

Blackhawk556
10-01-2009, 6:02 PM
this is cool

but sucks for everyone.

who ever wrote that trojan is hella smart

BB63Squid
10-01-2009, 9:47 PM
this is cool

but sucks for everyone.

who ever wrote that trojan is hella smart

I can guarantee there was more than one person involved in this nefarious lil bug.

BB63Squid
10-01-2009, 9:49 PM
I use Linux, so I'm not exactly worried...

So do I. As well as OSX 10.5, 10.6, XP, 2003, Vista, Win7. Gotta let my fellow gunnies know though...just in case.