Trusteer Reports Hackers Improve Zeus Trojan to Retain Leadership in Crimeware Race

Version 2.1 of Leading Online Fraud Platform Evolves to Stay Ahead of the Financial Malware Pack

NEW YORK, Oct. 20, 2010 Trusteer, the leading provider of secure browsing services, today reported that it has captured and analyzed a new version (2.1) of the Zeus financial malware and found that it has added sophisticated new mechanisms to commit online fraud and remain the Trojan of choice for criminals. Zeus has not only improved its business logic but also its ability to avoid detection and automatic analysis by antivirus vendors. Zeus is under the spotlight of security vendors, banks, and law enforcement, which forces its developers to continually improve it to avoid losing business to competing malware like Bugat, Clampi, and SpyEye. Just like commercial application developers, the creators of Zeus run an R&D programme to ensure it can avoid detection and side-step the growing number of IT security mechanisms designed to detect, block and eliminate it.

New capabilities in Zeus 2.1 include:

· URL matching based on a full implementation of the Perl Compatible Regular Expressions (PCRE) library. This allows much more flexibility for Zeus's configuration to define targets. For example, Zeus can now target all URLs that start with “https” and then zero in on those that contain specific digits and keywords. Earlier Zeus versions had a primitive regular expression implementation which provided very little flexibility in specifying target URLs.

· The injection mechanism (Zeus’s main “work horse”) now uses sophisticated regular expressions based on PCRE as well, which helps avoid detection.  It can target individual web pages with elaborate injections, while not injecting into other pages.  This surgical injection method creates more convincing pages and can target more banks using a single attack. 

· Zeus now has a fine-grained "grabbing" mechanism, again based on PCRE, which can extract very specific areas of the page (e.g. the account balance) and report them to the C&C host. The grab mechanism provides an efficient way of collecting user data (such as account balance), as opposed to the cumbersome and wasteful way (supported by earlier Zeus variants) of having to copy the full page.

· As other researchers have already pointed out Zeus 2.1 completely changed the way it communicated with its Command &Control (C&C) servers with a daily list of hundreds of C&C hostnames, through which it cycles trying to find a live one which is a considerable improvement over the previous scheme.

· Zeus has added a 1024-bit RSA public key, which will probably be used for one-way encryption of data and authenticating the C&C server to Zeus clients.

“Since the Trusteer Secure Browsing software is installed on the PCs of millions of bank customers, automatically classifying, blocking, analyzing, and removing financial malware such as Zeus, our researchers can see enhanced attack vectors in real time,” said Mickey Boodaei, CEO of Trusteer.  “The improvements are similar to those seen in commercial software, but instead of enhancements being released on a monthly or annual basis, the timescales are now being compressed to just days and weeks, largely because of the immense fraudulent revenues involved. While commercial software needs to undergo extensive quality assurance processes before being released, Zeus has the luxury of pushing rapid updates without worrying too much about software quality.”

Previous malware has risen in popularity, then been tweaked and then faded away, the enhancements in Zeus - which is currently into version 2.1 - show no signs of abating, largely because of the modular coding structure of Zeus.  The modular approach, for example means that exploit hacks can be used to enhance the ability of Zeus to stage a real-time bank access attack, and so greatly extend its useful lifetime to the cybercriminals. As with any commercial application, software product maintenance and support are two of the more important reasons why users buy and use products, and Zeus has proven over the last three years that it does both very well for the cybercriminals.

The Zeus developers keep releasing new features - such as a highly granular browser injection facility - that allow them to stay one step ahead of the IT security community, as well as fixing bugs and other issues in previous versions.  This level of commitment attracts the fraudsters' business and maintains interest in the Trojan amongst security vendors, banks and law enforcement officials. And this in turn re-enforces the security circle, with hacker coders constantly tweaking and improving the malware as time goes on.

"The big question is how long can Zeus stay in pole position in the malware fraud charts? Our researchers suggest that, given its ability to be morphed and enhanced, it's going to be some while yet before other malware gets a look in at the top spot.  And this means that hackers have a vested interest to keep Zeus ahead of the game as far as its ability to defraud, forcing them to improve and increase their effort all the time to avoid losing the cybercriminal's business," Boodaei said.

IT security teams trying to defend against Zeus should:

1. Recognize that antivirus technology is only partially effective against modern malware such as Zeus, Bugat, and SpyEye. Many of these fly under the radar of antivirus solutions while targeting employees and stealing sensitive corporate information. This version of Zeus is extremely elusive and is virtually undetectable by antivirus products.

2. Recognize that the browser has emerged as the weakest link in the enterprise security infrastructure and is being exploited by malware authors and criminals to infect computers and steal sensitive information.

3. Protect employees, contractors, and unmanaged computers with secure browsing services, which can detect, block, and remove browser-borne malware from computers.

4. Put in place technology and processes that enable effective, and instant investigation of malware-related fraud incidents.

Trusteer, the world’s leading provider of secure browsing services, helps secure computers against Man in the Middle, Man in the Browser, and Phishing attacks. Trusteer’s Secure Browsing Service has been available since 2008 and is currently used by more than 70 leading financial organizations in North America and Europe and by more than 13 million of their customers to protect their online banking communication against sophisticated malware attacks and fraud. Trusteer’s Secure Browsing Service is also used by fortune 100 enterprises to protect unmanaged computers entering their network. HSBC, Santander, The Royal Bank of Scotland, Standard Bank, and ING DIRECT are just a few of the banks using Trusteer’s technology. Trusteer is a privately held corporation led by former executives from RSA Security, Imperva, and Juniper. Follow us on www.Twitter.com/Trusteer. For more information about our products and services, please visit www.trusteer.com.

Source: Eskenzi PR Ltd.

Read More

BitDefender releases free removal tool for Carberp Trojan

Standalone utility available for free download on MalwareCity.com to protect against growing threat from potent banking Trojan

BitDefender®, an award winning provider of innovative internet security solutions, has announced a free removal tool targeting the Trojan.Downloader.Carberp.A. Building on the technologies implemented in Zeus and Brazilian Bankers, Trojan.Downloader.Carberp.A has rapidly obtained its place among a rather exclusive club of banking Trojans. It is designed to intercept, manipulate and steal confidential information that a user might send or receive over the internet.

Trojan.Downloader.Carberp.A snatches details from websites that require log-in sessions over a SSL connection such as online banking services and e-mail providers. Apart from keeping an eye on every service that is important enough to force SSL authentication, Trojan.Downloader.Carberp.A is also instructed to monitor a list of websites containing several e-banking portals.

“Once executed on a computer, Trojan.Downloader.Carberp.A creates a couple of temporary files in the %temp% folder, then copies itself to the Windows Startup folder in order to self implement after every boot or restart,” said Catalin Cosoi, Head of the BitDefender Online Threats Lab. “This approach may seem basic compared to other families of malware that add startup entries to the Registry, however, it is this depreciation that allows Trojan.Downloader.Carberp.A to execute itself on newer operating systems, or to run on users’ accounts that do not have administrative privileges.”

Right after infection, the downloader connects to a C&C server, from which it will download an encrypted configuration file, along with additional fire-power such as plug-ins. This allows Trojan.Downloader.Carberp.A to intercept internet traffic and to kill whatever antivirus it may find on the recently infected computer. It then sends the C&C server a unique ID and uploads a list of currently running processes via a GET request.

After it has successfully copied itself in the startup folder as either syscron.exe or chkntfs.exe, Trojan.Downloader.Carberp.A hides its presence by using function hooks in ntdll.dll in order to intercept any calls to NtQueryDirectoryFile and ZwQueryDirectoryFile. This means the user cannot see its files when using Windows® Explorer® or the command-line dir query.

Cosoi continues, “Every time a user logs in using SSL-based authentication to gain access to online banking, e-mail and social network accounts Trojan.Downloader.Carberp.A steals their details, before they are encrypted, and sends them to its C&C server over HTTP. By the time the log in request reaches the bank the credentials will already have fallen into the hands of the attackers.”

Trojan.Downloader.Carberp.A also targets certain banks in Germany, Denmark, the Netherlands, America and Israel following precise instructions that it receives from the C&C server along with configuration instructions. This sophisticated approach provides a lucrative financial tool designed to steal money from online service customers and SMBs. Trojan.Downloader.Carberp.A is also able to install without administrator privileges, attack systems that run the latest versions of OSs and doesn’t make any changes in the Registry or in critical areas of the operating system.

BitDefender customers have been protected since day zero via generic packer routines already included in the signature database. For those not protected by a BitDefender product, a free removal tool can be downloaded from the Downloads section of MalwareCity.com. For a full list of BitDefender 2011 features and benefits by product, visit www.bitdefender.co.uk or follow BitDefender on Twitter for daily malware alerts.

BitDefender is the creator of one of the industry's fastest and most effective lines of internationally certified security software. Since its inception in 2001, BitDefender has continued to raise the bar and set new standards in proactive threat prevention. Every day, BitDefender protects tens of millions of home and corporate users across the globe - giving them the peace of mind of knowing that their digital experiences will be secure. BitDefender solutions are distributed by a global network of value-added distribution and reseller partners in more than 100 countries worldwide. More information about BitDefender and its products are available at the company's security solutions press room. Additionally, BitDefender's www.malwarecity.com provides background and the latest updates on security threats helping users stay informed in the everyday battle against malware. www.bitdefender.co.uk

Source: Media Safari

Read More

Nuclear secrets revealed after unencrypted USB stick found in Cumbria hotel room

Just when you thought it was safe to go back into the water… (Ed)

18th October 2010 - Reports are coming in that an unencrypted USB stick - apparently containing details on the Sellafield nuclear site's operations - was found by a coach driver in a Cumbria hotel room.

And, says Credant Technologies, the endpoint data security specialist, it seems that the USB stick contained details of the nuclear firm's proposed workforce transfer from its Capenhurst operation in Cheshire to uranium specialist Urenco.one.

"This fact alone is manna from heaven to enemies of the UK, especially since the data on the USB stick suggested that International Atomic Energy technicians visiting the site were not sufficiently up to speed," said Sean Glynn, Credant's vice president and chief marketing officer.

“While the convenience of USB sticks make them an important tool for any business, you don’t have to be a nuclear scientist to know that the data carried on these devices must be protected,”he added.

Corporate USB sticks, says Glynn, should always include encryption and other forms of security as a basic requirement because - as this incident clearly shows - unencrypted data can, and does, fall into the wrong hands.

And in the case of Sellafield - the former Windscale nuclear material processing and handling site - he added that the data on the USB stick falls firmly into the kind of information which has national security implications, especially with the UK currently being on heightened terrorist alert (http://bit.ly/aMhIQI).

The discovery of this data on a USB stick in a hotel room, says the Credant vice president, is the kind of plot that would do justice to a John Le Carre thriller novel, rather than real-life hotel in deepest Cumbria.

"But here we have a coach driver making a discovery that has serious national security overtones. That technicians and other employees at Sellafield are using USB sticks to store and move sensitive data is not really a surprise in today’s world, but that there are not policies and procedures in place to encrypt or otherwise protect the data on those devices is a real concern,” he said.

"As the coach driver is quoted as saying in the local press, what if the USB stick had fallen into the hands of terrorists, or contained top secret information?" he added.

"Sellafield has done the right thing in launching an investigation, but this is a potentially serious breach of data security on several levels, with national security overtones. Sellafield needs to look very carefully at its data security policies, and the technology that enforces those policies."

For more on the Sellafield USB stick fiasco: http://bit.ly/9RY97A

For more on Credant Technologies: www.credant.com

Source: Eskenzi PR

Read More

Microsoft criticizes its competition OpenOffice.org on YouTube

by Michael Smith (Veshengro)

Epsom, UK, 10/15/2010: Some days ago Microsoft's Office Division made public on YouTube a video in which they list one supposed disadvantage of OpenOffice.org after the other.

They claim that Oracle's free office product, OpenOffice.org, is incompatible, insecure and slow and that it would be no alternative for firms and other businesses to the Microsoft Office-Suite.

In this video Microsoft's Office Division claims the free office OpenOffice.org to be entirely incompatible, insecure and way too slow. For the professional use in businesses they claim that the free Open-Source solution is entirely useless, as, because of the lack of support and the unreliability high additional costs would arise.

In the three-minute long film selected representatives of a variety of companies are cited who, so it is claimed, after the installation of OpenOffice were forced, because of disappointment, to switch over to the to be paid for Microsoft Office software.

Mostly mention is made of so supposed additional costs which are supposedly caused by the implementation of Open Source software solutions.

“First we used Open Office, based upon Linux systems, in order to save money. We found soon, however, that the exorbitant costs and the extremely limited available support, left us worse off than before,” claims, for example, James Fleminf, of the American company “Speedy Hire”.

An estimated 25% extra time would be needed in order to install and maintain Open Office based systems, claimed David Sterling, IT manager of Central Scotland Police. Even a teacher is quoted as saying that pupils who handed in a document converted with OpenOffice.org for grading and who, as a result, and how could it be different, received worse grades. With use of Microsoft Word or Excel this could and would not have happened, they claim.

After the video had been put up on YouTube and the first critics had countered the claims made as not being objective enough it was removed from YouTube. In the meantime, however, Microsoft has put it back up, in, so I understand, the same way as it was before.

Having been using OpenOffice.org for years now I can but say that I find it easier to use than MS Word (and other MS Office products) and there is absolutely no compatibility issue. In fact all documents convert to OpenOffice.org without any problems whatsoever, whether MS Word, Excel, or PowerPoint. Just a shame that MS often does not allow for proper back-conversion.

It is also a shame that the likes of Avery and others still only make their templates available for MS Word and not OpenOffice.org though many Microsoft templates do, in fact, convert.

I must say that I have serious misgivings as to the reliability of the quotes in the video as, for instance, many local governments and police authorities on mainland Europe work in OpenOffice.org on Windows and on Linux-based Operating Systems.

The claim about security issues with OpenOffice.org and its files is absolutely laughable. Microsoft would do well to clean up in front of their own door before talking about other people's products.

Then again, those tactics and antics of the Redmond-based company do not surprise me at all. It is the same story when it comes to talking about Open-Source Operating Systems as when it comes to OpenOffice and, indeed, other Open-Source software.

Microsoft is running scared that it could be losing customers, especially in the still ongoing Great Recession.

While it is true that not all the keyboard shortcuts on OpenOffice are the same as on MS Word, for instance, it does not take much to get used to them and the interface is not much different to MS Office, even Office 2007.

Folks, don't allow yourselves to be scared off by the bullies out of Redmond. Rather give the a good run for their money while not wasting yours.

OpenOffice.org is compatible and secure and fast and I use it every day.

© 2010

Read More

BitDefender releases Stuxnet Removal Tool

Standalone utility available for free download on MalwareCity.com

BitDefender^®, an award winning provider of innovative internet security solutions, has today released a free removal tool targeting the Win32.Worm.Stuxnet. Available for free download on MalwareCity.com, the tool is capable of removing all known variants of the computer worm plus the rootkit drivers that are used to conceal critical components of it.

Win32.Worm.Stuxnet is part of a new breed of e-threats that emerged around mid-July. It infects all Windows-based systems but primarily targets supervisory control and data acquisition (SCADA) systems that run the Siemens WinCC software. It spreads by taking advantage of a multitude of 0-day exploits in the current versions of Windows.

The worm can execute itself from an infected removable medium as soon as the .lnk file on the drive has been read by the operating system. Successful exploitation of this vulnerability results in the injection of a backdoor, as well as the installation of two rootkits that will conceal both the .lnk files and the accompanying .tmp files.

“BitDefender added generic detection covering all variants of Stuxnet on July 19^th so we have been protecting our customers since day zero,” said Catalin Cosoi, Head of the BitDefender Online Threats Lab. “However, as part of our constant efforts to help users worldwide in their fight against e-threats, we have also created a Stuxnet Removal Tool. Therefore, users who are not protected by a BitDefender security solution can now also eliminate Stuxnet from their infected systems. The tool can be run on both 32 and 64-bit installations and it will eliminate both the rootkit drivers and the worm.”

The Stuxnet Removal Tool can be downloaded from the Removal Tools section of www.malwarecity.com, a BitDefender initiative for the software security community and a free resource for those interested in their online security.

For a full list of BitDefender 2011 features and benefits by product, please visit www.bitdefender.co.uk or follow BitDefender on Twitter for daily malware alerts.

BitDefender is the creator of one of the industry's fastest and most effective lines of internationally certified security software. Since its inception in 2001, BitDefender has continued to raise the bar and set new standards in proactive threat prevention. Every day, BitDefender protects tens of millions of home and corporate users across the globe - giving them the peace of mind of knowing that their digital experiences will be secure. BitDefender solutions are distributed by a global network of value-added distribution and reseller partners in more than 100 countries worldwide. More information about BitDefender and its products are available at the company's security solutions press room. Additionally, BitDefender's www.malwarecity.com provides background and the latest updates on security threats helping users stay informed in the everyday battle against malware. www.bitdefender.co.uk

<>

Read More

Gathering Clouds: Transferring Data Outside the UK

by Michael Smith (Veshengro)

While data protection is standardised to a large degree in the European Economic Area (EEA) and transfers within the EEA raise no issues, in general, transfers to most other jurisdictions, notably here the USA, may raise complex legal issues, and also privacy issues.

The 8th principle of the Data Protection Act 1988 ('DPA') stipulates that personal data shall not be transferred to a country or territory outside the EEA unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. The USA does not seem to do that and too many of its alphabet agencies like to lay their hands on data from the UK, for instance.

However, in a global, increasingly cloud-based economy, data transfers between the EEA and the USA and other countries are inevitable. Thus, mechanisms have been developed to accommodate this. First there are the 'Safe Harbor' rules to which US companies may sign up agreeing to be bound by rules akin to those set out in the DPA. There are also Binding Corporate Rules ('BCR') and Model Contractual Rules ('MCR') that can be invoked to address the problem. BCR are a set of inter-company rules reflecting the 8 DPA principles. These are only valid for data transfers from EEA companies to their non-EEA affiliates. The European Commission has approved MCR which comprise model contractual clauses that can be implemented into contracts for data transfers from EEA companies to unaffiliated non-EEA companies.

The DPA distinguishes between a Data Controller is a person who alone, jointly or in common with others determines the purposes for which and the manner in which any personal data are processed and is responsible for ensuring compliance with the provisions of the DPA. Where Data Controllers have external contractors process data on their behalf, the latter are known as "Data Processors". But the Data Controller nevertheless remains responsible for the actions of the Data Processors.

Where an EU Data Controller sends personal data to a non-EEA Data Processor, the MCR can be invoked. In today's cloud-based environment, data may pass through numerous different processors and countries. It is not realistic to expect the Data Controller to monitor each such transfer so it has been deemed sufficient for the non-EEA Data Processor to obtain the consent of the EU Data Controller prior to entering into an agreement to send personal data to a sub-processor and for the Data Processor to enter into an agreement with sub-processors to process and handle the data in accordance with EU data protection law.

Binding rules or not knowing the interest of the agencies in the United States it will have to said that data transfer, especially data such as medical records, and other government records of residents of the UK and EU member states, to clouds based in the USA will not be a good idea at all.

While it is said that this and that rule is in place and that American companies sign up to those the fact is that should their agencies demand data they will (have to) hand it over.

We must remember that the jurisdiction of the country in which the servers are based applies and not the jurisdiction of any of the EU member states, such as the United Kingdom.

With any such data, especially sensitive personal data, based in the cloud on servers in the USA (or elsewhere) we can all kiss the notion of privacy goodbye and we should resist and work to prevent any government data being sent from our country to a foreign one.

© 2010

Read More

Criminals behind Zeus Trojan are failing to cover their tracks

Reports that the Metropolitan Police's e-crime unit have arrested 19 people in connection with the notorious Zeus Trojan malware - show that some of the criminal groups behind Zeus are failing to cover their tracks according to Mickey Boodaei, CEO of Trusteer, the Secure Browsing Service specialist.

“The arrests shows that some of the criminal groups behind Zeus are doing a poor job in covering their tracks,” said Mickey Boodaei, Trusteer's CEO “This provides an excellent opportunity for the police, the banks, and their customers to join together and get more criminals behinds bars. The police did a great job in tracing down this group and gathering information that can facilitate their arrest. This is not a simple task and I've heard many people saying that this is almost impossible due to the level of sophistication from criminals and the complication of the justice system. However, this case and a few others that precede it show that this can be achieved.”

In a recent initiative by Trusteer and a few other organizations, we were able to actually penetrate the criminals' servers and gather a lot of evidence from them. This shows that criminals are vulnerable.

“By running more operations like this and by the banks and other organizations investing effort in tracing fraudsters and not just blocking their activities, there is a good chance we can lower the volumes of attacks. Customers can take their banks' advice and implement fraud prevention tools that provide valuable capabilities to banks in detecting and blocking these threats. By working together we can definitely stop this threat from growing.” Boodaei said.

Trusteer, the world’s leading provider of secure browsing services, helps prevent financial malware attacks through its array of services. Trusteer enables banks and online businesses to protect sensitive data such as account holder credentials from malware by locking down the browser and creating a tunnel for safe communication between the web site and customers’ machines. It also prevents phishing by validating site authenticity. Trusteer also allows remote, effective, and instant investigation of malware-related fraud incidents. Trusteer’s solutions are used by more than 70 leading financial organizations in North America and Europe and by more than 12 million of their customers. Trusteer is a privately held corporation led by former executives from RSA Security, Imperva, and Juniper. Follow us on www.Twitter.com/Trusteer. For more information about our products and services, please visit www.trusteer.com.

Source: Eskenzi PR

Read More