New Banking Trojan Discovered in the Wild

New Banking Trojan Discovered in the Wild - Used to perform ACH and wire fraud - Softpedia

Researchers from Atlanta-based security vendor SecureWorks have discovered a new information-stealing trojan facilitating ACH and wire fraud. The trojan has all the capabilities of malware commonly used to steal money from SMBs and non-profits.

An unprecedented wave of Automated Clearing House (ACH) and wire fraud started in 2009, resulting in small and medium-sized companies, public institutions and non-profit organizations losing millions of dollars to cyber-criminals. The problem prompted the FBI and the American Bankers Association torecommend that online banking operations be performed from dedicated computers only.

These attacks start by infecting computers on an organization's network with the purpose of stealing online banking credentials. The Clampi and Zeus (Zbot) families of trojans have so far dominated this aspect of cyber-crime and positioned themselves as the leading information-stealing computer trojans.

However, it seems other groups are willing to challenge that supremacy, especially since antivirus products are getting better at generically detecting modified Clampi and Zeus variants, which significantly reduces their success rate. The trojan discovered by SecureWorks back in January, which was dubbed Bugat, appears to be one of these new competitors.

"In mid-January, the installer for Bugat had moderate coverage (20/40), according to VirusTotal. The most commonly identified name (Bredolab) corresponds to a family of trojan downloaders. However, its runtime behavior did not match what one would expect from Bredolab. The installed mspdb30.dll file had almost no AV recognition (2/41)," Jason Milletary, SecureWorks' technical director for malware analysis, explains on the company's research blog.

Bugat is capable of capturing information entered in Web forms, altering the content of targeted websites or stealing browser cookies, as well as FTP and POP3 credentials. Additionally, the malware can function as a SOCKS proxy server, upload files from the infected computer to a remote server or download and execute programs.

The trojan communicates with a command and control (C&C) server from where it receives instructions and updates to the list of financial websites it targets. This communication can be encrypted in order to thwart traffic inspection tools.

"The emergence of Bugat reinforces that there is a strong demand for new malware to commit financial credential theft and that ACH and wire fraud remains a profitable venture for criminals," Mr. Milletary concludes. Indeed, just last week, Symantec warned of a new Zeus-like crimeware toolkit called SpyEye.

Computer Trojan Helped Expose Secret Syrian Nuclear Reactor - Which was subsequently bombed by Israel in September 2007 - Softpedia

Computer Trojan Helped Expose Secret Syrian Nuclear Reactor - Which was subsequently bombed by Israel in September 2007 - Softpedia: "The use of a computer Trojan played a critical role in gathering intelligence regarding a now-destroyed secret nuclear reactor in Syria. The information-gathering program was planted by Mossad operatives on the laptop of a Syrian official while he was staying in London.

Journalists from the German publication Der Spiegel have recently published an article describing the events that led and followed Israel's bombing of the Syrian nuclear reactor at Al Kibar. According to them, Israel had reason to believe that Syria might be planning to launch a secret nuclear program even since 2002, but information was scarce at the time.

Their suspicions intensified in 2004 after United States' National Security Agency (NSA) informed them of an unusually high number of calls between Pyongyang, the capital of North Korea, and a region in the Syrian desert situated close to the Euphrates river. This place was called Al Kibar.

Then, in late 2006, Mossad operatives succeeded in obtaining more concrete evidence. Apparently, this was achieved by installing a professional trojan on the computer of a senior Syrian government official. The clandestine program was planted on his laptop left in a Kensington hotel room during a trip to London.

The trojan stole secret documents and images depicting the Al Kibar reactor in various stages of construction. It also captured photos of Chon Chibu, a leading North Korean nuclear scientist, together with Ibrahim Othman, the director of the Syrian Atomic Energy Commission. This intelligence gathering effort eventually led to 'Operation Orchard,' the bombing by Israeli fighter jets of the Al Kibar complex in September 2007.

There is no mention as to whether the information on this laptop was encrypted or not, but generally with such sensitive information, it is. However, it doesn't matter as this is a perfect example of a so-called 'Evil Made' attack, a situation where the attacker can install a boot-level malware on an unattended device, which is then returned to the owner for use.

'People who encrypt their hard drives, or partitions on their hard drives, have to realize that the encryption gives them less protection than they probably believe,' warns cryptography guru Bruce Schneier. 'It protects against someone confiscating or stealing their computer and then trying to get at the data. It does not protect against an attacker who has access to your computer over a period of time during which you use it, too,' he explains."

Source: http://news.softpedia.com/news/Computer-Trojan-Helped-Expose-Secret-Syrian-Nuclear-Reactor-126423.shtml