Russian rootkit stealing bank info

Powered by SC Magazine
 

Teams from Sana Security have discovered a difficult-to-detect trojan designed to steal passwords previously used on infected machines.

The malware is effective because it acts as a rootkit to stay hidden from users, remaining on a PC indefinitely because it can survive a restart, the San Mateo, Calif., security vendor said Wednesday.

The trojan is kernel-mode, meaning the trojan modifies the layer of an operating system that controls the machine's basic functions.

The trojan – named rootkit.hearse by Sana – can compromise bank accounts, email logins and insurance information, the firm said.

The worm began infecting machines March 16, and Sana discovered the malware Tuesday. The firm estimated the trojan has affected roughly 20,000 users, stealing almost 40,000 records from 7,000 sites.

"The trojan appears to not be active at all times, but it does wake up and start communicating when it sees a user browsing to a website that requires authentication," Sana said.

The firm said it infected a virtual machine with the trojan, and the worm recorded a made-up username and password entered into Bank of America's website.

Once installed, the malware sends the information it steals to a Russian server.

"Due to the seriousness of this infection, and lack of detection in most mainstream security products, (we have) contacted the (anti-virus) companies with infected users, notified the owners of the websites that are hosting the malicious content and notified appropriate authorities," Sana said.

Meanwhile, anti-virus vendor F-Secure said today it is investigating a Russian email worm, which relies on rootkit technologies.

Called Gurong.A, the worm is in the wild but spreading slowly, the company said.

Because it is a kernel-mode rootkit, the malware can execute malicious code without adding any additional, F-Secure said.

Copyright © SC Magazine, US edition


 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 433

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 209

Vote