Russian rootkit stealing bank info

Powered by SC Magazine
 

Teams from Sana Security have discovered a difficult-to-detect trojan designed to steal passwords previously used on infected machines.

The malware is effective because it acts as a rootkit to stay hidden from users, remaining on a PC indefinitely because it can survive a restart, the San Mateo, Calif., security vendor said Wednesday.

The trojan is kernel-mode, meaning the trojan modifies the layer of an operating system that controls the machine's basic functions.

The trojan – named rootkit.hearse by Sana – can compromise bank accounts, email logins and insurance information, the firm said.

The worm began infecting machines March 16, and Sana discovered the malware Tuesday. The firm estimated the trojan has affected roughly 20,000 users, stealing almost 40,000 records from 7,000 sites.

"The trojan appears to not be active at all times, but it does wake up and start communicating when it sees a user browsing to a website that requires authentication," Sana said.

The firm said it infected a virtual machine with the trojan, and the worm recorded a made-up username and password entered into Bank of America's website.

Once installed, the malware sends the information it steals to a Russian server.

"Due to the seriousness of this infection, and lack of detection in most mainstream security products, (we have) contacted the (anti-virus) companies with infected users, notified the owners of the websites that are hosting the malicious content and notified appropriate authorities," Sana said.

Meanwhile, anti-virus vendor F-Secure said today it is investigating a Russian email worm, which relies on rootkit technologies.

Called Gurong.A, the worm is in the wild but spreading slowly, the company said.

Because it is a kernel-mode rootkit, the malware can execute malicious code without adding any additional, F-Secure said.

Copyright © SC Magazine, US edition


 
 
 
Top Stories
Australia's digital crescendo
Barely unpacked from his move from Amsterdam, Southern Cross Austereo's new digital boss Vijay Solanki is looking for Australia's untapped potential.
 
Turnbull nabs UK govt digital guru as DTO chief
Inaugural CEO to lead change agenda.
 
NBN to offer TV connections through fibre for greenfields
Ditching aerials to come at a cost.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Is site blocking effective in stopping piracy?


   |   View results
Yes
  2%
 
No
  86%
 
Somewhat
  12%
TOTAL VOTES: 795

Vote