Russian rootkit stealing bank info

Powered by SC Magazine
 

Teams from Sana Security have discovered a difficult-to-detect trojan designed to steal passwords previously used on infected machines.

The malware is effective because it acts as a rootkit to stay hidden from users, remaining on a PC indefinitely because it can survive a restart, the San Mateo, Calif., security vendor said Wednesday.

The trojan is kernel-mode, meaning the trojan modifies the layer of an operating system that controls the machine's basic functions.

The trojan – named rootkit.hearse by Sana – can compromise bank accounts, email logins and insurance information, the firm said.

The worm began infecting machines March 16, and Sana discovered the malware Tuesday. The firm estimated the trojan has affected roughly 20,000 users, stealing almost 40,000 records from 7,000 sites.

"The trojan appears to not be active at all times, but it does wake up and start communicating when it sees a user browsing to a website that requires authentication," Sana said.

The firm said it infected a virtual machine with the trojan, and the worm recorded a made-up username and password entered into Bank of America's website.

Once installed, the malware sends the information it steals to a Russian server.

"Due to the seriousness of this infection, and lack of detection in most mainstream security products, (we have) contacted the (anti-virus) companies with infected users, notified the owners of the websites that are hosting the malicious content and notified appropriate authorities," Sana said.

Meanwhile, anti-virus vendor F-Secure said today it is investigating a Russian email worm, which relies on rootkit technologies.

Called Gurong.A, the worm is in the wild but spreading slowly, the company said.

Because it is a kernel-mode rootkit, the malware can execute malicious code without adding any additional, F-Secure said.

Copyright © SC Magazine, US edition


 
 
 
Top Stories
ATO investigates 25 tech giants in tax hunt
Prepared to take tax evaders to court.
 
Immigration, Customs restructure IT leadership
Customs CIO promoted into transformation role.
 
NBN Co begins FTTB rollout
Will bring service to 6000 apartments.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  36%
 
Your insurance company
  5%
 
A technology company (Google, Facebook et al)
  9%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  4%
 
A Federal Government agency (ATO, Centrelink etc)
  18%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  7%
TOTAL VOTES: 2916

Vote
Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
  27%
 
I DON'T support shutting the OAIC.
  73%
TOTAL VOTES: 906

Vote