Exploited Bank of India website downloads malware

Powered by SC Magazine
 

The website of one of India's leading financial services companies is back online after US researchers discovered it was downloading a wide range of malware to customer PCs.

Sunbelt Software discovered Thursday afternoon that the Bank of India's website had become compromised and was serving up about 30 forms of malware, Alex Eckelberry, the company's CEO, told SCMagazine.com.

Sunbelt learned that the site had become compromised while researching another malware issue, he said.

Sunbelt contacted the Bank of India, which shut its site down at about 2 a.m. ET Friday to clean the server, he said. The site is up and running again.

"We tracked communication with [the other malware] to the Bank of India site," Eckelberry said.

"We're fairly certain this was done by the Russian Business Network  (RBN), an underground criminal gang in Russia responsible for lot of bad things on the Internet."

The exploit appeared to be a malicious IFRAME, which took advantage of a Microsoft Windows 2003 server running the Bank of India site, he added.

As noted, the malware downloaded a wide variety of malware to end-user PCs whose Windows machines have not been patched since August 2006, Eckelberry said.

Included among the malware were a variant of TSPY_AGENT.AAVG, a variant of Trojan.Netview, several rootkits, and a Trojan.Pandex.

The former steals information from active windows on vulnerable end-user PCs as well as information collected by a keylogger, network configuration and user names and passwords from POP3 and SMTP email protocols.

The collected files were then uploaded to an FTP server located in Russia, according to Sunbelt.

"Bank of India had a hole in its systems, and the Russians took the opportunity to insert code into the page," Eckelberry said. "The same thing happened to the Super Bowl site earlier this year."

These types of exploits should remind website owners that if their servers "are not fully patched, they will get infected," Eckelberry emphasised.

"Patching and having good security policies in place are critical – you can't take web server or SQL server software out of box and operate with the defaults."

Exploited Bank of India website downloads malware
 
 
 
Top Stories
Innovating in the sleepy super industry
There’s little incentive to be on the bleeding edge, so why is Andrew Todd fighting so hard?
 
How technology will unify Toll
The systems headache formed through 15 years of acquisitions.
 
Immigration breached Privacy Act with data leak
Pilgrim slams "copy and paste" of asylum seeker data.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  38%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  7%
 
Your telco, ISP or utility
  8%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  15%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 834

Vote