News Stay informed about the latest enterprise technology news and product updates.

New banking Trojan wants you for its army

A couple of weeks ago I wrote a story about some of the more sophisticated Trojans out there right now, including Storm and Nugache. I mentioned a few Trojans that specifically target online banking customers, and now there comes word in this blog post from Symantec about a new banking Trojan:

The ability of this Trojan to perform man-in-the-middle attacks on valid transactions is what is most worrying. The Trojan can intercept transactions that require two-factor authentication. It can then silently change the user-entered destination bank account details to the attacker’s account details instead. Of course the Trojan ensures that the user does not notice this change by presenting the user with the details they expect to see, while all the time sending the bank the attacker’s details instead. Since the user doesn’t notice anything wrong with the transaction, they will enter the second authentication password, in effect handing over their money to the attackers. The Trojan intercepts all of this traffic before it is encrypted, so even if the transaction takes place over SSL the attack is still valid. Unfortunately, we were unable to reproduce exactly such a transaction in the lab. However, through analysis of the Trojan’s code it can be seen that this feature is available to the attackers.

How about that for a barrel of laughs? Symantec’s analysis shows that the Trojan, which has yet to be assigned a catchy name, also can steal passwords for email accounts, FTP sites and other applications. Not to mention its ability to execute the more common type of man-in-the-middle attack, sending users to a server controlled by the attacker instead of the user’s intended destination.

The thing that worries me about these Trojans, aside from the obvious, is that what we’re seeing is only a small percentage of what’s out there. For every one of these that we see a detailed analysis of, there’s no telling how many others are quietly infecting machines across the Net.

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Hi, Interesting article... I am currently patenting a security protocol that offers some defence against identity theft and man in the middle attack. The novelty of my system is a single user password that is used in a human brain public / private key scenario making it possible to request confirmations of transactions after initial authentication. My protocol does not need to "hide" from attackers using technology such as encryption and takes place "in the clear" - it is proof against all known and foreseeable forms of attack except those in which the legitmate user deliberately hands over his password. I got close to selling this to a local bank in South Africa a short while back and I know that eventually at least one bank will use my technology for Internet transaction security. I am looking for intros under NDA to interested parties.