Attacks/Breaches
9/19/2013
11:33 AM
50%
50%

Shylock Malware Resurges, Targets Top U.S. Banks

Major U.S. financial firms are being targeted by tough-to-detect malware that can steal money while customers access their online accounts.

Beware the latest version of the banking malware known as Shylock -- also called Caphaw -- which has been retooled to target customers of 24 different banks.

Security firm Zscaler reported Wednesday that over the last month it's seen the number of Shylock infections surge. While the malware was first spotted in 2011 and was seen earlier this year targeting European banking customers, the latest version of the Trojan application now targets customers of the four largest U.S. banks -- Chase Manhattan Corporation, Bank of America, Citi Private Bank and Wells Fargo -- as well as Bank of the West, Capital One, U.S. Bancorp and others.

Shylock is better than most banking malware, which typically siphons up a user's banking credentials and relays them to attackers for later use. "This is one of the few pieces of malware that can automatically steal money when the user is actively accessing his banking account," read an analysis of Caphaw published earlier this year by ESET security researcher Aleksandr Matrosov. Other malware with this capability includes Carberp, Gataka, Ranbyus and Tinba.

[ Use Internet Explorer? Be careful where you browse. See Microsoft: Beware IE Zero-Day Attacks. ]

Shylock, which hides in Windows Explorer, can also hook itself to the operating system in a way that allows it to control the reboot/shutdown process and makes it possible for the malware to restore itself after some antivirus cleaning procedures have been carried out, Matrosov said.

The previous iteration of Caphaw largely targeted banks in Britain, Denmark, Italy and Turkey.

To date, it's not clear how people are being infected with the latest version of Shylock, although Zscaler ThreatLabZ security researchers Sachin Deodhar and Chris Mannon said in a blog post that "it is more than likely arriving as part of an exploit kit [homing] in on vulnerable versions of Java." That's because infected devices that communicate with Shylock command-and-control (C&C) servers have an HTTP "user-agent" header listed as "Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_07." In other words, infected devices seen to date are running both Windows XP and a version of Java 6 that dates from 2008. Needless to say, that version of Java contains a number of known -- and exploitable -- vulnerabilities.

Don't expect antivirus software to reliably stop Shylock, since it's been built so that every infection looks slightly different to help it sneak past antivirus scanners. As of Wednesday, only one out of 46 antivirus scanners could detect the latest version of Shylock, though by Thursday 25 out of 48 scanners were spotting it. "The variation in the dropped executable is different across every instance, so it's no wonder standard AV is having a problem keeping up," said Zscaler's Deodhar and Mannon. "This AV performance also indicates that the likelihood of someone proactively catching this infection inside their network is fairly low at the time of this writing."

To further hide its activities, the malware also makes use of a domain generation algorithm, which keeps the malware's lines of communication -- encrypted via SSL -- synchronized with a constantly changing roster of C&C servers sporting quasi-random names. These servers receive stolen data, send commands to infected PCs, and can also push plug-ins that transform the infection into a rootkit, make a video recording of a user's PC session, allow the malware to spread via removable media and shared drives, and copy information from Microsoft Outlook personal folder (.pst) files.

Thanks to the C&C servers' quasi-random names, actually finding and shutting them down can be difficult. "The large number of potential rendezvous points with randomized names makes it extremely difficult for investigators and law enforcement agencies to identify and 'take down' the [C&C] infrastructure," said the Zscaler researchers. "Furthermore, by using encryption, it adds another layer of difficulty to the process of identifying and targeting the command and control assets."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/1/2013 | 10:24:14 AM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Becca, Shylock was named by Trusteer, which discovered the financial malware in 2011. "We codenamed it Shylock because every new build bundles random excerpts from Shakespeare's The Merchant of Venice in its binary," wrote Trusteer at the time. "These are designed to change the malwareG«÷s file signature to avoid detection by anti-virus programs."
Becca Lipman
50%
50%
Becca Lipman,
User Rank: Apprentice
9/24/2013 | 10:04:56 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Who is in charge of naming these malwares? As Matthew describes it, this sounds particularly scary. I find the dramatic one day increase of antivirus scanners able to detect the latest version of Shylock to be impressive (from 1 to 25). But is that encouraging to others? Should that number be higher?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/19/2013 | 9:21:38 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"How now, Shylock! What news among the merchants?" ... ??
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
9/19/2013 | 6:19:34 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"Shylock" is attacking banks? Start rounding up Shakespeare scholars who are also hackers.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?