Attacks/Breaches
9/19/2013
11:33 AM
50%
50%

Shylock Malware Resurges, Targets Top U.S. Banks

Major U.S. financial firms are being targeted by tough-to-detect malware that can steal money while customers access their online accounts.

Beware the latest version of the banking malware known as Shylock -- also called Caphaw -- which has been retooled to target customers of 24 different banks.

Security firm Zscaler reported Wednesday that over the last month it's seen the number of Shylock infections surge. While the malware was first spotted in 2011 and was seen earlier this year targeting European banking customers, the latest version of the Trojan application now targets customers of the four largest U.S. banks -- Chase Manhattan Corporation, Bank of America, Citi Private Bank and Wells Fargo -- as well as Bank of the West, Capital One, U.S. Bancorp and others.

Shylock is better than most banking malware, which typically siphons up a user's banking credentials and relays them to attackers for later use. "This is one of the few pieces of malware that can automatically steal money when the user is actively accessing his banking account," read an analysis of Caphaw published earlier this year by ESET security researcher Aleksandr Matrosov. Other malware with this capability includes Carberp, Gataka, Ranbyus and Tinba.

[ Use Internet Explorer? Be careful where you browse. See Microsoft: Beware IE Zero-Day Attacks. ]

Shylock, which hides in Windows Explorer, can also hook itself to the operating system in a way that allows it to control the reboot/shutdown process and makes it possible for the malware to restore itself after some antivirus cleaning procedures have been carried out, Matrosov said.

The previous iteration of Caphaw largely targeted banks in Britain, Denmark, Italy and Turkey.

To date, it's not clear how people are being infected with the latest version of Shylock, although Zscaler ThreatLabZ security researchers Sachin Deodhar and Chris Mannon said in a blog post that "it is more than likely arriving as part of an exploit kit [homing] in on vulnerable versions of Java." That's because infected devices that communicate with Shylock command-and-control (C&C) servers have an HTTP "user-agent" header listed as "Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_07." In other words, infected devices seen to date are running both Windows XP and a version of Java 6 that dates from 2008. Needless to say, that version of Java contains a number of known -- and exploitable -- vulnerabilities.

Don't expect antivirus software to reliably stop Shylock, since it's been built so that every infection looks slightly different to help it sneak past antivirus scanners. As of Wednesday, only one out of 46 antivirus scanners could detect the latest version of Shylock, though by Thursday 25 out of 48 scanners were spotting it. "The variation in the dropped executable is different across every instance, so it's no wonder standard AV is having a problem keeping up," said Zscaler's Deodhar and Mannon. "This AV performance also indicates that the likelihood of someone proactively catching this infection inside their network is fairly low at the time of this writing."

To further hide its activities, the malware also makes use of a domain generation algorithm, which keeps the malware's lines of communication -- encrypted via SSL -- synchronized with a constantly changing roster of C&C servers sporting quasi-random names. These servers receive stolen data, send commands to infected PCs, and can also push plug-ins that transform the infection into a rootkit, make a video recording of a user's PC session, allow the malware to spread via removable media and shared drives, and copy information from Microsoft Outlook personal folder (.pst) files.

Thanks to the C&C servers' quasi-random names, actually finding and shutting them down can be difficult. "The large number of potential rendezvous points with randomized names makes it extremely difficult for investigators and law enforcement agencies to identify and 'take down' the [C&C] infrastructure," said the Zscaler researchers. "Furthermore, by using encryption, it adds another layer of difficulty to the process of identifying and targeting the command and control assets."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/1/2013 | 10:24:14 AM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Becca, Shylock was named by Trusteer, which discovered the financial malware in 2011. "We codenamed it Shylock because every new build bundles random excerpts from Shakespeare's The Merchant of Venice in its binary," wrote Trusteer at the time. "These are designed to change the malwareG«÷s file signature to avoid detection by anti-virus programs."
Becca Lipman
50%
50%
Becca Lipman,
User Rank: Apprentice
9/24/2013 | 10:04:56 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Who is in charge of naming these malwares? As Matthew describes it, this sounds particularly scary. I find the dramatic one day increase of antivirus scanners able to detect the latest version of Shylock to be impressive (from 1 to 25). But is that encouraging to others? Should that number be higher?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/19/2013 | 9:21:38 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"How now, Shylock! What news among the merchants?" ... ??
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
9/19/2013 | 6:19:34 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"Shylock" is attacking banks? Start rounding up Shakespeare scholars who are also hackers.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4720
Published: 2014-12-27
Hillstone HS TFTP Server 1.3.2 allows remote attackers to cause a denial of service (daemon crash) via a long filename in a (1) RRQ or (2) WRQ operation.

CVE-2012-1203
Published: 2014-12-27
Cross-site request forgery (CSRF) vulnerability in starnet/index.php in SyndeoCMS 3.0 and earlier allows remote attackers to hijack the authentication of administrators for requests that add user accounts via a save_user action.

CVE-2013-4663
Published: 2014-12-27
git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the service parameter to info/refs, related to the get_info_refs function or (2) the reqfile argument to the file_exists function.

CVE-2013-4793
Published: 2014-12-27
The update function in umbraco.webservices/templates/templateService.cs in the TemplateService component in Umbraco CMS before 6.0.4 does not require authentication, which allows remote attackers to execute arbitrary ASP.NET code via a crafted SOAP request.

CVE-2013-5958
Published: 2014-12-27
The Security component in Symfony 2.0.x before 2.0.25, 2.1.x before 2.1.13, 2.2.x before 2.2.9, and 2.3.x before 2.3.6 allows remote attackers to cause a denial of service (CPU consumption) via a long password that triggers an expensive hash computation, as demonstrated by a PBKDF2 computation, a si...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.