Attacks/Breaches
9/19/2013
11:33 AM
Connect Directly
RSS
E-Mail
50%
50%

Shylock Malware Resurges, Targets Top U.S. Banks

Major U.S. financial firms are being targeted by tough-to-detect malware that can steal money while customers access their online accounts.

Beware the latest version of the banking malware known as Shylock -- also called Caphaw -- which has been retooled to target customers of 24 different banks.

Security firm Zscaler reported Wednesday that over the last month it's seen the number of Shylock infections surge. While the malware was first spotted in 2011 and was seen earlier this year targeting European banking customers, the latest version of the Trojan application now targets customers of the four largest U.S. banks -- Chase Manhattan Corporation, Bank of America, Citi Private Bank and Wells Fargo -- as well as Bank of the West, Capital One, U.S. Bancorp and others.

Shylock is better than most banking malware, which typically siphons up a user's banking credentials and relays them to attackers for later use. "This is one of the few pieces of malware that can automatically steal money when the user is actively accessing his banking account," read an analysis of Caphaw published earlier this year by ESET security researcher Aleksandr Matrosov. Other malware with this capability includes Carberp, Gataka, Ranbyus and Tinba.

[ Use Internet Explorer? Be careful where you browse. See Microsoft: Beware IE Zero-Day Attacks. ]

Shylock, which hides in Windows Explorer, can also hook itself to the operating system in a way that allows it to control the reboot/shutdown process and makes it possible for the malware to restore itself after some antivirus cleaning procedures have been carried out, Matrosov said.

The previous iteration of Caphaw largely targeted banks in Britain, Denmark, Italy and Turkey.

To date, it's not clear how people are being infected with the latest version of Shylock, although Zscaler ThreatLabZ security researchers Sachin Deodhar and Chris Mannon said in a blog post that "it is more than likely arriving as part of an exploit kit [homing] in on vulnerable versions of Java." That's because infected devices that communicate with Shylock command-and-control (C&C) servers have an HTTP "user-agent" header listed as "Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_07." In other words, infected devices seen to date are running both Windows XP and a version of Java 6 that dates from 2008. Needless to say, that version of Java contains a number of known -- and exploitable -- vulnerabilities.

Don't expect antivirus software to reliably stop Shylock, since it's been built so that every infection looks slightly different to help it sneak past antivirus scanners. As of Wednesday, only one out of 46 antivirus scanners could detect the latest version of Shylock, though by Thursday 25 out of 48 scanners were spotting it. "The variation in the dropped executable is different across every instance, so it's no wonder standard AV is having a problem keeping up," said Zscaler's Deodhar and Mannon. "This AV performance also indicates that the likelihood of someone proactively catching this infection inside their network is fairly low at the time of this writing."

To further hide its activities, the malware also makes use of a domain generation algorithm, which keeps the malware's lines of communication -- encrypted via SSL -- synchronized with a constantly changing roster of C&C servers sporting quasi-random names. These servers receive stolen data, send commands to infected PCs, and can also push plug-ins that transform the infection into a rootkit, make a video recording of a user's PC session, allow the malware to spread via removable media and shared drives, and copy information from Microsoft Outlook personal folder (.pst) files.

Thanks to the C&C servers' quasi-random names, actually finding and shutting them down can be difficult. "The large number of potential rendezvous points with randomized names makes it extremely difficult for investigators and law enforcement agencies to identify and 'take down' the [C&C] infrastructure," said the Zscaler researchers. "Furthermore, by using encryption, it adds another layer of difficulty to the process of identifying and targeting the command and control assets."

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/1/2013 | 10:24:14 AM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Becca, Shylock was named by Trusteer, which discovered the financial malware in 2011. "We codenamed it Shylock because every new build bundles random excerpts from Shakespeare's The Merchant of Venice in its binary," wrote Trusteer at the time. "These are designed to change the malwareGÇÖs file signature to avoid detection by anti-virus programs."
Becca Lipman
50%
50%
Becca Lipman,
User Rank: Apprentice
9/24/2013 | 10:04:56 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Who is in charge of naming these malwares? As Matthew describes it, this sounds particularly scary. I find the dramatic one day increase of antivirus scanners able to detect the latest version of Shylock to be impressive (from 1 to 25). But is that encouraging to others? Should that number be higher?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/19/2013 | 9:21:38 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"How now, Shylock! What news among the merchants?" ... ??
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
9/19/2013 | 6:19:34 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"Shylock" is attacking banks? Start rounding up Shakespeare scholars who are also hackers.
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2014-2640
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

CVE-2014-2641
Published: 2014-10-01
Cross-site request forgery (CSRF) vulnerability in HP System Management Homepage (SMH) before 7.4 allows remote authenticated users to hijack the authentication of unspecified victims via unknown vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.