Attacks/Breaches
9/19/2013
11:33 AM
50%
50%

Shylock Malware Resurges, Targets Top U.S. Banks

Major U.S. financial firms are being targeted by tough-to-detect malware that can steal money while customers access their online accounts.

Beware the latest version of the banking malware known as Shylock -- also called Caphaw -- which has been retooled to target customers of 24 different banks.

Security firm Zscaler reported Wednesday that over the last month it's seen the number of Shylock infections surge. While the malware was first spotted in 2011 and was seen earlier this year targeting European banking customers, the latest version of the Trojan application now targets customers of the four largest U.S. banks -- Chase Manhattan Corporation, Bank of America, Citi Private Bank and Wells Fargo -- as well as Bank of the West, Capital One, U.S. Bancorp and others.

Shylock is better than most banking malware, which typically siphons up a user's banking credentials and relays them to attackers for later use. "This is one of the few pieces of malware that can automatically steal money when the user is actively accessing his banking account," read an analysis of Caphaw published earlier this year by ESET security researcher Aleksandr Matrosov. Other malware with this capability includes Carberp, Gataka, Ranbyus and Tinba.

[ Use Internet Explorer? Be careful where you browse. See Microsoft: Beware IE Zero-Day Attacks. ]

Shylock, which hides in Windows Explorer, can also hook itself to the operating system in a way that allows it to control the reboot/shutdown process and makes it possible for the malware to restore itself after some antivirus cleaning procedures have been carried out, Matrosov said.

The previous iteration of Caphaw largely targeted banks in Britain, Denmark, Italy and Turkey.

To date, it's not clear how people are being infected with the latest version of Shylock, although Zscaler ThreatLabZ security researchers Sachin Deodhar and Chris Mannon said in a blog post that "it is more than likely arriving as part of an exploit kit [homing] in on vulnerable versions of Java." That's because infected devices that communicate with Shylock command-and-control (C&C) servers have an HTTP "user-agent" header listed as "Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_07." In other words, infected devices seen to date are running both Windows XP and a version of Java 6 that dates from 2008. Needless to say, that version of Java contains a number of known -- and exploitable -- vulnerabilities.

Don't expect antivirus software to reliably stop Shylock, since it's been built so that every infection looks slightly different to help it sneak past antivirus scanners. As of Wednesday, only one out of 46 antivirus scanners could detect the latest version of Shylock, though by Thursday 25 out of 48 scanners were spotting it. "The variation in the dropped executable is different across every instance, so it's no wonder standard AV is having a problem keeping up," said Zscaler's Deodhar and Mannon. "This AV performance also indicates that the likelihood of someone proactively catching this infection inside their network is fairly low at the time of this writing."

To further hide its activities, the malware also makes use of a domain generation algorithm, which keeps the malware's lines of communication -- encrypted via SSL -- synchronized with a constantly changing roster of C&C servers sporting quasi-random names. These servers receive stolen data, send commands to infected PCs, and can also push plug-ins that transform the infection into a rootkit, make a video recording of a user's PC session, allow the malware to spread via removable media and shared drives, and copy information from Microsoft Outlook personal folder (.pst) files.

Thanks to the C&C servers' quasi-random names, actually finding and shutting them down can be difficult. "The large number of potential rendezvous points with randomized names makes it extremely difficult for investigators and law enforcement agencies to identify and 'take down' the [C&C] infrastructure," said the Zscaler researchers. "Furthermore, by using encryption, it adds another layer of difficulty to the process of identifying and targeting the command and control assets."

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
OtherJimDonahue
50%
50%
OtherJimDonahue,
User Rank: Apprentice
9/19/2013 | 6:19:34 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"Shylock" is attacking banks? Start rounding up Shakespeare scholars who are also hackers.
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/19/2013 | 9:21:38 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
"How now, Shylock! What news among the merchants?" ... ??
Becca Lipman
50%
50%
Becca Lipman,
User Rank: Apprentice
9/24/2013 | 10:04:56 PM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Who is in charge of naming these malwares? As Matthew describes it, this sounds particularly scary. I find the dramatic one day increase of antivirus scanners able to detect the latest version of Shylock to be impressive (from 1 to 25). But is that encouraging to others? Should that number be higher?
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/1/2013 | 10:24:14 AM
re: Shylock Malware Resurges, Targets Top U.S. Banks
Becca, Shylock was named by Trusteer, which discovered the financial malware in 2011. "We codenamed it Shylock because every new build bundles random excerpts from Shakespeare's The Merchant of Venice in its binary," wrote Trusteer at the time. "These are designed to change the malwareGÇÖs file signature to avoid detection by anti-virus programs."
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?