Attacks/Breaches
12/2/2013
10:57 AM
Dark Reading
Dark Reading
Products and Releases
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Experts Predict Mass Attacks On Online Banking Users

Neverquest Trojan banker supports almost every trick used to bypass online banking security system

Kaspersky Lab has recorded several thousand attempts to infect computers used for online banking with a malicious program that its creators claim can attack "any bank in any country". The Neverquest Trojan banker supports almost every trick used to bypass online banking security systems, including web injection, remote system access and social engineering. Due to the Trojan's self-replication capabilities, Kaspersky Lab is warning a sharp rise in the number of attacks involving Neverquest can be expected, resulting in financial losses for users all over the world.

The weeks prior to Christmas are traditionally a period of high malicious user activity. As early as November there have been instances where posts were made in hacker forums about buying and selling databases to access bank accounts and other documents, which are used to open and manage the accounts to which stolen funds are sent. Neverquest appeared on the market even earlier - an advert looking for a partner to work with the Trojan on the servers of a group of cybercriminals, with their support, was posted in July of this year.

Sergey Golovanov, Principal Security Researcher, Kaspersky Lab, commented:

"After wrapping up several criminal cases associated with the creation and proliferation of malware used to steal bank website data, a few 'holes' appeared on the black market. New malicious users are trying to fill these with new technologies and ideas. Neverquest is just one of the threats aiming to take over the leading positions previously held by programs like ZeuS and Carberp."

Neverquest steals usernames and passwords to bank accounts as well as all the data entered by the user into the modified pages of a banking website. Special scripts for Internet Explorer and Firefox are used to facilitate these thefts, giving the malware control of the browser connection with the cybercriminal's command server when visiting the sites of 28 sites on the list, including those that belong to large international banks, sites of German, Italian, Turkish and Indian banks, as well as payment systems. Another function of Neverquest helps the malicious users replenish their list of targeted banks and develop code to be seeded on new websites, extending the target list.

Of all of the sites targeted by this particular program, an investment fund appears to be the top target. Its website offers clients a long list of ways to manage their finances online. This gives malicious users the chance to not only transfer cash funds to their own accounts but also to play the stock market, using the accounts and the money of Neverquest victims.

After gaining access to a user's account with an online banking system, cybercriminals conduct transactions and wire money from the user to their own accounts or - to keep the trail from leading directly to them - to the accounts of other victims.

Protection against threats such as Neverquest requires more than just standard antivirus; users need a dedicated solution that secures transactions

[http://www.securelist.com/en/analysis/204792304/Staying_safe_from_virtual_robbers#12

]. In particular, the solution must be able to control a running browser process and prevent any manipulation by other applications.

The full version of the expert article dedicated to Neverquest is available at securelist.com [http://www.securelist.com/en/analysis/204792315/Online_banking_faces_a_new_threat

].

About Kaspersky Lab

Kaspersky Lab is the world's largest privately held vendor of endpoint protection solutions. The company is ranked among the world's top four vendors of security solutions for endpoint users*. Throughout its more than 16-year history Kaspersky Lab has remained an innovator in IT security and provides effective digital security solutions for large enterprises, SMBs and consumers.

Kaspersky Lab, with its holding company registered in the United Kingdom, currently operates in almost 200 countries and territories across the globe, providing protection for over 300 million users worldwide. Learn more at http://www.kaspersky.co.uk. [http://www.kaspersky.co.uk ]

* The company was rated fourth in the IDC rating Worldwide Endpoint Security Revenue by Vendor, 2012. The rating was published in the IDC report "Worldwide Endpoint Security 2013-2017 Forecast and 2012 Vendor Shares (IDC #242618, August 2013). The report ranked software vendors according to earnings from sales of endpoint security solutions in 2012.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2012-0871
Published: 2014-04-18
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.

CVE-2012-6646
Published: 2014-04-18
F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors.

CVE-2013-4279
Published: 2014-04-18
imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl version) to the developer's site.

Best of the Web