Risk
2/28/2011
05:55 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Sophisticated Trojan Targets Some Banking Sites

S21sec, a Spanish information security firm, claims to have spotted a new Trojan with advanced infiltration and attack techniques.

S21sec, a Spanish information security firm, claims to have spotted a new Trojan with advanced infiltration and attack techniques.This Trojan, named Tatanga, like most banking Trojan, possesses man-in-the-browser capabilities, can inject malicious HTML code into many popular browser types. According to S21sec, the Trojan can conduct banking transactions in the background. The Trojan can display a fake balance, which the end user perceives as the real account balance, while their account is being fleeced.

"The trojan in question is rather sophisticated," the company posted in its research blog. "It is written in C++ and uses rootkit techniques to conceal its presence, though on occasion, its files are visible. The trojan downloads a number of encrypted modules (DLLs), which are decrypted in memory when injected to the browser or other processes to avoid detection by antivirus software," it continued.

Some of those libraries grab email addresses, encrypt and manage the malware's processes, remove other forms of malware on the machine, as well as block installed antivirus applications.

The Trojan can also grab user credentials during the session, including one-time-passwords. The malware relies on both technical attacks as well as social engineering tactics designed to walk users through a transfer they think is a demonstration transfer.

S21sec has a snippet of the Trojan's code on its site.

While the Trojan is currently targeting European banks, mainly in Spain, United Kingdom, Germany, and Portugal - these attacks rarely remain localized.

Unfortunately, according to the security firm, the anti-virus detection rate of this Trojan is currently very low.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2382
Published: 2014-11-20
The DfDiskLo.sys driver in Faronics Deep Freeze Standard and Enterprise 8.10 and earlier allows local administrators to cause a denial of service (crash) and execute arbitrary code via a crafted IOCTL request that writes to arbitrary memory locations, related to the IofCallDriver function.

CVE-2014-3625
Published: 2014-11-20
Directory traversal vulnerability in Pivitol Spring Framework 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2 allows remote attackers to read arbitrary files via unspecified vectors, related to static resource handling.

CVE-2014-8387
Published: 2014-11-20
cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi.

CVE-2014-8493
Published: 2014-11-20
ZTE ZXHN H108L with firmware 4.0.0d_ZRQ_GR4 allows remote attackers to modify the CWMP configuration via a crafted request to Forms/access_cwmp_1.

CVE-2014-8767
Published: 2014-11-20
Integer underflow in the olsr_print function in tcpdump 3.9.6 through 4.6.2, when in verbose mode, allows remote attackers to cause a denial of service (crash) via a crafted length value in an OLSR frame.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?