Vulnerabilities / Threats
1/8/2016
03:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Japanese Banks Targeted With New Rovnix Trojan

US organizations need to monitor such threats because cyber criminals can easily modify and migrate such threats for use here, IBM says.

The language barrier that for long protected Japanese banks from being targeted by Trojan attacks appears to have been decisively overcome by cybercrime groups if the sustained attacks against the nation’s financial institutions over the past few months are any indication.

The latest manifestation of that trend is Rovnix, an advanced malware tool that is currently being used to target customers at as many as 14 major Japanese banks.

IBM’s X-Force security researchers have been tracking the banking Trojan for the past several months and this week described the Rovnix campaign against the banks as “nothing short of an onslaught.” The infection campaigns, which began in early December, include the use of email messages with an attachment containing the Rovnix downloader. Recipients who click on the attachment -- typically disguised as a package delivery waybill from an international transport company -- end up downloading the malware on their systems.

Until recently, the operators of Rovnix have used the malware mainly to target banks in Europe. But more recently, Rovnix’ configuration file appears to have been uniquely adapted to target banks in Japan, IBM researchers found. The malware contains attack schemes that have been specifically customized for each of the targeted banks.

Rovnix uses a Web injection mechanism that is capable of perfectly imitating a targeted bank’s Web pages. When a user with an infected computer visits the web page of a targeted bank, Rovnix serves up Web pages that look and feel exactly like the bank’s actual site. The malware is even capable of adapting itself to whatever authentication process the user might employ to log into the account. For instance, Rovnix in some cases tries to get victims to download a malicious Android app on their smartphone so it can intercept authorization codes send via SMS by the bank.

“For each bank, the injections used by Rovnix modify large parts of the original page, which is designed to trick the victim into divulging the second password or token for the ensuing fraudulent transaction,” IBM cybersecurity evangelist Limor Kessem wrote.

The use of convincing-sounding Japanese language email messages to distribute Rovnix and the level of customization that has gone into the attacks suggests that the gang behind Rovnix has put some thought into its campaign in Japan, IBM noted. The malware continues a trend that began last summer when cybercrime gangs suddenly turned their attention on Japanese banks after mostly ignoring it for the past several years. Since then, financial services companies in the country have been hammered by a succession of banking Trojans including Shifu and Tsukuba.

Etay Maor, senior cybersecurity strategist at IBM Security, says US organizations need to keep an eye on threats like Rovnix because of the ease with which cybercriminals can modify such malware for use here.

“Companies should pay specific attention to the amount of effort the attackers have put into this campaign as it shows the attackers studied how individual banks work, uncovered their security measures, and developed specific schemes for them,” Maor says.

The attackers put in the effort because they knew they could generate significant revenue through the campaign, he says. “It’s important for banks and financial institutions to monitor for these types of threats and campaigns as they can be quickly migrated to target the United States – or wherever [the attackers] determine is worth the investment.”

The growing sophistication of such malware is also a worry. Rovnix, for instance, has employed extensive mechanisms to protect against known security tools. The malware also leverages digital signatures in all communications and even uses code before the malware reaches the device to detect any anti-virus software or security measures that may be present on it, Maor says. “It uses many different modules to look into the device and be persistent in its attack. “

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: You should see what I wear on my work from home days!
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.