Vulnerabilities / Threats
2/8/2011
03:59 PM
50%
50%

Enhanced SpyEye Trojan Poses New Threats

Features from Zeus crimeware toolkit lets SpyEye grab credit card numbers from hacked PCs and allows users to upgrade plug-ins after purchase.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010

The Zeus crimeware toolkit lives on. Since its developer reportedly bequeathed the application's code base to rival SpyEye in October 2010, security researchers have been watching for a hybrid toolkit to emerge.

Now, it's apparently arrived. "We've acquired a sample of version 1.3.05 of the SpyEye builder, which appears to be the result of … said merger," a recent online post from Trend Micro senior threat researcher Loucif Kharouni stated.

Kharouni said the application combines disparate features from previous versions of the two crimeware toolkits. For example, whereas Zeus required buyers to include desired plug-ins from the get-go, SpyEye allowed users to install them after the purchase. Now, the new software will offer some of the plug-in functionality of the former, with the "buy when you like" functionality of the latter.

Of course, a botnet is only as good as its ecosystem of compromised -- aka zombie -- PCs. Here, the hybrid toolkit could be a bigger threat than its predecessors. "The merger of Zeus and SpyEye is significant because it not only puts together two different code bases, but it is also merging two different bot networks, meaning 'SpyZeus' will have a much greater reach," Anup Ghosh, chief scientist of virtual browser protection vendor Invincea, said in an email. "Essentially SpyEye is subsuming the Zeus Trojan kit, network, and user base."

Other features of the new SpyEye include assessments of whether Web injection attacks will work against Firefox, plus better plug-in control and browser cookie clearing. Plug-in options include the ability to steal certificates from Windows cryptographic storage, a tool for faking HTTP and HTTPS Web pages in IE and Firefox -- without having to connect to the original Web server -- as well as an FTP back door and bug reporter.

According to Trend Micro, SpyEye also actively attempts to evade or disable Rapport, a free secure-browsing tool from Trusteer with a user base numbering in the millions. About 70 financial services institutions also actively push the software to their customers.

Of course, targeting isn't the same as disabling. In the wake of the Trend Micro analysis, Trusteer revealed that Zeus has been targeting Rapport for some time, which is information it's shared with business partners, but not the general public or competitors. "Zeus has been launching direct attacks against Trusteer for the last couple of years now. There are several different attacks against Rapport incorporated into different versions of Zeus, all of which focus on disabling the software on customer computers. All are successfully blocked by Trusteer," Mickey Boodaei, CEO of Trusteer, said in an email.

In fact, he said that the attack code essentially gives itself away, making it easy to find and eliminate, when it gets hostile and attempts to terminate certain threads -- such as the Rapport thread responsible for blocking HTML injection -- or outright delete files associated with security applications. "It seems to me that in their passion to differentiate service from other malware tools, the authors of SpyEye ignored a simple rule -- for malware it's always better to keep a low profile," Boodaei said.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9209
Published: 2015-03-30
Untrusted search path vulnerability in the Clean Utility application in Rockwell Automation FactoryTalk Services Platform before 2.71.00 and FactoryTalk View Studio 8.00.00 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.