Vulnerabilities / Threats
2/22/2011
02:13 PM
50%
50%

OddJob, Zeus Mitmo Trojans Target Financial Data

The malware aims for bank accounts and financial details, warn security researchers at Trusteer and F-Secure.

Top 10 Security Stories Of 2010
(click image for larger view)
Slideshow: Top 10 Security Stories Of 2010

Hide your bank account details, as two new pieces of banking malware are making the rounds: the OddJob Trojan, which keeps banking sessions open after users log out, as well as a variant of Zeus Mitmo that targets Symbian and BlackBerry smartphones.

On Tuesday, browser security firm Trusteer warned that the OddJob malware could keep banking Web site sessions open even after users thought they'd logged off. "By tapping the session ID token -- which banks use to identify a user's online banking session -- the fraudsters can electronically impersonate the legitimate user and complete a range of banking operations," according to a blog post from Amit Klein, CTO of security firm Trusteer.

Trusteer discovered OddJob several months ago, but withheld disclosing details until law enforcement agencies concluded related investigations. It said that the malware has targeted customers in the United States, Poland, and Denmark, and appeared to be the work of criminals based in eastern Europe.

Interestingly, rather than writing its configuration to disk -- which might trip security software alarms -- OddJob fetches a new configuration from the cloud, by querying its command-and-control server every time a user opens a new browser session. These sessions can be tracked by criminals in real time, allowing them to select which ones they'd like to hijack.

Expect OddJob to evolve. "The most interesting aspect of this malware is that it appears to be a work in progress, as we have seen differences in hooked functions in recent days and weeks, as well as the way the command-and-control protocols operate," said Klein.

Meanwhile, the other new piece of financial malware is a Zeus Mitmo variant that targets Polish banking customers. According to a blog post from Sean Sullivan, a security advisor at antivirus and security firm F-Secure, the variant "is targeting the mobile-phone-based, two-factor authentication used by ING Bank Slaski," which is ING Bank in Poland. He said this Mitmo variant resembles one seen in September 2010 that targeted Spanish banking customers.

"Computers infected with a ZeuS Mitmo Trojan will inject a 'security notification' into the Web banking process, attempting to lure the user into providing their phone number," said Sullivan. "If a phone number is provided, the user will receive an SMS link pointing to the mobile component, ZeusMitmo.A." Clicking on the link then presents Symbian and BlackBerry users with Zeus Mitmo malware tailored to their smartphone.

The goal of Zeus Mitmo is to create fraudulent transactions using the mobile device, while subverting the bank's security procedures. In particular, the malware's mobile component creates a man-in-the-middle attack that steals the one-time password that some banks send via SMS to authorize a financial transaction, which are also known as mobile transaction authentication numbers (mTANs). By hijacking this security verification process, Zeus Mitmo disguises its fraudulent activities from users.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4807
Published: 2014-11-22
Sterling Order Management in IBM Sterling Selling and Fulfillment Suite 9.3.0 before FP8 allows remote authenticated users to cause a denial of service (CPU consumption) via a '\0' character.

CVE-2014-6183
Published: 2014-11-22
IBM Security Network Protection 5.1 before 5.1.0.0 FP13, 5.1.1 before 5.1.1.0 FP8, 5.1.2 before 5.1.2.0 FP9, 5.1.2.1 before FP5, 5.2 before 5.2.0.0 FP5, and 5.3 before 5.3.0.0 FP1 on XGS devices allows remote authenticated users to execute arbitrary commands via unspecified vectors.

CVE-2014-8626
Published: 2014-11-22
Stack-based buffer overflow in the date_from_ISO8601 function in ext/xmlrpc/libxmlrpc/xmlrpc.c in PHP before 5.2.7 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code by including a timezone field in a date, leading to improper XML-RPC encoding...

CVE-2014-8710
Published: 2014-11-22
The decompress_sigcomp_message function in epan/sigcomp-udvm.c in the SigComp UDVM dissector in Wireshark 1.10.x before 1.10.11 allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted packet.

CVE-2014-8711
Published: 2014-11-22
Multiple integer overflows in epan/dissectors/packet-amqp.c in the AMQP dissector in Wireshark 1.10.x before 1.10.11 and 1.12.x before 1.12.2 allow remote attackers to cause a denial of service (application crash) via a crafted amqp_0_10 PDU in a packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?