Vulnerabilities / Threats
7/23/2013
12:38 PM
50%
50%

Russian Trojan With Twist Targets Financial Details

Malware, designed to not infect Russian or Ukrainian PCs, is already for sale on cybercrime underground, says RSA.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
For sale: State-of-the-art banking Trojan, just $5,000 via the WebMoney (WMZ) payment system.

So goes the sales pitch for "a new professional-grade banking Trojan" spotted by security firm RSA. Dubbed Kins, the software promises to fill a gap in the financial malware world left by the source code for the easy-to-use Zeus malware published in 2011, and Citadel -- which offered not only a range of features but also high-grade technical support -- withdrawn from sale in cybercrime marketplaces in December 2012.

"Underground chatter increasingly reflects the growing appetite for new, 'real' banking malware in the online fraud arena, featuring discussions by criminals who would eagerly welcome a new developer and jointly finance a banker project if one would only make sense to them," said RSA cyber intelligence researcher Limor Kessem in a Tuesday blog post.

[ Is telecom equipment maker Huawei engaged in espionage? Read Huawei Spies For China, Former NSA Director Says. ]

Enter Kins, which RSA said it first began hearing chatter about in February 2013. Earlier this month, meanwhile, "a vendor in a closed Russian-speaking online forum announced the open sale of the Trojan to the cybercrime community," said Kessem.

The related "software sale" bulletin, written in Russian, says the bot includes both a dropper and Zeus-compatible DLLs, which are used for malicious Web injections, to disguise the malware's manipulation of online banking accounts.

The developer behind Kins promised that the Trojan can infect a PC deep at the volume boot record (VBR) level, where it's harder for antivirus software to detect. The developer also said that the malware includes features designed to help it evade Trojan trackers, which have been used by security researchers to bring down numerous botnet command-and-control systems, including SpyEye.

The malware's developer advertised the base version of the Trojan for $5,000, but said additional modules are also for sale, including a plug-in for $2,000 that's designed to disable the financial malware defense tool Rapport. Kins' developers also promised technical support for all Windows 8 users and said they have "plans for further development," including a module that will scan infected PCs for the presence of software that uses the remote desktop protocol (RDP). If RDP is present, remote attackers would have an easy-to-use and hard-to-detect mechanism for gaining full remote control of an infected PC.

Who built Kins? Assuming the software is real, it appears to be built by Russian or Ukrainian criminals. "Kins does not work on Russian-language systems. If Russian or Ukrainian specs are detected, the Trojan will terminate," said Kessem. That suggests that Kins' developer is abiding a long-standing agreement between cybercriminals and authorities in both of those countries: If the criminals refrain from targeting locals and agree to provide occasional pro bono work to the country's security services, then government authorities turn a blind eye to their online crime campaigns -- or in this case, financial malware development efforts.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3407
Published: 2014-11-27
The SSL VPN implementation in Cisco Adaptive Security Appliance (ASA) Software 9.3(.2) and earlier does not properly allocate memory blocks during HTTP packet handling, which allows remote attackers to cause a denial of service (memory consumption) via crafted packets, aka Bug ID CSCuq68888.

CVE-2014-4829
Published: 2014-11-27
Cross-site request forgery (CSRF) vulnerability in IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allows remote attackers to hijack the authentication of arbitrary users for requests tha...

CVE-2014-4831
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to hijack sessions via unspecified vectors.

CVE-2014-4832
Published: 2014-11-27
IBM Security QRadar SIEM and QRadar Risk Manager 7.1 before MR2 Patch 9 and 7.2 before 7.2.4 Patch 1, and QRadar Vulnerability Manager 7.2 before 7.2.4 Patch 1, allow remote attackers to obtain sensitive cookie information by sniffing the network during an HTTP session.

CVE-2014-4883
Published: 2014-11-27
resolv.c in the DNS resolver in uIP, and dns.c in the DNS resolver in lwIP 1.4.1 and earlier, does not use random values for ID fields and source ports of DNS query packets, which makes it easier for man-in-the-middle attackers to conduct cache-poisoning attacks via spoofed reply packets.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?