Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

6/5/2013
01:01 PM
50%
50%

ZeuS Malware Returns, Targets SMBs

ZeuS banking Trojan again puts small and midsize businesses at high risk. Here's what you need to know.

The Syrian Electronic Army: 9 Things We Know
(click image for larger view)
The Syrian Electronic Army: 9 Things We Know
Even criminals need to periodically retool their operations for current market conditions.

The ZeuS/ZBot malware has resurfaced "with a vengeance," according to Trend Micro security researchers. The "new" ZeuS is ultimately a matter of economics, according to Symantec Security Response director Kevin Haley. The data-stealing malware hadn't been eradicated, per se -- it was just getting a profit-minded makeover.

"Like legitimate software, malware goes through revisions and new releases," Haley said in an email to InformationWeek. "These new releases include improvements or new features that make them popular and increase their prevalence. ZeuS is no different."

ZeuS's second verse is much the same as the first; though technically a new threat, the fundamentals here should all sound familiar. The malware is good at stealing data off of infected machines. Banking credentials are the favorite target. And while ZeuS doesn't discriminate, smaller companies are especially vulnerable to its fallout.

[ Read more about ZeuS's renewed presence on Facebook: Zeus Bank Malware Surges On Facebook. ]

"Small businesses have a bulls-eye on their back," Haley said. The reasoning is the stuff of sound -- albeit illegal -- market research: Small and midsize businesses (SMBs) have more money than the average individual, but often have less security protection than large enterprises. Bank accounts typically top the list of security risks inside SMBs, and Haley doesn't expect that to change any time soon.

Like phishing and other "old" scams, ZeuS is back because it works -- very well, in some cases. In 2009, for example, hackers lifted $588,000 from a Maine construction company's bank account before the theft was detected. A ZeuS variant was later found on an employee's computer, according to court documents. The company, Patco, sued its bank for the $345,000 it couldn't recover, a watershed case for determining financial responsibility in such instances of online fraud. (Business accounts don't come with the same regulatory protections as consumer accounts.) Patco lost, but a federal appeals court later overturned the verdict.

The advice for defending against the ZeuS reboot and similar threats should also sound familiar. (If not, you've got work to do.) Use strong security technologies. Educate, train and test employees on security policies and risks; don't assume common sense rules the day, nor that "everyone" knows a phishing email or malicious Facebook link when they see one. Everyone does not, and even those that do make mistakes. In a case similar to Patco's, the controller at a midsize business clicked on a link in an email that appeared to be from Comerica, the company's bank. After entering the corporate username and password, crooks initiated offshore wire transfers totaling more than $1.9 million -- and ultimately made off with more than $560,000 after the bank's fraud protocols kicked into gear.

Symantec's Haley recommends spending extra training time with finance pros and any other employees with access to corporate financial accounts or other high-risk credentials. Such access should be granted judiciously, too. Every employee with access is a data breach-in-waiting, especially with ubiquitous social media usage and growing social engineering threats.

"Limit the number of people who have login and password access to bank accounts," Haley said. "And seriously consider dedicating machines to only banking. Email and Web browsing are popular infection vectors for Zeus, so avoiding those activities will significantly lower the risk of a machine used for online banking from getting infected."

The extra security effort is worth it, lest you log in one morning to find the corporate coffers have been cleaned out. "An infection like ZeuS can be devastating to a small business," Haley said.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
sandydoll
50%
50%
sandydoll,
User Rank: Apprentice
6/6/2013 | 3:26:53 AM
re: ZeuS Malware Returns, Targets SMBs
While the "dedicated PC" may be be better than doing nothing, there are numerous problems with this advice. First it only takes one forgetful moment of PC use for an employee to compromise the Gǣdedicated PCGǥ with a drive-by download. Sadly, this happens too often as even trained security experts are vulnerable to human error.
Secondly, most PCs will be configured with local network sharing enabled which permit machines on the same LAN already infected to launch attacks on the Gǣdedicated PCGǥ used for banking. And third, the data shows anti-virus software is only about 5% effective protecting the user from the latest malware.

There is far better security for online banking and fortunately it's free. CyberShield-OS is a bootable Linux designed specifically to protect online banking and it runs on any Intel PC. It delivers better security than the "dedicated PC" and doesn't require buying another PC. It functions as a "read-only" "self-destroying" OS so every bank session gets an exact unaltered copy of the code on the bootable USB. Further, it has an auto-configuring firewall which permits access to and from the Internet while blocking local LAN access and preventing attack by infected machines on the same network. There are additional security measures.

CyberShield-OS is used in over 70 countries and is available as a free download. The site has video tutorials that explain everything. www.cybershieldsolutions.com
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This gives a new meaning to blind leading the blind.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-28815
PUBLISHED: 2021-06-16
Insecure storage of sensitive information has been reported to affect QNAP NAS running myQNAPcloud Link. If exploited, this vulnerability allows remote attackers to read sensitive information by accessing the unrestricted storage mechanism. This issue affects: QNAP Systems Inc. myQNAPcloud Link vers...
CVE-2021-3535
PUBLISHED: 2021-06-16
Rapid7 Nexpose is vulnerable to a non-persistent cross-site scripting vulnerability affecting the Security Console's Filtered Asset Search feature. A specific search criterion and operator combination in Filtered Asset Search could have allowed a user to pass code through the provided search field. ...
CVE-2021-32685
PUBLISHED: 2021-06-16
tEnvoy contains the PGP, NaCl, and PBKDF2 in node.js and the browser (hashing, random, encryption, decryption, signatures, conversions), used by TogaTech.org. In versions prior to 7.0.3, the `verifyWithMessage` method of `tEnvoyNaClSigningKey` always returns `true` for any signature that has a SHA-5...
CVE-2021-32623
PUBLISHED: 2021-06-16
Opencast is a free and open source solution for automated video capture and distribution. Versions of Opencast prior to 9.6 are vulnerable to the billion laughs attack, which allows an attacker to easily execute a (seemingly permanent) denial of service attack, essentially taking down Opencast using...
CVE-2021-32676
PUBLISHED: 2021-06-16
Nextcloud Talk is a fully on-premises audio/video and chat communication service. Password protected shared chats in Talk before version 9.0.10, 10.0.8 and 11.2.2 did not rotate the session cookie after a successful authentication event. It is recommended that the Nextcloud Talk App is upgraded to 9...