Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/5/2010
09:04 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Gozi Trojan Variant Evades AV

TrustDefender Labs analysis shows increasing threats of Trojans

5th November 2010: The recent TrustDefender Labs report has alarmingly discovered another variant of the Gozi Trojan with a 0% detection rate. TrustDefender Labs has recently re-analysed the Trojan Gozi, (pronounced goh'-zee), which has been showing fraudulent attacks since 2007. Their research highlights how the Gozi Trojan is professional, efficient and attacks financial institutions worldwide by managing to stay under the radar and remain undetectable. By targeting specific financial institutions (mainly business and corporate banking in the US) Gozi endeavours not to attract industry attention with this approach. While everybody is talking about Zeus, Gozi can do its dirty work.

During the TrustDefender Labs tests the Gozi Trojan was invisible to all leading anti-virus software, allowing it to infiltrate and attack user’s systems and browsers. The new Gozi variant has many of the same characteristics of its predecessor (researched 12 months ago) however, is showing increasing sophistication in HTML injection compared to other Trojans. Gozi perpetrators have been successfully evading signature patterns so consistently that the evolution of the Trojan has been relatively unknown. This highlights the potential risks and impacts of attacks on financial institutions, businesses and individuals whilst staying predominantly undetectable to any anti-virus software.

Online Security expert and CTO of TrustDefender, Andreas Baumhof comments; “Gozi is unbelievably good at staying under the radar from an infection point of view, but this particular sample also used SSL and HTTPS against the good guys. Typically designed to protect us, the fraudulent use of HTTPS helps them to stay virtually invisible for their C&C server connection. Alarmingly we are coming across an increasing number of Trojans that are using SSL and HTTPS to cover their tracks. The other thing that impressed us was the extensive client-side logic to circumvent even Two-Factor Authentication. Unfortunately this is becoming more common as we see similar techniques with Trojans such as Zeus, Spyeye, Carberp.”

Why should we be worried about Gozi?

-- Gozi is one of the most sophisticated Trojans out there with an impressive feature set.

-- Gozi can use encrypted HTTPS connection for its C&C server communication with a valid certificate meaning it can evade detection.

-- Traditional anti-virus software is unable to detect the Gozi Trojan

-- Gozi features an extensive client side logic (in JavaScript) to be able to work with many different banking websites and also allowing it to steal static information (such as maiden name) and also dynamic password schemes (such as Two-Factor Authentication and One-Time-Passwords). This is similar to Zeus, Spyeye, Carberp and Silon

-- Gozi enables real time account takeover that even works with Two-Factor Authentication.

For more information visit:

www.trustdefender.com and www.trustdefender.com/blog

For any further media information or an interview contact:

Sharon Ghatora or Monique Jones Taurus Marketing

Phone: +61 2 9415 4528 or +61 416 890 648 / +61 413 689 343

Email: [email protected] / [email protected]

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/23/2020
Russian Military Officers Unmasked, Indicted for High-Profile Cyberattack Campaigns
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/19/2020
Modern Day Insider Threat: Network Bugs That Are Stealing Your Data
David Pearson, Principal Threat Researcher,  10/21/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27187
PUBLISHED: 2020-10-26
An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker on the local machine can replace /etc/fstab, and execute mount and other partitioning related command...
CVE-2020-7752
PUBLISHED: 2020-10-26
This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.
CVE-2020-7127
PUBLISHED: 2020-10-26
A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2.
CVE-2020-7196
PUBLISHED: 2020-10-26
The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or retrieval. Specifically, they display the kdc_admin_password in the source file of the ur...
CVE-2020-7197
PUBLISHED: 2020-10-26
SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* U...