ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Researchers intercept dangerous new banking Trojan

By | February 10, 2010, 12:13pm PST

Summary: Malware hunters have intercepted a new banker Trojan being used by cyber-criminals to steal financial credentials from banks in the United States.

Malware hunters at SecureWorks have intercepted a new banker Trojan being used by cyber-criminals to steal financial credentials from banks in the United States.

The Trojan, dubbed “Bugat,” targets Automated Clearing House (ACH) and wire transfer transactions by small- and mid-sized business in the U.S., much like the virulent Clampi Trojan that has stolen tens of millions of dollars.

According to SecureWorks researcher Jason Milletary, the Bugat Trojan includes features commonly found in malware used to commit credential theft for financial fraud.

These include:

  • Internet Explorer (IE) and Firefox form grabbing
  • Scrape or modify HTML for targeted sites
  • Steal and delete IE, Firefox, and Flash cookies
  • Steal FTP and POP credentials
  • SOCKS proxy server (v4 and v5)
  • Browse and upload files from the infected computer
  • Download and execute programs
  • Upload list of running processes
  • Delete system files and reboot computer to render Windows unable to boot

The Trojan communicates with a remote command and control web server to receive commands and to exfiltrate stolen information.

As part of this process, the malware also receives a list of URL target strings used to monitor the victim’s web browser activity. These target strings indicate a strong interest in websites used for business banking and wire transfers. Bugat may also use HTTPS in an attempt to secure its command and control communications.

For more information on these types of attacks, see reporting by Brian Krebs on the WaPo SecurityFix blog.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

85
Comments

Join the conversation!

Just In

RE: Researchers intercept dangerous new banking Trojan
FAULKNE 13th Oct
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.
0 Votes
+ -
Could you please clarify?
AzuMao 10th Feb 2010
From

Delete system files and reboot computer to render Windows
unable to boot


I get that it affects Windows.. but does it affect anything else?
Thank you! I'm glad you like it grin chanel bags
Meanwhile those of us already on safe systems can do nothing but watch amused as the drama unfolds.
You can always educate the user but if the machine side is sub-par then no amount of education will be enough to produce a safe system.
0 Votes
+ -
CAUTION HOT!
pupkin_z 10th Feb 2010
I am guessing you are one of those people who have no idea that coffee is hot, ice is slippery, walking on railways is dangerous...

It is a trojan. HOW can machine protect a system if despite the warnings issued by the OS the user deliberately hits the button that says "YES! YES! YES! I AM THAT STUPID. RUN THIS FILE THAT I JUST DOWNLOADED FROM THIS COOL WEB SITE IN NIGERIA THAT PROMISSES ME 100 MILLIONS OF DOLLARS"?
0 Votes
+ -
MS could approve apps for Windows
NonZealot Updated - 10th Feb 2010
MS could prevent the installation of any
Windows application that isn't approved by MS.

HAHAHAHAHAHAHAHAHAHAHAHAHAHAHAHA!!!!!! I'd love
to see the reaction of the Apple cultists after
that one. Considering how much they all
freaked out when it was announced that
all 64 bit Vista drivers would have to be
signed by MS, I can only imagine the outcry if
that policy was extended to apps. Of course,
when Apple does it to block the installation of
competing software, then it is okay.

Cue the double standards...
0 Votes
+ -
Huh?
AzuMao 11th Feb 2010
Why would someone not using Windows get freaked out over
problems in Windows? That makes no sense.


Anyways, the solution already exists and has been in use for a
long time in less crappy OSs. It's called having a software
repository, and everything else being source.
0 Votes
+ -
MS should do exactly that....
arminw 11th Feb 2010
which would get rid of all malware in due time. If Apple had not done
this for their mobile devices, they too would be plagued by this modern
technological scourge. The only ones who would object to this, are the
nerds and techies of this world. The ordinary user type folks are evidently
all for this, as shown by the success of the iTunes app store.
0 Votes
+ -
Yes it is..
AzuMao 11th Feb 2010
..unless by users you mean sysadmins?
0 Votes
+ -
How is your system so safe? Oh, I know
AllKnowingAllSeeing 10th Feb 2010
you never turn it on.

Can't beat that for security.
0 Votes
+ -
.
0 Votes
+ -
Yes you can.
AzuMao 11th Feb 2010
If it's off someone could steal it/replace it with
keyloggers/etc without you knowing.


Anyways, a far easier more practical solution is to use
an OS that was actually designed with security in mind.
0 Votes
+ -
Which would be? (nt)
deanders 11th Feb 2010
NT
0 Votes
+ -
One based on a UNIX-like kernel.
AzuMao 12th Feb 2010
0 Votes
+ -
Nothing to do
gwthornt Updated - 11th Feb 2010
I finally realized why Mac and Linux users post so much to articles about Windows OS, they have nothing else to do. Since they run computers with operating systems that can run only a very small percentage of the available software out there, they have plenty of time to tell us how great their OS is.
an "elite", that needs to remind everyone that they are "elite", is not an "elite", but a bunch of insecure nerds ...
That's how you are being perceived, by other reading your posts.
0 Votes
+ -
that require far less maintenance. They don't have to clean spyware and
other crap out periodically, try to maintain an obtuse registry and other
futzing around with a cantankerous Windows operating system. Windows
7 is a bit better, but still requires more work than a Mac. Macs just work.
That is why Mac users have more time to razz hapless Windows users.
0 Votes
+ -
nt
0 Votes
+ -
No, Mac and Linux users have computers....
raykaville@... 14th Feb 2010
...with limited market share. So little that the "spyware and other crap" developers don't waste their time on them. If either of them actually grab a market share as large as the MS one you'll see the tables turn. Personally, I'd love to see that if only to put MS in a position where they'd have to compete and consider what their users actually want rather than what the marketing personnel and engineers mandate.
0 Votes
+ -
And just how are you going to stop people from downloading malware/virus made just for Linux? Just for argument sake, say everyone moves to linux. Now everyone will want thoses neat icons,cursors,web browser plug ins,nice greeting card, nude women pictures and so on. How is linux going to stop people from infesting themselves? its software they want and will allow access to the system because its what they want.

So tell me and everyone else just how are you going to stop that type of malware/virus infestation??
0 Votes
+ -
In Windows, it is true that you get things by browsing to some random website, downloading an executable, and running it, yes.

But in the Linux world, it works a little differently.
If you download something from your browser, the default is for it not to even be executable. This isn't a problem since you don't use a web browser to install things.
You use a specialized program known as a "package manager" which searches through a trusted repository for programs, and downloads them using the equivalent of HTTPS. Anything to be included in a repository is first peer reviewed.
So it's kind of hard to accidentally install a trojan.
0 Votes
+ -
It's okay, trojans don't count
NonZealot 10th Feb 2010
Whenever trojans are discovered in the wild for OS X, we
get told that trojans don't count.

Cue the double standards...
0 Votes
+ -
Another off-topic comment...
msalzberg 10th Feb 2010
from NonSequitur.
Looks pretty similar to the Bredolab + "dangerous new
banker" interception made and described here last month:

http://blog.threatfire.com/2010/01/bredolab-downloading-
bankingfinancial-service-password-stealers.html
0 Votes
+ -
1. It is not Microsoft.
2. It is a DVD.
3. It protects your hard drive.
4. It supports Firefox with security add-ons.
5. It supports browser updates.

See my articles:
http://www.ciphersbyritter.com/COMPSEC/COMPSEC.HTM
0 Votes
+ -
Dangerous WINDOWS ONLY trojan
whisperycat 11th Feb 2010
Why is no effort being made to highlight the fact that this is a Microsoft Windows only exploit? People with Macs, or who are running Linux, and who don't know much about their OS, would be forgiven for thinking that they too might be affected by this Windows exploit. It's shoddy reporting, or, deliberate underplaying of another colossal Microsoft drop off.

Here are the details on this WINDOWS ONLY exploit -

http://www.symantec.com/security_response/writeup.jsp?docid=2010-013112-4647-99

Discovered: January 25, 2010
Updated: January 31, 2010 3:23:40 PM
Type: Trojan
Infection Length: 51712 Bytes
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000

Trojan.Bugat is a Trojan horse that steals information from the compromised computer and sends it to a remote host.
0 Votes
+ -
Oh Please!!!
Novis_z 11th Feb 2010
When will you anti microsoft people give up? You're not going to change anything. By FAR, the vast majority of pc's in the world are running a MS os. Sure, Mac and Linus are really good operating systems, but face it, whether or not you like it, and you can rant and rave till the cows come home but MS is the hands down TOP system accepted by the public and the majority of businesses. You anti MS people are not going to change the world or save it from itself with all your childish MS bashing. You need to find a hobby
0 Votes
+ -
do not ask them to find a hobby!
hifi@... 11th Feb 2010
It is dangerous!
Who knows what they find next!
0 Votes
+ -
Oh Please!!!
AzuMao 11th Feb 2010
When will you anti anti microsoft people give
up? You're not going to change anything. By FAR,
the vast majority of humans in the world hate
MS. Sure, Mac is an OS and Linus is a person,
but don't let that stop you from ranting and
raving till the cows come home but MS is hands
down HATED by the public and the majority of
businesses. You anti anti MS people are not
going to change the world or save it from
yourselves with all your childish MS
apologizing. You need to find a hobby
0 Votes
+ -
You made a geek smile amongst a series of
unfortunate events that have me in a DFW Airport for
24 hrs. Very poetic and sardonic. My compliments to
your subtle mockery.
0 Votes
+ -
Why target linux
DaveN_MVP 11th Feb 2010
With less than 1% of the market, why would anyone bother to target linux? Wouldn't that be like a bank robber only targeting green and pink striped banks?

It's tiresome for the linux fans to keep pointing out their (relatively) malware-free status. When you slam Microsoft and praise linux, do you point out that people can't run their rich messaging client or their accounting app on linux, or only that viruses don't run on it?
0 Votes
+ -
here
SpikeyMike 16th Feb 2010
http://www.theregister.co.uk/security/security_report_windows_vs_linux/#bursting

Stop with the marketshare rationale - you're not fooling anyone.

For me, adopting Linux was more about unlearning concepts that I developed over the course of several years of experience with Windows (since 3.1 days!).

Explaining it to other people was impossible, until I found this article. It conveys the concept of what Linux is very well. http://linux.oneandoneis2.org/LNW.htm

And, YES you can run your accounting apps on Linux.

-Mike
0 Votes
+ -
I wish more people used Linux
cwallen19803@... 11th Feb 2010
I wish more people used Linux. Then, these guys would target Linux machines and leave Windows machines alone.
0 Votes
+ -
Doubtful.
AzuMao 11th Feb 2010
Low hanging fruit is low hanging fruit, whether
there's more of it or not.
0 Votes
+ -
*nix/Linux
renegade768 11th Feb 2010
Though larger use of one over the other presents a bigger target, it is much harder to infect *nix type OS's because of their makeup, and how they operate.
The original concept was security oriented from the beginning, all newer OS's (Micro$lug) originated from single user, single tasking operation, security was an afterthought.

Anything can be hacked, some are just easier than others (I'll mention no names, Micro$lug).

Previous thread about rich clients as well, just as many rich clients, just different names, For just about anything MS can do, a good well equipped *nix system can do, as well.
0 Votes
+ -
I actually read these columns for current data that I can use to help the
users I support, be they Windows, Mac or Linux. I don't have time to read
all this crap going back and forth about who is better. They all have a
place. I wish those posters would get a life and go play somewhere else.
Anyway, thanks again for the details...one thing missing, how does it
spread?
0 Votes
+ -
I agree
wcb42ad 11th Feb 2010
It's nice to see the list of Windows versions affected - I don't know why this kind of information wasn't included in the blog article.

Windows 7 is not affected which is nice. Another good reason to switch from XP in my opinion. So far, Win7 has had a pretty good track record as far as security goes.

One question I do have though, does anyone know if there are patches for this yet for XP/Vista? It would be nice to know this information as well.
Come on now, we've come to expect your stupid comments.
0 Votes
+ -
I love to watch self-important and arrogant IT folks bash "stupid users". I wonder how many of you know what you should/shouldn't put down your sinks and toilets. Most of you probably don't know because all that is important is that the faucet works and the toilet flushes.

My message is, everyone doesn't have time to be an expert in everything. Don't be a playa hata.
Arrogance not a new concept,if IT people were that good they would make a virus to attack the source. Stupid users, give me a break its a tool I dont want to know how to make and repair a telephone just so I can use it. When a new tool arrives I will gladly dump the internet and computors.
0 Votes
+ -
Personally, I would love to meet one of these hackers that steal and ruin peoples lives face to face in person... just for a few minutes. Let's see if they can hack their way out my fist reaching their face and my boot up their.....
0 Votes
+ -
Solution to the trojan problem
MattPW 11th Feb 2010
The key aspect to this trojan is the form and html scraping and modifying, this enables it to not just steal usernames and passwords but more scarily bypass the electronic OTP tokens which some of the banks have introduced. (although not in America so much I understand)

Id like to put forward my own invention as a solution, a passwindow which can include the transaction information with the dynamic code directly to the user.
0 Votes
+ -
Great idea.
AzuMao 12th Feb 2010
Then the trojans will only need to hook one
window to get your goods no matter what browser
you use. So much easier that way. Wait.. who's
side are you on again?
0 Votes
+ -
It is a great idea
MattPW 13th Feb 2010
I think your confused or just havnt thought it through, the MITB attack simply wont work if they cant modify the visual challenge with the real transaction information correctly. The only possible online attack would be a long term brute force trojan analysis requiring at least 5000+ interceptions which they just wont be able to pull off in the real world even if the user is authenticating twice a day for seven years. Its also realtively trivial to increase the 5000 value exponentially simply by using a larger key size. If you would like to explain your attack theory please post a better description. There is also a whitepaper on the subject available here http://vest.fr/PassWindow_Analysis.pdf
0 Votes
+ -
Instead of making code for each browser they
just have to make code for the PassWindow thing.
0 Votes
+ -
Please elaborate on your "make code for the thing" attack.
0 Votes
+ -
Instead of making separate code to inject into
each of the popular browsers, there'd just be
one program to attack.
Good day to confirm this comment I would appreciate T h e b e s t o f Z D N e t d e l i v e r e d your website very nice to everyone Yes, Oracle is the only one with shared-disk architecture, but that is there advantage. It means you can add or remove nodes and the database lives on. In a shared nothing architecture, if you lose a node, you lose the system. I'm sure Oracle appreciates EMC highlighting their advantage.I also desire to signal in your RSS feeds. Thank you as soon as once again and maintain up the great operate Awesome post! Thank you very much || thanks for nice content this is really benefit to me.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix