Green Cloud: September 2009

Protect Against Keylogging Trojans with KeyScrambler

There has been a lot of news lately surrounding key logging trojans including Zbot, Clampi and others. These trojans are designed to steal authentication credentials and other sensitive information, especially for banking and social networking sites leaving users scrambling for ways to protect themselves.

The highlights of these news articles has been how easily these trojans can evade detection even by the most current anti-virus detection programs and the large sums of money that have been stolen using them. A recent ComputerWorld article reports up to $350,000 US dollars stolen from the Crystal Lake School district.

Beyond typical web filtering and anti-virus programs, browser add-ons are also very useful. Web of Trust and NoScript are well known to help prevent web based attacks. Another is called KeyScrambler.

KeyScrambler (free edition) works with popular browsers - Firefox, IE and Flock - as well as some other software to protect you from keyloggers. The paid editions offer additional protection. After install, Keylogger will run silently in your system tray or with notifications letting you know when it is protecting your keystrokes. Even if anti-virus protection is lax and did not catch the trojan or virus being installed, you will still be protected by KeyScrambler.

"There are hundreds of keylogging programs and new ones are appearing all the time. Most anti-spyware and anti-virus programs may not be able to detect new viruses and worms because they have to be updated to recognize them, which means that they often work after the fact - they detect and remove the malware only after it is already in your computer - and may not be able to stop theft in time. KeyScrambler protects all the time. It defeats existing and new keyloggers by making your keystrokes indecipherable to spyware." (Keyscrambler)

This is another great way to protect yourself from the bad guys. With the newest outbreak of keylogging trojans this should be considered a must have!

Download: http://www.qfxsoftware.com/Download.htm

Read rest of entry

Zbot Trojan: World's Most Dangerous Malware

The Zbot Trojan, aka Zeus or WSNPoem, is the world's largest and most dangerous malware. A recent whitepaper by Trusteer, who specializes in securing online transactions, proven the Zbot trojan has an incredibly low detection rate amongst anti-virus scanners.

Trusteer reports that 3.6 million PCs are infected in the US alone, and even up to date anti-virus scanners cannot stop it. "Installing an anti-virus product and maintaining it up to date reduces the probability to get infected by Zeus by 23% compared to running without an anti-virus altogether" (Trusteer).

In other words, opening or downloading the trojan results in infection more than 75% of the time.

The newest delivery method of the trojan is emails claiming to be from the IRS and a typical subject of "Notice of Unreported Income". These emails are in wide circulation over the last three weeks and are showing no signs of slowing down according to a report recently published by Network World.

What is Zbot?
The Zbot trojan is designed to steal login credentials, usually for financial accounts. The admin panel and exe builder can be easily purchased and is widely distruibuted on criminal networks for only a few thousand dollars. Old and obsolete versions of the builder are even freely available on P2P file sharing networks and torrent sites. This admin panel makes it possible for the cybercriminals to generate their own version of the virus to get around anti-virus scanners.

Zbot is typically used to steal account information. The main area of focus for the criminals is banking websites. Once the credentials for these sites have been stolen they can then be used to siphon money from the account and into their own network of accounts. Because Zbot is a keylogger and due to design it can be used for any type of website the hacker wishes to gain access to including social networking sites, ftp accounts and can even be used to bypass two-factor authentication.

Zbot is commonly spread through email or malicious websites using drive-by downloads. The emails claim to be from a reputable source containing an attachment that the unsuspecting user will open. The most prevalent scheme for these emails has been shipping carrier (UPS, Fedex, etc.) delivery notifications which report a problem with package delivery and get the user to open the attachment. Other schemes include bank notifications, Microsoft Outlook update notifications, Western Union fakes and others.

How Does Zbot Work?
The Zbot Trojan is essentially a framework for the exploit. Without the configuration file the program does nothing. This encrypted configuration file is the command and control structure of the bot including what sites to attack and where to send stolen credentials and information.

"The logics contained in the configuration contains the list of banking institutions that the bot targets, URLs of the additional components that the bots relies on to download commands and updates, the lists of questions and the list of the fields that the bot injects into Internet banking websites to steal personal details/credentials, etc." (ThreatExpert)

The configuration file can be downloaded from a site of the attackers choosing, and also contains the location for the next configuration update. Infected machines can be grouped into botnets by the attacker and updated from the same locations.

Once running on a system the trojan can perform a variety of operations. The majority of the time this is simply a keylogger which is activated when the user accesses a targeted site. Zeus can also replace the web form on a search page to ask for additional information such as card numbers, pin numbers, social security numbers and the answers to security questions. Real-time screenshots can also be taken from infected machines.

More detailed technical information is available on the ThreatExpert blog and the Zeus tracker pages at the bottom of this post.

Detecting Infection
To determine if a machine is infected users can look for specific registry keys and file locations added by Zbot. Here is a list of file locations from abuse.ch:

Preventing Infection
The best way to prevent infection is to simply be cautious of opening dangerous file attachments in email, and by enabling browser protection to limit scripts and file downloads. Web filtering can be a powerful technique in limiting the effectiveness of Zeus by preventing access to distribution and call-home points. The tracker on abuse.ch is a great resource for finding command and control centers which can then be blocked with web filtering or firewall.

Conclusion
Zbot usage and distribution is showing no signs of slowing down and criminals associated are making millions. The trojan has proven effectiveness and has been in circulation over three years - it will continue to be a threat for more to come.

Resources
Abuse.ch Zeus Tracker
ThreatExpert: Time to Revisit Zeus Almighty
Trusteer: Measuring the in-the-wild effectiveness of antivirus against Zeus
Network World: IRS Scam Now World's Biggest Email Virus Problem
Dancho Danchev: Crimeware in the Middle - Zeus
Zero Day: Modern banker malware undermines two-factor authentication

Read rest of entry

Newly Listed IRS Scam and Zbot Domains

A new list of IRS Scam and Zbot domains was recently posted on malwareurl.com. These are interesting as the domain names are altered only slightly and end in .eu. There are a total of 28 domains and 20 unique IP addresses.

yoky1w.eu 79.117.171.75
mi11f1.eu 187.64.34.106
mi11fa.eu 187.64.34.106
mi11fd.eu 79.184.58.166
mi11fe.eu 187.64.34.106
mi11ff.eu 85.106.95.114
mi11fi.eu 194.54.48.50
mi11fp.eu 79.184.58.166
mi11fq.eu 79.186.68.243
mi11fr.eu 190.46.93.230
mi11fs.eu 188.124.232.92
mi11ft.eu 187.64.34.106
mi11fw.eu 190.46.93.230
mi11fy.eu 194.54.48.50
yoky1a.eu 79.109.163.252
yoky1c.eu 77.41.105.36
yoky1d.eu 89.74.19.174
yoky1e.eu 85.136.132.50
yoky1f.eu 77.255.108.52
yoky1g.eu 95.208.30.24
yoky1n.eu 85.137.227.84
yoky1r.eu 74.3.203.93
yoky1t.eu 74.3.203.93
yoky1v.eu 95.208.30.24
yoky1x.eu 85.136.132.50
yoky1y.eu 74.3.203.93
yoky1z.eu 74.3.203.93
xyg1qe.eu 59.93.83.148

Stay tuned for more info on the zbot trojan coming soon. This financial malware is one of the biggest threats with the worst detection rates out there...very dangerous!

Read rest of entry

Introductory Post

As internet threats continue to evolve it's becoming clear that web threats and blended threats are becoming the most predominant danger to network security. Green Cloud Security and this blog are dedicated to the proliferation of information about web security issues - increasing awareness for both network administrators and regular internet users.

The creation of this blog comes on the heels of the Websense Security Labs "State of Internet Security" for the first half of 2009. There are many fascinating statistics that are presented in this report.

Some Highlights Directly from the Report:

• Websense Security Labs identified a 233 percent growth in the number of malicious Web sites in the last six monthsand a 671 percent growth during the last year.
• 77 percent of Web sites with malicious code are legitimate sites that have been compromised. This remains
unchanged from the last six-month period.
• 87.7 percent of email messages were spam. This represents a three percent increase over the last six months.
• 85.6 percent of all unwanted emails in circulation during this period contained links to spam sites and/or malicious Web sites.
• 95 percent of user generated comments to blogs, chat rooms and message boards are spam or contain
malicious links.
• Researchers from Harvard and Cambridge estimate that 75.8 percent of phishing sites are hosted on
compromised servers.

The full report can be downloaded from the WebSense Newsroom. There is also a video version of the report available.

One of the key concepts to be taken from this report is the importance of web filtering as it pertains to malware and other internet threats. Using web based blocking can significantly decrease the "window of vulnerability" of a particular threat. While anti-virus vendors scramble to create and release definitions (averaging 22 hours according to this report), web security vendors can block a virus download in a matter of minutes if done properly. While anti-virus programs will likely always have their place, web security is quickly becoming the most important factor in internet threat prevention.

Blended threats, which are usually in the form of an email containing a link to a web page with harmful code or files are also showing no signs of slowing either. Real-time web filtering can prevent access to the link, and infection. If almost 88% of all email is spam, and 85% of that mail contains links to malicious and spam sites, then 75% of all email contains links to malicious and spam sites - a serious problem.

This site is dedicated to keeping up to date information on any web threats, blended threats, botnets. Please bear in mind that this is still very much in the building stages. Please follow via RSS or Twitter, and thanks much for reading.

Read rest of entry