Banking and Virus Scanning with a Live CD

Last week, Brian Krebs of the Washington Post blogged here advising business owners to perform online banking using a live CD. This excellent advice (IMHO) created quite a stir over the last week.

Essentially, banking on a live CD prevents you from becoming susceptible to Windows viruses, while at the same time loading a fresh, non-compromised OS each time. This can almost guarantee that you online banking sessions will be secure - so long as you go directly to the bank site and don't click on a dangerous links in delivered via email, etc. It's also a no-cost option which is great for SMBs.

Mr. Krebs took the time to respond to some of the publicity surrounding his article with a follow up earlier today. He responds to some reader suggestions like using limited user accounts, and dedicated computers for online banking. These practices are well-recommended but don't necessarily work against the most popular banking trojans today - Zeus and Clampi.

As noted by Krebs, "a number of today's more advanced threats - including the Zeus Trojan, a sophisticated family of malware most commonly associated with these attacks against small businesses -- will just as happily run on a limited user account as an administrator account in Windows." He also noted that Clampi can easily propogate over a Windows network.

What I found most interesting was the discussion about the Genlabs breach which netted criminals $437,000 dollars. This was done using the Zeus (Zbot) family of malware and the forensic report done after the fact highlighted a major problem with Windows based anti-virus scanning.

"Using a Windows-based scanning tool, the drive showed no infections. However, several directory trees and files could not be accessed indicating that the tools were not able to complete a 100% analysis.
...
We built a Linux-based system to repeat selected scans and analysis on the theory that Linux would bypass possible Windows-based protocols to protect and/or hide files."

The compromised system contained two variants of the Zeus trojan, the trojan that just cost them $473,000 dollars!!!

However, this got me thinking about something I hadn't ever done before. Why not boot into Ubuntu (which I currently dual-boot, any other OS besides Windows would work) and run scans from there?

Testing this was incredibly easy. First, I went to the Avast! website and downloaded the newest .deb package from the Linux download page. After installing it was as simple as picking out my Windows partitions, which are easily accessible in Ubuntu, and running scans on them.

Luckily, nothing was infected. This type of scan could also easily be run from a Live CD to check for any type of bot, virus or infection.

For those of you that have read this far, apologies for the long winded article. I had wanted to comment on the use of a live CD last week and ever got a chance until now. This cheap and quick alternative could certainly save a number of small and medium size companies from huge losses at the hands of criminals.

Read rest of entry

New Zeus Scam Emails and Download Domains

There are some new Zeus emails going around that folks should be aware of. These emails, as reported by the Securosis blog, pretend to be from a system administrator. The administrator asks them to "run SSl updates procedure" as below.

Read rest of entry

Evolution....New Multi-Function Trojan

Webroot has discovered a new trojan that performs a variety of malicious tasks. One of the primary functions is to crack captchas so that forms of all types can be submitted by the attacker. The trojan will download a specific set of instructions from the internet including which sites to attack, and then operate in the background - attempting to connect to targeted sites.

That is not the only concern. The trojan is also capable of stealing passwords and stealing all the information from online shopping forms. It also includes an adcliker function which will click through certain ads which match its instruction set. Furthermore, it deeply plants itself into the Windows OS, so that system restore and reboots do not interfere with its function.

Webroot has classified this a password stealer, Trojan-PWS-Lanci.

More information on the Webroot Blog:
http://blog.webroot.com/2009/10/02/trojan-decodes-captchas-using-stolen-commercial-tools/

Read rest of entry

Zbot Trojan: World's Most Dangerous Malware

The Zbot Trojan, aka Zeus or WSNPoem, is the world's largest and most dangerous malware. A recent whitepaper by Trusteer, who specializes in securing online transactions, proven the Zbot trojan has an incredibly low detection rate amongst anti-virus scanners.

Trusteer reports that 3.6 million PCs are infected in the US alone, and even up to date anti-virus scanners cannot stop it. "Installing an anti-virus product and maintaining it up to date reduces the probability to get infected by Zeus by 23% compared to running without an anti-virus altogether" (Trusteer).

In other words, opening or downloading the trojan results in infection more than 75% of the time.

The newest delivery method of the trojan is emails claiming to be from the IRS and a typical subject of "Notice of Unreported Income". These emails are in wide circulation over the last three weeks and are showing no signs of slowing down according to a report recently published by Network World.


What is Zbot?
The Zbot trojan is designed to steal login credentials, usually for financial accounts. The admin panel and exe builder can be easily purchased and is widely distruibuted on criminal networks for only a few thousand dollars. Old and obsolete versions of the builder are even freely available on P2P file sharing networks and torrent sites. This admin panel makes it possible for the cybercriminals to generate their own version of the virus to get around anti-virus scanners. 

Zbot is typically used to steal account information. The main area of focus for the criminals is banking websites. Once the credentials for these sites have been stolen they can then be used to siphon money from the account and into their own network of accounts. Because Zbot is a keylogger and due to design it can be used for any type of website the hacker wishes to gain access to including social networking sites, ftp accounts and can even be used to bypass two-factor authentication.

Zbot is commonly spread through email or malicious websites using drive-by downloads. The emails claim to be from a reputable source containing an attachment that the unsuspecting user will open. The most prevalent scheme for these emails has been shipping carrier (UPS, Fedex, etc.) delivery notifications which report a problem with package delivery and get the user to open the attachment. Other schemes include bank notifications, Microsoft Outlook update notifications, Western Union fakes and others. 


How Does Zbot Work?
The Zbot Trojan is essentially a framework for the exploit. Without the configuration file the program does nothing. This encrypted configuration file is the command and control structure of the bot including what sites to attack and where to send stolen credentials and information.

"The logics contained in the configuration contains the list of banking institutions that the bot targets, URLs of the additional components that the bots relies on to download commands and updates, the lists of questions and the list of the fields that the bot injects into Internet banking websites to steal personal details/credentials, etc." (ThreatExpert)

The configuration file can be downloaded from a site of the attackers choosing, and also contains the location for the next configuration update. Infected machines can be grouped into botnets by the attacker and updated from the same locations.

Once running on a system the trojan can perform a variety of operations. The majority of the time this is simply a keylogger which is activated when the user accesses a targeted site. Zeus can also replace the web form on a search page to ask for additional information such as card numbers, pin numbers, social security numbers and the answers to security questions. Real-time screenshots can also be taken from infected machines.

More detailed technical information is available on the ThreatExpert blog and the Zeus tracker pages at the bottom of this post.

Detecting Infection
To determine if a machine is infected users can look for specific registry keys and file locations added by Zbot. Here is a list of file locations from abuse.ch:

Preventing Infection
The best way to prevent infection is to simply be cautious of opening dangerous file attachments in email, and by enabling browser protection to limit scripts and file downloads. Web filtering can be a powerful technique in limiting the effectiveness of Zeus by preventing access to distribution and call-home points. The tracker on abuse.ch is a great resource for finding command and control centers which can then be blocked with web filtering or firewall.

Conclusion
Zbot usage and distribution is showing no signs of slowing down and criminals associated are making millions. The trojan has proven effectiveness and has been in circulation over three years - it will continue to be a threat for more to come.

Resources
Abuse.ch Zeus Tracker
ThreatExpert: Time to Revisit Zeus Almighty
Trusteer: Measuring the in-the-wild effectiveness of antivirus against Zeus
Network World: IRS Scam Now World's Biggest Email Virus Problem
Dancho Danchev: Crimeware in the Middle - Zeus
Zero Day: Modern banker malware undermines two-factor authentication

Read rest of entry