At least 100,000 computers in the U.K. are infected with the Zeus malware, an advanced piece of spying software that is regularly defeating most antivirus software suites, according security vendor Trusteer.
Researchers at Trusteer managed to analyze a server used to collect details from the hacked PCs, which likely became infected by visiting Web sites engineered to attack computers and install Zeus, said Mickey Boodaei, Trusteer's CEO.
What they found was startling. Zeus is designed to monitor computers and collect information, but the operators of this group of infected computers have taken data collection to a higher level.
For these hacked computers, Zeus was recording all traffic sent through a browser, including that transmitted using SSL (Secure Sockets Layer), a method used to encrypt sensitive data between two points. Boodaei said Zeus grabs the information before it has been encrypted or just after it has been decrypted.
"Anything the user sees from the browser or anything they type in the browser is being captured by the malware," Boodaei said.
All of the data captured by Zeus is sent to a remote a database, which the Trusteer researchers were able to access. They found that the command-and-control software for Zeus is capable of doing keyword searches in that database, Boodaei said.
Since Zeus can see any data in the browser, it means that the cybercriminals know exactly when a person last accessed their bank account and the account balance without even needing to log into the account.
The Zeus database also holds a lot of other information, such as company e-mail, log-ins for social networking sites and financial credentials, Boodaei said.
Boodaei said the Metropolitan police have been alerted about Trusteer's findings. Trusteer will share gigabytes of data it has collected with the police in addition with the banks whose customers have been compromised, he said.
Zeus has been so successful due to the high number of variants that have been modified to evade security software. At any one point, Boodaei said that most antivirus software suites only detect Zeus about 10 percent of the time.
"The reason is that Zeus is so sophisticated it keeps changing its behavior," Boodaei said.
That's also a problem for Trusteer, which makes a widely used product called Rapport:
http://www.trusteer.com/product/trusteer-rapport , which many U.K. banks have distributed to their customers for free. Rapport is designed to harden browsers against malware and lock out malware trying to interfere with data exchanged between, for example, a bank and a customer.
Malware will often try to disable security software. Trusteer's Rapport will alert a bank if it is uninstalled. At that point, the bank could forbid the customer in question from performing transactions or tell them their computer is apparently infected. Trusteer is soon adding a component that will allow it to detect and remove certain types of malware from an infected computer.
(PCW)
Total Members: 14197
Topic: 100,000 UK Computers Infected With Zeus Malware (Read 9659 times)
