They say popularity has its price. This saying holds a new weight when it comes to the growing influence of social media. In fact, your “Likes” may be worth more to hackers than your credit card number. As counterintuitive as it may seem, your social clout has become the new target of hackers. And they’re Read more…
avast! Internet Security detects and blocks 100% of the world’s most malicious Zeus Trojan strains. The Zeus Trojan is the most prevalent type of financial malware. Zeus infects a user’s computer and lies in wait until the user logs on to a banking website. Once that occurs, it attempts to steal the user’s bank account […]
寄稿: Piotr Krysiuk
6 月 5 日、Microsoft 社は金融業界および FBI との協力により、オンラインバンキングを狙う Citadel というトロイの木馬プログラムの活動を停止に追い込んだことを発表しました。この停止措置により、1,000 以上の Citadel ボットネットがオフラインになりました。
Citadel はオンラインバンキングを狙うトロイの木馬のひとつで、2011 年に登場しました。オンラインバンキングを狙う他のトロイの木馬と同様に、Citadel も、すべてが揃ったクライムウェアキットであり、ペイロードビルダー、コマンド & コントロール（C&C）サーバーのインフラストラクチャ、さまざまな銀行を標的にする設定スクリプトを攻撃者に提供します。Citadel は、金融業界を狙うトロイの木馬として大きな存在である Trojan.Zbot（Zeus）の末裔です。2011 年に Zeus のソースコードが漏えいした後で、犯罪者グループがそのコードを引き継ぎ強化する形で登場しました。
図 1. トロイの木馬 Citadel のインターフェース
先駆けとなった Zeus が広範囲に出回ったのに対し、Citadel はより「資金力のある」攻撃者を市場として対象にしています。SpyEye や、漏えいした Zeus のキットがわずか 100 ドルで取引されているのに対して、Citadel キットはロシアの地下フォーラムで通常 3,000 ドル前後で販売されています。Citadel のユーザーは、標的にしようとする銀行に合わせた Web インジェクションコードを購入するたびに、30 ～ 100 ドルを追加で支払う必要もあります。しかも、攻撃者に資金の余裕があったとしても、新規購入の場合には紹介が必要であり、厳格な審査プロセスがあります。
Citadel の感染は全世界に広がっていますが、過去 6 カ月で多数の感染が確認されているのは、オーストラリア、イタリア、米国でした。
図 2. 2013 年 1 月から 6 月までの Citadel の感染件数
シマンテックは、Citadel ボットネットの活動停止という今回の報道を歓迎します。この停止措置で Citadel の脅威を完全に排除できるわけではありませんが、現在の活動が停止することは確かであり、攻撃者に対しても、その活動がいつも監視されているという明確なメッセージになったはずです。この脅威の排除にあたって官民の協力態勢が取られたことも称賛に値します。
金融業界を狙うトロイの木馬について詳しくは、シマンテックのホワイトペーパー（英語）をお読みください。シマンテックの最新のウイルス対策と侵入防止シグネチャを使用することで、Citadel の感染を防ぐことができます。
* 日本語版セキュリティレスポンスブログの RSS フィードを購読するには、http://www.symantec.com/connect/ja/item-feeds/blog/2261/feed/all/ja にアクセスしてください。
A dangerous Trojan named ZeuS is making its way among Facebook users. This old Trojan horse has infected millions of computers over the years, stealing banking credentials and other personally identifiable information. Zeus can lie dormant on infected computers until the unsuspecting victim logs into their bank’s website. Once you’re logged in, cybercrooks can steal […]
Contributor: Piotr Krysiuk
On June 5, Microsoft announced that they had worked together with members of the financial services industry and the FBI to disrupt the operations of a banking Trojan horse program called Citadel. The takedown operation resulted in over 1,000 Citadel botnets being taken offline.
Citadel is a banking Trojan that has been in existence since 2011. As with most banking Trojans, Citadel is a full crimeware kit, providing the attackers with payload builders, a command and control (C&C) server infrastructure, and configuration scripts to target various banks. Citadel is a descendant of that other behemoth of the financial Trojan world, Trojan.Zbot (Zeus). It came into existence after the Zeus source code was leaked in 2011, with criminal groups taking that code and enhancing it.
Figure 1. The Citadel Trojan interface
Citadel is aimed at a more “exclusive” attacker market than its more widespread predecessor, Zeus. The Citadel kit is sold through underground Russian forums and typically costs around $3,000, compared to $100 for the SpyEye and leaked Zeus kits. Citadel users will also have to fork out a further $30-$100 to purchase Web inject code for the banks that they wish to target. Additionally, even if attackers have that money to spend, there is a strict vetting process with referrals required for new purchasers.
Citadel infections have spread around the globe, but in the past six months the majority of infections have been in Australia, Italy and the US.
Figure 2. Citadel infections from January to June 2013
Symantec welcomes news of the takedown of these Citadel botnets. While these takedowns may not eliminate the threat of Citadel completely, it certainly disrupts current campaigns and sends out a clear message to attackers that their actions are being monitored. Symantec also welcomes the cooperation between the public and private sector in taking action against this threat.
For more information about the world of financial Trojans, read our whitepaper. Symantec’s current antivirus and intrusion prevention signatures provide protection against Citadel infections.
Contributor: Piotr Krysiuk
On June 5, Microsoft announced that they had worked together with members of the financial services industry and the FBI to disrupt the operations of a banking Trojan horse program called Citadel. The takedown operation resulted in over 1,000 Citadel botnets being taken offline.
Citadel is a banking Trojan that has been in existence since 2011. As with most banking Trojans, Citadel is a full crimeware kit, providing the attackers with payload builders, a command and control (C&C) server infrastructure, and configuration scripts to target various banks. Citadel is a descendant of that other behemoth of the financial Trojan world, Trojan.Zbot (Zeus). It came into existence after the Zeus source code was leaked in 2011, with criminal groups taking that code and enhancing it.
Figure 1. The Citadel Trojan interface
Citadel is aimed at a more “exclusive” attacker market than its more widespread predecessor, Zeus. The Citadel kit is sold through underground Russian forums and typically costs around $3,000, compared to $100 for the SpyEye and leaked Zeus kits. Citadel users will also have to fork out a further $30-$100 to purchase Web inject code for the banks that they wish to target. Additionally, even if attackers have that money to spend, there is a strict vetting process with referrals required for new purchasers.
Citadel infections have spread around the globe, but in the past six months the majority of infections have been in Australia, Italy and the US.
Figure 2. Citadel infections from January to June 2013
Symantec welcomes news of the takedown of these Citadel botnets. While these takedowns may not eliminate the threat of Citadel completely, it certainly disrupts current campaigns and sends out a clear message to attackers that their actions are being monitored. Symantec also welcomes the cooperation between the public and private sector in taking action against this threat.
For more information about the world of financial Trojans, read our whitepaper. Symantec’s current antivirus and intrusion prevention signatures provide protection against Citadel infections.