Windows users are by far the most targeted ones by malware-wielding
criminals, but that doesn't mean that OS X and Linux users should feel
impervious.
In fact, RSA researcher Limor Kessem warns that a banking Trojan targeting the Linux operating system has been spotted being sold online by a cybercrime team based in Russia.
"This malware is currently offered for sale in closed cybercrime communities for $2,000 USD (€1,500 EUR) with free updates," she notes. "The current functionality includes form grabbers and backdoor capabilities, however, it’s expected that the Trojan will have a new suite of web injections and graduate to become full-blown banking malware in the very near future. At that point, the price is expected to rise to $3,000 USD (€2,250 EUR), plus a hefty $550 per major version release."
After having analyzed both the malware builder and the server side source code, the company's researchers say that the Trojan - dubbed "Hand of Thief" by its creators - includes a form grabber for both HTTP and HTTPS sessions within Firefox, Chrome and Linux-only browsers.
It is also able to block the victims' access to hosts offering AV solutions and security updates, and open a backdoor into the system.
In order to prevent being spotted and analyzed both by security researchers and competitors looking to copy it, the Trojan is also able to detect the presence of virtual environments, sandboxes and debuggers, and prevent itself from running in those circumstances.
The researchers were also able to take a peek at the administration panel for the Trojan, which shows a list of the bots, provides a querying interface, and so on. The stolen credentials are stored in a MySQL database.
It's good to note that the Trojan purportedly works on 15 different Linux desktop distributions, (including Ubuntu, Fedora and Debian) and supports 8 different desktop environments (including Gnome and Kde).
But given the hefty price tag, the limited Linux user base, and the lack of Linux exploit packs to spread the malware, only time will tell if Hand of Thief will be a success with cyber crooks.
In fact, RSA researcher Limor Kessem warns that a banking Trojan targeting the Linux operating system has been spotted being sold online by a cybercrime team based in Russia.
"This malware is currently offered for sale in closed cybercrime communities for $2,000 USD (€1,500 EUR) with free updates," she notes. "The current functionality includes form grabbers and backdoor capabilities, however, it’s expected that the Trojan will have a new suite of web injections and graduate to become full-blown banking malware in the very near future. At that point, the price is expected to rise to $3,000 USD (€2,250 EUR), plus a hefty $550 per major version release."
After having analyzed both the malware builder and the server side source code, the company's researchers say that the Trojan - dubbed "Hand of Thief" by its creators - includes a form grabber for both HTTP and HTTPS sessions within Firefox, Chrome and Linux-only browsers.
It is also able to block the victims' access to hosts offering AV solutions and security updates, and open a backdoor into the system.
In order to prevent being spotted and analyzed both by security researchers and competitors looking to copy it, the Trojan is also able to detect the presence of virtual environments, sandboxes and debuggers, and prevent itself from running in those circumstances.
The researchers were also able to take a peek at the administration panel for the Trojan, which shows a list of the bots, provides a querying interface, and so on. The stolen credentials are stored in a MySQL database.
It's good to note that the Trojan purportedly works on 15 different Linux desktop distributions, (including Ubuntu, Fedora and Debian) and supports 8 different desktop environments (including Gnome and Kde).
But given the hefty price tag, the limited Linux user base, and the lack of Linux exploit packs to spread the malware, only time will tell if Hand of Thief will be a success with cyber crooks.
No comments:
Post a Comment