Michael Mongold's Technology Security

Bank accounts hacked for over 1 million dollars

Last month, a British bank and its customers were hit by a coordinated and targeted attack by criminals that launched their efforts from Eastern Europe. 

In an impressive display of a blended threat, the crooks created advertising with malicious code that they then posted on legitimate websites (run by Yahoo for example) and their own websites. Once the advertisement was clicked on or the malicious website was visited, the user would unknowingly have an exploit kit (the Eleonore and Phoenix kits in this example) drill into the browser to embed the new and improved Zeus v3 Trojan onto their PCs.

Once installed the Trojan would announce to its Command and Control server (C&C) that it was ready and then wait for the user to log into their bank account.

When the unsuspecting user finally logged into their bank account, the Trojan would notify the C&C while the bank session was open. The C&C would then step in between the bank page and the user and provide a script that performed its own intelligence to determine how much money the user had in the account. If the user had over a certain amount, the script would transfer money into a money mule’s account which would eventually make its way to the criminals. The malefactors were aware of each process along the way receiving detailed information about the accounts and their values, the success or failure of any transactions – all via encrypted traffic to avoid detection.

An observation that everyone should take from this story is just how difficult it was(is) to detect the attack. Of all the anti-malware software that is on the market, only Sophos and Trend Micro would have caught the Zeus v3 Trojan which would have stopped the attack before it could have started. Most other anti-malware players have since updated their software to include Zeus v3.

The bank and the banking victims have been notified of the illegal activities and authorities are investigating. No responsible parties have been apprehended at this time.

Read more of the attack and the excellent research by M86 Security here.

Technorati Tags: Michael Mongold,bank,British,blended threat,zeus v3,money mule,sophos,trend micromicro,criminal,Yahoo,Eleonore,phoenix,exploit,trojan,command and control,malicious code

Trojan implicated in plane crash that killed 154

A plane crash that occurred two years ago when taking off from Barajas Airport in Madrid was riddled with Trojans. The Spanish newspaper, El Pais, is reporting that the trojans did not allow alarms to sound which would have alerted the crew of the incorrect positioning of the plane’s flaps. While the crew should have discovered the out-of-position flaps during their pre-flight checklist, the alarms’ failure as a failsafe was a contributing factor.

It cannot really be said that the trojans caused the crash, but that they merely failed to alert the crew to something they already should have been aware of. However, as our reliance on technology to perform more and more critical tasks associated with human life grows, it is only a matter of time before the Titanic or Hindenberg of the future is associated with a compromised device. Some Skynet-futurists may even believe it will be on purpose…

Technorati Tags: Trojan,Michael Mongold,Barajas,plane,Madrid,El Pais,Titanic,Skynet,hindenberg

Researchers hack your vehicle (again)

A few months ago, researchers with the University of Washington and UC San Diego released a paper detailing their "Experimental Security Analysis of a Modern Automobile". It presented a dark story where the electronic components of a vehicle, given the right access and know-how by a motivated individual, could   program events to occur from the benign (windshield wipers come on when you reach 20 MPH) to the homicidal (disable brakes and ignition over 80 MPH). It even proposed that with newer vehicles self-parking capabilities, it might be possible for steering to be arrested from the driver. If there was a silver lining it was felt that the individual hacking the device needed physical connectivity in order for the exploit to be realized. There was some indication that with weak Bluetooth security it might be possible to use that as an access vector but nothing was firmly tested.

Now, another method of wirelessly accessing your vehicle has been exposed by researchers at Rutgers University. In a paper being presented this week at the USENIX Security Symposium, tire pressure monitoring systems (TPMS) are gaining quite a bit of attention. Most people are likely unaware that all new cars in the US have been required to have a wireless tire pressure monitoring systems since 2008. The paper explains that with relatively inexpensive equipment, researchers from up to 120 feet away could obtain wireless data from the sensors, spoof it, and then send it back to the car with inaccurate data while traveling 65 MPH. While the data that was spoofed was merely enough to make the tire pressure light on the car's dashboard display incorrectly, it signals a potential foothold for wireless attacks by nefarious individuals. At, once again, it shows a serious lack of foresight by product manufacturers to account for ways that their systems could be gamed.

Each and of themselves, the threats have limited play. However, when they become combined (and what would make anyone think otherwise?), the results could be extremely dangerous. Automakers need to review how they approach the security architecture of our vehicle's internal devices now, before a flashing light on your dashboard turns into a stuck accelerator or worse…