A Trojan dubbed Silentbanker targets more than 400 banks including the household names in the U.S. and other financial institutions abroad and hangs in the background to intercept transactions with two-factor authentication, according to researchers at Symantec. In a day full of the usual Trojan attacks (they all sort of look alike after awhile) the sheer versatility of Trojan.Silentbanker is notable.
Symantec researcher Liam OMurchu writes in a blog post:
"The ability of this Trojan to perform man-in-the-middle attacks on valid transactions is what is most worrying. The Trojan can intercept transactions that require two-factor authentication. It can then silently change the user-entered destination bank account details to the attacker’s account details instead. Of course the Trojan ensures that the user does not notice this change by presenting the user with the details they expect to see, while all the time sending the bank the attacker’s details instead. Since the user doesn’t notice anything wrong with the transaction, they will enter the second authentication password, in effect handing over their money to the attackers. The Trojan intercepts all of this traffic before it is encrypted, so even if the transaction takes place over SSL the attack is still valid. Unfortunately, we were unable to reproduce exactly such a transaction in the lab. However, through analysis of the Trojan’s code it can be seen that this feature is available to the attackers."
View: Full Story @ ZDNet
However what I don't understand is, is that surely it's easy to track where the money went to in cases like this once it's reported?
Sometimes I wonder if it is Symantec themselves that write these viruses/trojans, so people will buy their software.
Last edited by Optix Illusion on 14 Jan 2008 - 22:59
Do you really wonder that?
Do you really think that Symantec [or any other legitimate security firm] could do something like that and keep it from leaking out?
And do you really think that Symantec is stupid enough to jeopardize its entire multi-billion-dollar security business by secretly producing malware when there is already enough crap out there to keep them in business forever?
Last edited by elvenseven on 15 Jan 2008 - 02:43
Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!
Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.