1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

New Session-Stealing Banking Trojan Identified

Discussion in 'Security Updates' started by starbuck, Feb 22, 2011.

  1. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Trusteer, a provider of secure browsing solutions, warns that a new banking trojan capable of hijacking online banking sessions in real time has been identified.

    Dubbed OddJob, after Goldfinger's henchman in the Bond series, the trojan appeared a few months ago, but it was kept under wraps because of ongoing law enforcement investigations.

    It's still very much a work in progress and Trusteer researchers have seen code modifications made as recent as a few days ago.

    The trojan hooks into Firefox or Internet Explorer functions and monitors browsing activity on a predefined list of websites.

    It can log GET and POST requests, grab full HTML pages, inject code and terminate connections.

    All these features give fraudsters the ability to control a user's online banking session in real time without their knowledge.

    A rather unique feature is the trojan's ability to intercept and bypass logout requests in to keep the sessions opened. The functionality provides even more time for attackers to abuse the victim's account.

    Also, another interesting aspect of OddJob is that it doesn't keep a config file on disk. Instead, it reads the configuration directly from the command and control server each time a new browsing session is started.

    "Our research team has reverse engineered and dissected OddJob's code methodology, right down to the banks it targets and its attack methods," Trusteer's chief technology officer, Amit Klein, notes.

    "Trusteer has already warned Financial Institutions that OddJob is being used by criminals based in Eastern Europe to attack their customers in several countries including the USA, Poland and Denmark," he adds.

    Because of all the attention received by ZeuS last year in the media, some cybercriminal gangs are experimenting with custom coded trojans that meet their particular needs and keeps them away from the spotlight.


    Source:
    http:/ ews.softpedia.com ews/New-Session-Stealing-Banking-Trojan-Identified-185635.shtml
     

Share This Page