New 'warp' Trojan Poses As A Network Router

snoopy · Jul 12, 2012

New 'Warp' Trojan Poses As A Network Router
Jul 12, 2012 | 03:51 PM |
By Kelly Jackson Higgins
Dark Reading

Researchers have found a new Trojan out of China that mimics a router in order to intercept traffic and spread throughout the network. The so-called Warp Trojan isn't related to more common malware like Zeus or SpyEye, and it operates as a stage-two infection rather than a bot-run one. It appears to be spreading adware mainly in China, and the attackers behind it also appear to be out of China.

John Morris, principal security researcher at Kindsight Security Labs, discovered the attack in the lab after visiting a legitimate, trusted website and noticing it was resolving improperly. Morris dug into the HTML code sent to his browser and found a suspicious iFrame, but it wasn't the Web server that was the source of the malicious HTML injection: Morris and his team found another machine that was set up as a man-in-the middle in one of the Kindsight lab's subnets.

"This [malware] was behaving very differently than anything else we had seen before," Morris says. "It was calling out and pretending to be a router" with the ARP (Address Resolution Protocol) protocol, he says. It basically informs the network's existing router that it's a router, too, he says.

Unlike most Trojans that generate their own rogue traffic, Warp corrupts legitimate traffic. "If you were to link to Web page on the Net, like Google, it would corrupt the traffic coming back to you. So you get Google, plus an invisible iFrame that takes you to another malicious site," Morris says.

The victim doesn't see the malicious site, which basically uses a variety of exploits to infect his or her machine. "You don't know you're redirected," he says.

ARP spoofing itself isn't new, but it's rare for a Trojan to employ this technique to propagate itself, according to the researcher. Warp employs a seven-year-old Chinese hacking tool called ZXarps and dupes other computers on the network into believing it's the router.

[Remote VPN connections are not necessarily as secure as you’d think -- how enterprises can get infected by far-flung users via their SSL VPNs. See VPN An Oft-Forgotten Attack Vector.]
Click to expand...

Full article here: http://www.darkreading.com/vulnerability-management/167901026/security/attacks-breaches/240003641 ew-warp-trojan-poses-as-a-network-router.html

Log in or Sign up

New 'warp' Trojan Poses As A Network Router

snoopy Registered Members

Share This Page

Log in or Sign up

New 'warp' Trojan Poses As A Network Router

snoopy Registered Members

Share This Page

Useful Searches