By Kevin Coleman 
Category:
Level of Sophistication:
Level of Threat:
Scale of Threat:
First Noticed:
Suspected Source: |
|
Trojan Horse
4.2 High
3.5 Moderate
1.2 Low (400+)
Mid 2007
Organized Crime
Extremist Groups |
Overview: This cyber threat has already struck over 400 banks in the U.S. Canada,
France, Spain, Ireland, the UK, Finland and Turkey. The malicious code
has the ability to get around two-factor authentication and the capability to distribute
other Trojan software as well as to update itself. The scale and sophistication
of this banking Trojan is worrying, even for someone who sees banking
Trojans on a daily basis.
Operation: This software is downloaded to an unsuspected computer. It contains
a configuration file that includes domain names of over 400 banks. The
banks include large U.S. banks and also banks in at least seven other countries
and the list is growing.
This Trojan is a derivative of the older man-in-the-middle (MitM) attacks and
becomes a man-in-the browser (MitB) type exploit. The exploit intercepts valid
transactions that use two-factor authentication and silently changes the userentered
destination bank account details to the attacker's account details. Silent-
Banker intercepts authentication traffic before it is encrypted so that even if using
SSL, the exploit can still take place. As with MitM, MitB style malicious
code exploits the collection of user data stolen from valid transactions and the
self updating capability are two characteristics that makes this attack very concerning
to security experts, banking officials and international law enforcement.
Investigating Agencies Include: Interpol, Scotland Yard, the FBI, KRP
(Finland’s FBI) and possibly more than a dozen other agencies.
Reference Links:
http://www.symantec.com/enterprise/security_response/weblog/2008/01/banking_in_silence.html
http://www.microsoft.com/security/portal/Entry.aspx?ThreatId=-2147367388
http://www.networkworld.com/news/2008/011408-silentbanker-trojan.html?page=1
Back to Briefings Page |
