Tailor-made Trojans

Recently, there is a Russian web site discovered that sells a spyware kit, called WebAttacker, for a price of approximately RM 80+. This site, which refers to it’s creators as “spyware and adware developers”, markets the kits by strength and sells them online, along with technical support for buyers.

Included in the kits are scripts desgined to simplify the task of infecting computers – the buyer need only spam out a message to email addresses, inviting recipients to visit a compromised web site.

Samples found in Sophos’s network of monitoring stations use newsworthy topics to lure unwary users. One presents itself as warning of the H5N1 bird flu virus, providing links to the bogus site. Another claims that Slobodan Milosevic was murdered and invites users to visit the site for more information. These sites then attempt to download the malicious code remotely on to the user’s PC by taking advantage of known browser and operating system vulnerabilities.

“This type of behaviour is inviting the return of script-kiddies,” said Carole Theriault, senior security consultant at Sophos. “By simplifying the task of the potential hacker for a mere tenner, sites like this one will attract opportunists who aren’t necessarily very skilled and turn them into cyber criminals.”

JavaScript code on the infected sites detects the visiting computer’s browser version and operating system, including any installed patches, and launches the most appropriate exploit, which then downloads a program that attempts to turn off the firewall and install malware, generally a password stealer, keylogger or a banking trojan.


Leave a Reply

Please log in using one of these methods to post your comment:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.