Slashdot Mirror
'Greasemonkey' Malware Targets Firefox
snydeq writes "Researchers have discovered a new type of malware that collects passwords for banking sites but targets only Firefox. The malware, dubbed 'Trojan.PWS.ChromeInject.A,' sits in Firefox's add-ons folder, registering itself as 'Greasemonkey,' the well-known collection of scripts that add functionality to Web pages rendered by Firefox. The malware uses JavaScript to identify more than 100 financial and money transfer Web sites, including PayPal, collecting logins and passwords, which it forwards to a server in Russia. Trojan infection can occur via drive-by download or download duping."
I would suggest that DO-NOT "Remember Passwords" and Login ids in any Browser where Sensitive Information will be sent ultimately.
This [plugin] is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox's Plugin folder
Since the computer need already be compromised... sure you can draw your own conclusion on that one :)
Want Big Business out of government? Take away the incentive and start by getting government out of big business!
More details here
licet differant, aequabitur
The problem with USB keys is that you have to install a client to handle the PKCS #11 with the browser. No bank wants to get in the business of telling customers to install software (and all the help desk problems that come with it).
OTP tokens have been the preferred method for consumer strong authentication, but only consumers in Europe have seem to taken to them. I don't really see people lining up to get the paypal OTP token.
"This latest e-threat - called Trojan.PWS.ChromeInject.A - is intended to be delivered onto a compromised computer system by other malware"
SYMPTOMS: Presence of the: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll"
TECHNICAL DESCRIPTION: It drops an executable file (which is a Firefox 3 plugin)
Does that mean it's Windows only ?
davecb5620@gmail.com
It doesn't "target Firefox", it targets "Firefox on Windows 32 systems" This does not affect Linux, Mac, or other systems. Ehud
The reason Windows is targeted is because it's model of sharing everything was so wide open to so many exploits. And don't forget the numerous buffer-overflow vulnerabilities. Top that off with the fact that it is so pervasive, and you have the deadly combination we have now.
Linux/Unix, on the other hand, was written with clear lines of delineation between the user and kernel spaces. And attention was paid to avoid buffer overflow vulnerabilities.
Not saying that there aren't exploits available in Linux and Unix... There are. It's just designed from the ground up to be more secure than Windows.
So part of what you said is correct: The pervasiveness of Windows is a major reason why it is targeted. But you can't avoid the poor security design of Windows as a cause as well.
A clever person solves a problem, A wise person avoids it. -Einstein
I ran into this when I visited a site that another admin got the Antivirus 2008 trojan from. Of course I'm on Ubuntu so I was pretty sure simply visiting the site wouldn't cause any problems. I kept getting prompted to install it so I just found out what link it kept calling and just modified my hosts file to point it to localhost and then I got out of it like I should.
Pretty devious exploit though.
But I thought the sequence usually went like this:
1. Install Firefox /. for pedantic usage of noScript to designate a particular add-on to Firefox, and for not using the general designation of either FX3 or FF3...
2. Install noScript
3. ???
4. Don't get infected by js vector based viruses.
5. Get flamed on
No, but really. If you have noScript, as most everyone I know using Fx does, then how do you get infected by a virus that uses js as an attack vector...
Guess I'll keep reading the thread and see if the answer arises.
2^3 * 31 * 647
It is written in Java script, but the delivery system is windows only. This malware also does not use its own delivery system. (don't worry, you would have to read the article to know that and we all know reading the article is for losers)
Want Big Business out of government? Take away the incentive and start by getting government out of big business!
Read.article. Most of your 'insightful' comment applies to Windows and piggy-backing on a Windows exploit. The other OS's you mention (ie: not Windows) would be exploited by ignoring the FF warning dialog about installing untrusted add-ons and installing it anyway (not so much an exploit).
That said, if you're done being cheeky: software is complicated. Bugs are a simple reality and inevitably lead to some kind of exploitability. But Linux and Mac (along with FF and numerous other open tools) get a bit of credit for implementing basic controls (accounts with privilege separation in the OS's) and responding quickly and proactively.
Windows is only now trying it, but their implementation is so cumbersome it's defeating it's own purpose.
Any Vista user out there that haven't already tried it there are several open source sudo for Windows implementations that make using non-privileged accounts more viable. I think I use Sudowin which seemed to work the best for me, but I'm not on my home computer.
Quack, quack.
I give out my paypal password all the time.
It's Fire98-myFun.
it will do you no good without my keyfob and it's current 6 digit number. My bank, paypal, ebay, and 2 of my credit cards use the same keyfob because they use verisign and it defeats every single one of these trojans, keyloggers, and scammers. Why they are not common place I'll never understand.
Do not look at laser with remaining good eye.
http://www.coolest-gadgets.com/20070118/paypal-security-key-fob/
covers paypal and ebay. It's been in place over a year now. You will need to go searching online in ebay and Paypal to find the real links. I had to be logged in to find them and they are internal links.
My bank is a michigan only bank, so it'll probably not be available to you, but the whole system is verisign based so if the company uses verisigns system the same keyfob works for all of them.
Do not look at laser with remaining good eye.
https://www.paypal.com/cgi-bin/webscr?cmd=xpt/Marketing_CommandDriven/securitycenter/PayPalSecurityKey-outside
found a public paypal page with more info about it.
Do not look at laser with remaining good eye.
"Trojan.PWS.ChromeInject.B" is definitely only effective in Windows, because it installs and executes these files: "%ProgramFiles%\Mozilla Firefox\plugins\npbasic.dll" "%ProgramFiles%\Mozilla Firefox\chrome\chrome\content\browser.js" browser.js calls the The dll file, which can't run in Linux, etc. unless you're running a WINDOZE Firefox via crossover (which would be insanely stupid). Also, since it's installed into the program directory (rather than the user's profile), VISTA will almost certainly make you click for "administrator confirmation" before writing the files. (I don't know for sure, because I don't have VISTA.) - - - - - When I enter the URL for http://www.bitdefender.com/VIRUS-1000451-en--Trojan.PWS.ChromeInject.A.html#, the page content is identical the version for "Trojan.PWS.CHromeInject.B" (even the given name is "Trojan.PWS.ChromeInject.B", they even over-wrote the ChromeInject.A page by accident or, ChromeInject.A isn't spreading in the wild AND has nearly identical characteristcs, perhaps differing only in file sizes.) BitDefender provides the following list of banks their page for this version, http://www.bitdefender.com/VIRUS-1000451-en--Trojan.PWS.ChromeInject.B.html: It filters the URLs within the Mozilla Firefox browser and whenever encounter the following addresses opened in the Firefox browser it captures the login credentials. akbank.com caixasabadell.net credem.it areasegura.banif.es banca.cajaen.es openbank.es poste.it banesto.es carnet.cajarioja.es gruposantander.es intelvia.cajamurcia.es net.kutxa.net bancopastor.es bancamarch.es caixamanlleu.es elmonte.es ibercajadirecto.com bancopopular.es bancogallego.es bancajaproximaempresas.com caixa*.es caja*.es ccm.es bancoherrero.com bankoa.es bbvanetoffice.com bgnetplus.com bv-i.bancodevalencia.es clavenet.net fibancmediolanum.es sabadellatlantico.com arquia.es banking.*.de westpac.com.au adelaidebank.com.au pncs.com.au nationet.com online.hbs.net.au www.qccu.com.au boq.com.au banksa.com anz.com suncorpmetway.com.au quiubi.it cariparma.it bancaintesa.it popso.it fmbcc.bcc.it secservizi.it bancamediolanum.it csebanking.it fineco.it gbw2.it gruppocarige.it in-biz.it isideonline.it iwbank.it bancaeuro.it bancagenerali.it bcp.it unibanking.it uno-e.com unipolbanca.it carifvg.com cariparo.it carisbo.it islamic-bank.com banking.first-direct.com natwestibanking.com itibank.co.uk co-operativebank.co.uk lloydstsb.co.uk mybankoffshore.alil.co.im abbeynational.co.uk mybusinessbank.co.uk barclays.com online.co.uk my.if.com anbusiness.com hsbc.co anbusiness.com co-operativebankonline.co.uk halifax-online.co.uk ibank.cahoot.com smile.co.uk caterallenonline.co.uk tdcanadatrust.com schwab.com wachovia.com bankofamerica kfhonline.com wamu.com wellsfargo.com procreditbank.bg chase.com 53.com citizensbankonline.com e-gold.com paypal.com usbank.com suntrust.com banquepopulaire.fr onlinebanking.nationalcity.com