Slashdot Mirror
Bank Accounts Vulnerable For Victims of ZeuS Trojan Variant 'Gameover'
tsu doh nimh writes "Organized crooks have begun launching debilitating cyber attacks against banks and their customers as part of a smoke screen to prevent victims from noticing simultaneous high-dollar cyber heists, the FBI is warning. The thefts, aided by a custom variant of the ZeuS Trojan called 'Gameover,' are followed by distributed denial of service (DDoS) attacks against banks and the victim customers. The feds say the perpetrators also are wiring some of the money from victim organizations directly to high-end jewelry stores, and then sending money mules to pick up the pricey items."
You go to a legitimate page which has been compromised, or is hosting adds and the add site has been compromised. The page attempts to exploit your browser, usually with a disclosed vulnerability. If you haven't applied that latest patch you get knocked over without clicking any links.
After any big even there are usually malicious sites near the top of the Google rankings which will attempt to exploit any one who lands on them. After the tsunami in Japan there were fake news results in the top 10 with in 2-3 hours doing this.
SEO=Search Engine Optimized. So it's like this. Your Flash Player is a month out of date and has a secuity hole. You search for a popular term. Maybe something game related, or porn, or whatever. Bad guy has a carefully crafted page that has been SEOed to appeared fairly high in the rankings for your popular search. The exploit is in the Flash on the page. You don't have to do anything except click the link (which seems perfectly legitimate).
Of course if you've got No-script or Ad Block, you're probably fine, but most people don't use stuff like that. See above for "People expect their computers to be tools" rant. What they did might have been mildly stupid: They should upgrade their plugins, they should read links more carefully, they should use some kind of script blocker, but it falls well within what most normal users would consider reasonable. Still infected though.
I don't need a million points of light, just two points of multi-mode fiber and a 10 Gig-E router.
A large attack vector for SEO poisoning is image searches. Unless you're running with NoScript or JS disabled, all you have to do is click on the wrong link in a random image search result, and the rest happens in the background. While you're sitting there looking at images of Martin Luther King, Jr. (and wondering why there's a photo of chocolate cake on the page as well, and one of some puppies), a multi-exploit probe script starts up in the background, quickly figures out what OS, browser and general environment you're using (think malware author's version of 'make'), and then downloads and executes an exploit path custom to your configuration.
Of course, the term "drive-by download" does also include the FakeAV stuff that automatically downloads and sits in your download folder, waiting for you to say, "hey, what's this zipfile doing in here with the 'reallysuperantivirus.exe' inside? I guess I should run it to find out!"
That is not specific to a country. Any government will do.
Seven puppies were harmed during the making of this post.
I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows. But what about this: I just imaged and updated my Windows 7 64 system, only use Firefox, and have Microsoft AV (free) enabled. I was minding my own business surfing the web in what I thought was a fairly secure setup, some random popup or link injected code through what I believe was a flash vulnerability (again the box was only a month old) and installed some fucked up rootkit that MS AV actually found the next day. WTF? 0-day exploits CRUSH windows, despite the UAV etc, some how this shit still gets through. Yes, I could have done probably xyz things to protect myself, which I would believe if I were running XP, but this is a 1Mo old version of 7, automatic updates, and I only use firefox. FML.
Web browsers should run in a VM session that is incompatible with the host operating system on a binary level. This kind of aformentioned horseshit rarely if ever happens to everyday average normal guys just browsing the web on their Macs or Ubuntu boxes. Also, fuck it, I'm only browsing the web on a Linux image from now on on this Windows box (and just for reference the box is only used for gaming, occasionally slashdot raging)