Bank Accounts Vulnerable For Victims of ZeuS Trojan Variant 'Gameover'

tsu doh nimh writes "Organized crooks have begun launching debilitating cyber attacks against banks and their customers as part of a smoke screen to prevent victims from noticing simultaneous high-dollar cyber heists, the FBI is warning. The thefts, aided by a custom variant of the ZeuS Trojan called 'Gameover,' are followed by distributed denial of service (DDoS) attacks against banks and the victim customers. The feds say the perpetrators also are wiring some of the money from victim organizations directly to high-end jewelry stores, and then sending money mules to pick up the pricey items."

Comments

Ha! Stupid criminals

[Baloroth]

I keep all my money in my house! Perfectly safe. No organized crooks gonna steal my money.

Re:Ha! Stupid criminals

[fsckmnky]

Perhaps you have not heard the term "quantitative easing."

Re:Ha! Stupid criminals

[ColdWetDog]

I would certainly not describe the current US government as 'organized'.

The Keystone Cops come to mind as a role model.

Re:Ha! Stupid criminals

[Relayman]

Just don't donate the suit with the $13,000 in it to Goodwill.

Re:Ha! Stupid criminals

[History's Coming To]

You might be kidding but I keep a 6-month-earnings stash in banknotes nearby for exactly that reason. The banks seem to be all too good at just giving/gambling customer's money away these days.

Re:Ha! Stupid criminals

[Dunbal]

That is not specific to a country. Any government will do.

Re:Ha! Stupid criminals

[Dunbal]

Yep, it's not like you're going to be taking a hit on the lost interest, either. When you factor in service charges, it costs you money to keep your money in a bank. And if they can't even keep your money safe, well, what is the point?

Re:Ha! Stupid criminals

[ZenDragon]

Off topic I know, but that's really weird... why would he have 13k in cash in a suit pocket that he intended to spend on hospital bills? Something doesn't add up there.

Re:Ha! Stupid criminals

[davecason]

And mine is in gold... does anybody have a wheelbarrow I can borrow?

Re:Ha! Stupid criminals

[Aighearach]

Yep, it's not like you're going to be taking a hit on the lost interest, either. When you factor in service charges, it costs you money to keep your money in a bank.

If you're paying more in charges than you're getting in interest, you're either misusing a debit card, or have too small an amount in the bank for a useful generalization.

Still clicking the links in emails?

[somebodee]

Seriously? People are /still/ clicking the links in shady emails/downloading files from them? What, is this 1998?

Re:Still clicking the links in emails?

[fsckmnky]

Who can resist an important message from Sandra, the topless 3 boobed Nigerian government official charged with distributing $10 million dollars in oil industry windfall profits and free samples of Viagra ?

Re:Still clicking the links in emails?

[gvaness]

Sounds hot, you got a link?

Re:Still clicking the links in emails?

[Archangel Michael]

Think about it this way, then it will make perfect sense. Think about how ignorant the average person is, and realize that about 1/2 of the people are even more ignorant than average (for acceptable levels of average).

So yes, people still are doing stupid stuff on computers.

Re:Still clicking the links in emails?

[amicusNYCL]

Zeus is spread mainly through drive-by downloads and phishing schemes.

Drive-by downloads have been the primary infection vector for a while now.

Re:Still clicking the links in emails?

[Anonymous Coward]

I'm unclear on the term "Drive By Download"...to me it's always meant "Stupid User Clicked Install", I don't mean to be elitist or a jerk, I just want a definition of the phrase

Re:Still clicking the links in emails?

[bmo]

No, "drive by download" means going to google, clicking on a SEO link attached to a malware site, and getting screwed over.

You're being elitist.

--
BMO

Re:Still clicking the links in emails?

[Fluffeh]

I find your comment interesting and would like to subscribe to your newsletter.

Re:Still clicking the links in emails?

[Anonymous Coward]

Think about how ignorant people are they can not program their own space shuttle launch and all the surrounding software that goes with it! Geeze anyone should be able to do that. Yet none never bother.

That is how your post sounds. To *MOST* people computers are just some toy or tool to get things done. Not something they really want to give a crap about.

Re:Still clicking the links in emails?

[LordLimecat]

not to mention ignorant.

Its always the clever ones who think their 1337 skilz will render them immune to exploits for their out-of-date java plugin.

Re:Still clicking the links in emails?

[Anonymous Coward]

You go to a legitimate page which has been compromised, or is hosting adds and the add site has been compromised. The page attempts to exploit your browser, usually with a disclosed vulnerability. If you haven't applied that latest patch you get knocked over without clicking any links.

After any big even there are usually malicious sites near the top of the Google rankings which will attempt to exploit any one who lands on them. After the tsunami in Japan there were fake news results in the top 10 with in 2-3 hours doing this.

Re:Still clicking the links in emails?

[DrgnDancer]

SEO=Search Engine Optimized. So it's like this. Your Flash Player is a month out of date and has a secuity hole. You search for a popular term. Maybe something game related, or porn, or whatever. Bad guy has a carefully crafted page that has been SEOed to appeared fairly high in the rankings for your popular search. The exploit is in the Flash on the page. You don't have to do anything except click the link (which seems perfectly legitimate).

Of course if you've got No-script or Ad Block, you're probably fine, but most people don't use stuff like that. See above for "People expect their computers to be tools" rant. What they did might have been mildly stupid: They should upgrade their plugins, they should read links more carefully, they should use some kind of script blocker, but it falls well within what most normal users would consider reasonable. Still infected though.

Re:Still clicking the links in emails?

[Em Adespoton]

A large attack vector for SEO poisoning is image searches. Unless you're running with NoScript or JS disabled, all you have to do is click on the wrong link in a random image search result, and the rest happens in the background. While you're sitting there looking at images of Martin Luther King, Jr. (and wondering why there's a photo of chocolate cake on the page as well, and one of some puppies), a multi-exploit probe script starts up in the background, quickly figures out what OS, browser and general environment you're using (think malware author's version of 'make'), and then downloads and executes an exploit path custom to your configuration.

Of course, the term "drive-by download" does also include the FakeAV stuff that automatically downloads and sits in your download folder, waiting for you to say, "hey, what's this zipfile doing in here with the 'reallysuperantivirus.exe' inside? I guess I should run it to find out!"

Re:Still clicking the links in emails?

[DeadCatX2]

One day, I was browsing Google Image Search, looking to identify an ambiguous connector. (it ended up being a connector from JST)

Suddenly, I'm greeted with a UAC prompt. Having done nothing to instigate a UAC prompt, I immediately killed firefox. Nonetheless, there was a rogue process on my machine that was attempting to gain root access by desperately popping up anti-virus messages. Being an intelligent user, I discovered what process was responsible and promptly killed and deleted the offending binary from my machine.

I never even clicked anything.

Re:Still clicking the links in emails?

[anubi]

I noticed you posted as AC. I do not like to like to say what I need to say in cases like this, as I do not like hurt feelings.

You are average. You are not a computer "nerd" and are uninformed on the workings of errant programmers.

Programmers with malicious intent prey on people like you.

You could have googled "drive-by download" in less time than it took to post, and got lots of answers.

You didn't.

You wanted someone else to do it for you.

Well, that makes sense in a way.

In the business world, its called "delegation", and people who are good at it make a lot more money than those who just do what they are told.

In the shyster world, they are willing to tell you anything you want to hear in order to get you to admit their shyster code into your machine. Big deal, you might say.

Remember, even the lettering on the buttons is set by the programmer, Once you understand the power of JavaScript, you realize NOTHING your screen tells you can actually be trusted.

Really, no big deal? Its just a computer? How about handing out your checkbook, legal papers, deeds to your house, along with your personal seal of authenticity - to strangers?

Anything YOU can do on your computer, a stranger can do too, in your name, and probably a whole lot more that you didn't know you could do.

Once you have admitted their "agent" into your machine, its as if you have admitted an invisible "housekeeper" into your home, which can rifle through all your personal effects retrieving and sending to its author anything on its agenda.

Many people have not learned yet to take their privacy seriously.

They are led to believe "I am not a criminal - I do not have nothing to hide. If you have something to hide, its only because I have done something wrong which I am trying to keep from you!".

This whole story is about privacy - or what happens when it is breached - in this case by a computer trojan.

This is why we have so many stories and discussion here on Slashdot about how precious our privacy is,

Even "respectable businesses" that spill private information often shy away from cleaning up the mess made in your life by shysters taking advantage of the situation at your expense.

I cringe every time I hear someone accusing me of having something to hide because I must have done something wrong. Although I am not supposed to pray for someone else's woes, I often find myself uttering a silent prayer that their pristine crystal world will be shattered by someone taking their good name for a roll in the pig sty.

If "privacy" is so wrong, then why is our government so adamant on "security clearances".?

Re:Still clicking the links in emails?

[dissy]

While having out of date software is asking for troubles, lately with the thriving zero-day exploit market, even performing that task is not guaranteed to protect you.

It really requires nothing more than clicking the first link in Google.

Scary world. But aside that, you can't possibly blame the person using the web for a zero day (That's addressed to you Mr GP, not the parent)

Re:Still clicking the links in emails?

[TwilightXaos]

But people do "give a crap about" their money. To imply that parting fools from their money necessitates computers is disingenuous.

Re:Still clicking the links in emails?

[Dunbal]

No one can program their own space shuttle launch. That's why it takes a team - even for NASA.

As for YOUR post - if you drive a car you are expected to know a) how an internal combustion engine works and what oil is for and why you should check it once in a while b) whether your car runs on diesel or gasoline/petrol c) how to change a flat tire and d) when to take your car in for service/repairs. If you don't know the preceeding, then you really shouldn't be driving a car. Likewise with computers.

Re:Still clicking the links in emails?

[bmo]

>A large attack vector for SEO poisoning is image searches

I personally ran into this while looking for flooding pictures in Warwick RI a couple of springs back.

Nearly half the Google results on the first page were SEO malware sites.

--
BMO

Re:Still clicking the links in emails?

[f1vlad]

You can see plenty of them here: http://www.419eater.com/ in a Hall of Shame.

Re:Still clicking the links in emails?

[Archangel Michael]

Car Analogy: "I hear, if you put a cup of sugar in your gas tank, you can get double the miles per gallon you get now"

I expect that enough people don't know enough about cars that some idiot might WANT to believe such a statement long enough to put sugar in their gas tank, HOPING to get better mileage because they do care about money.

YES, I do expect people to know about how a ICE works, enough to know that putting sugar in the gas tank is a BAD idea. That is why Social Engineering is the greatest threat to computers, because the whole point of it is proven by how successful it is. And that arises because people are ignorant, trusting, hopeful, greedy ...

Humans are flawed. Most of us tragically so.

Re:Still clicking the links in emails?

[cavreader]

Too many people confuse the right to privacy with the right of anonymity. Personal information on people existed prior to the Internet and IP addresses. Things like phone books, marriage records, birth certificates, home/auto loans, and property deeds which can be obtained at any local government that keeps track of property taxes. Utility bills, drivers licenses, education records, insurance policies, and bank records have been available easily with or without any subpoena for over the past 50+ years. Earn no income that is subject to state or federal taxes otherwise that information will also be available in hard copy. The Internet just makes collecting this information faster. If you really want privacy unplug, store your money in your mattress, use cash and barter for all financial transactions , never enter into any type of agreement that requires more than a handshake, move to the wilderness and be prepared to turn off any anything that shows up in infrared when the satellites make their pass over your place. If this all seems too much of bother you could just stop posting your life story on Face book. If someone wants your information they don't need the Internet to get it. We have finally entered into the era where a lot of people have never had to live without access to the Internet and unfortunately these people are turning out to be the biggest morons on the planet. If you want true facts good luck finding them on the Internet, If you want a real education stop using Internet searches to find your answers and do real research that *gasp* might rely on using hard copy books. The Internet was supposed to herald the age of free and easy information exchange unfortunately the majority of that free information is bullshit and all around mis-information that has only increased the amount of acrimony and animosity in the world.

Re:Still clicking the links in emails?

[berzerke]

...Of course if you've got No-script or Ad Block, you're probably fine...

Ad Block I love (actually adblock plus), but I've tried No-Script and don't have it any more. It's a great idea, but for most people, it's just too much work. Too many sites don't work properly without javascript. It's stupid and it's wrong, but that's the reality on the web. You wind up just disabling no-script before too long because yet another site doesn't work properly and you're tired of making an exception for every site, or in my case, get tired of the [quite understandable] complaints.

Re:Still clicking the links in emails?

[jahudabudy]

Oh, come off it. Cars are much simpler to maintain and operate than computers. Spotting the square tires that will break my car when I put them on is much much easier than spotting the game with malware embedded in it that will break my computer. The whole point of a computer is to enable me to run multiple third party programs. If every time I wanted to change the dice hanging from my rear view mirror I had to worry about them silently altering my air/fuel injection ratio, then you might have a point.

Re:Still clicking the links in emails?

[Stan92057]

"You could have googled "drive-by download" [google.com] in less time than it took to post, and got lots of answers." 99.9% of the true geeks in the world would have done just that but the rest of us social beings like asking other people questions. Theres 1000,s of thing i could just have used Google for but where the fun in that? What use would Slashdot be if everyone just "Google it" Assumption is the mother of all fuck ups. You assume hes lazy when in fact hes just being social.

Re:Still clicking the links in emails?

[BranMan]

-99% of drivers have no idea how an ICE works (or what that stands for, or even that they have one in their car) -95%+ of drivers don't now anything about oil (and many new cars now have an idiot light to tell you to get it changed) -Only one of the nozzles at the gas pump (gas or diesel) will fit in your car. They needed that for a reason. -95% of drivers have never changed a flat, or know how - There is an idiot light "I need service" on the dash

So by your accounting 95%+ of drivers should not be driving. Yeah, that will happen.

Anonymous?

[MisterMidi]

Could this be related to the recent news about Anonymous?

off topic: Security/Wordpress

[s1d3track3D]

Why is it that every time I see a 'security' oriented blog, it is running on Wordpress?

anonymous?

[Tyrannosaur]

didnt we just have an article about anonymous threatening banks?

Crooks like these are doing it wrong.

[140Mandak262Jamuna]

What is the world coming to nowadays? Why are these crooks looking for holes in the computer servers and steal money? Why can't they steal the money honestly by buying the congress critters and passing legislation that forks over 7.1 trillion dollars? When will these crooks realize the Return on Investment for putting money in campaign contribution is like one million percent. These American Congresscritters are the best money can buy. Instead they go hire script kiddies and money mules. People like these give a bad name to the legitimate thieves of Wall Street.

On the same road

[currently_awake]

The foreign crooks are doing exactly what our local crooks did, just further back on the timeline. First they got a lot of money from prohibition, then they broke into the big time money of politics. The key point is you can't take short cuts on the road to evil wealth and power, you've got to achieve all the sub-quests along the way before you get to fight the final boss. You don't get to bribe the federal gov without large bags of money and knowing the right people to pay off.

"Cyber heist"

[Ltap]

For when you really need to dress something up as dangerous, the type of thing that would star a team of, perhaps, eleven big-name actors and a casino.

My wife handles the banking

[VTEngineer]

and my daughters use her computer. I have little doubt it has been hacked as I've had to re-image it several times. I can not convince my wife to use a live CD for online banking. I guess it will take us getting wiped out to drive home this point. There is an inflection point between prudence and convenience. Woman are especially non prudent (I want to access my bank when I need it, I am not going to reboot) This is a larger problem of identity that needs solving. It is big bucks now. We need a secure solution. As as a professional coder, I do not see one. Anything on the net can be hacked. Voting machines? On the net, consider the election stolen. Heck, just electronic voting, consider the election stolen. Nothing electronic is immune and all of it is vulnerable. Stinks, but that is reality.

Re:My wife handles the banking

[tlhIngan]

and my daughters use her computer. I have little doubt it has been hacked as I've had to re-image it several times. I can not convince my wife to use a live CD for online banking. I guess it will take us getting wiped out to drive home this point. There is an inflection point between prudence and convenience. Woman are especially non prudent (I want to access my bank when I need it, I am not going to reboot) This is a larger problem of identity that needs solving. It is big bucks now. We need a secure solution. As as a professional coder, I do not see one. Anything on the net can be hacked. Voting machines? On the net, consider the election stolen. Heck, just electronic voting, consider the election stolen. Nothing electronic is immune and all of it is vulnerable. Stinks, but that is reality.

Computers are cheap. Buy a cheap one. Do whatever you can to lock it down. And use it ONLY for banking.

A cheapass notebook without flash (gets rid of gaming and crap) and too slow to run anything other than a browser makes a great banking computer. And it's cheap, and thus, you can make it an appliance. Make the default homepage the bank site and have it load the browser on boot.

Have a general "screwing around" computer for games and all that. Then have a nice PC used strictly for banking and only banking.

Rebooting is a pain. Having another PC to conveniently do a bank transaction instead of having to reboot, and she can see her spreadsheets and accounting packages and banking on separate screens? Priceless.

And while you're at it, get some computers for the kids.

It's the best use for netbooks, really.

So much for obscurity....

[macraig]

So much for your obscure security... you just put out a press release for the whole world. You couldn't have done worse if you'd painted big bullseyes on your garage and roof - don't wanna exclude yourself from satellite view - with a red $ sign where the dot should be. *snicker*

Re:Jewelry stores

[macraig]

You and I might see their behavior as hypocritical and double-standardish, but they don't. I doubt we have a pin sharp enough to burst their bubble.

We're all nerds here

[ctime]

I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows. But what about this: I just imaged and updated my Windows 7 64 system, only use Firefox, and have Microsoft AV (free) enabled. I was minding my own business surfing the web in what I thought was a fairly secure setup, some random popup or link injected code through what I believe was a flash vulnerability (again the box was only a month old) and installed some fucked up rootkit that MS AV actually found the next day. WTF? 0-day exploits CRUSH windows, despite the UAV etc, some how this shit still gets through. Yes, I could have done probably xyz things to protect myself, which I would believe if I were running XP, but this is a 1Mo old version of 7, automatic updates, and I only use firefox. FML.

Web browsers should run in a VM session that is incompatible with the host operating system on a binary level. This kind of aformentioned horseshit rarely if ever happens to everyday average normal guys just browsing the web on their Macs or Ubuntu boxes. Also, fuck it, I'm only browsing the web on a Linux image from now on on this Windows box (and just for reference the box is only used for gaming, occasionally slashdot raging)

Re:We're all nerds here

[ledow]

"Web browsers should run in a VM session"

Or just have proper isolation and not ***execute*** random code at all.

The problem with Windows is not necessarily programmers, it's the design and the expectations of its users. For some reason, if your email client doesn't automatically execute and display that Powerpoint presentation without warnings, people get annoyed. If the Flash/Java sections of a website aren't seamlessly executed as they load people think things are broken. If the executable they download isn't immediately installable, they question it. If their Word macros don't run when they open the documents, they complain.

The "saviour" of other OS is really the culture (because we're not immune to the same things happening on Linux, etc. you know?) - You *can't* execute code without the execute bit set, and users of the system know WHY that is, and they are careful about what they apply the execute bit to (and we don't put up messages that say "Hey, this isn't executable, shall I do it for you?").

Is there an equivalent concept of "non-executable" on Windows that's usable in an everyday environment for random users? Not really. The nearest you get is Software Restriction policies, but they are a nightmare to manage and nobody uses them (and even then it's still possible to execute random code from the Internet if you just pipe it through a trusted program, e.g. a Word macro).

If you use a decent browser with the correct security, Flash/Java apps appear as nothing more than a play button that *YOU* decide to click and ZERO code is executed from that app until you do (and you'd be amazed how many play buttons I see each day just browsing ordinary websites that I *NEVER* click on because I stop noticing they are there unless I've gone to something that I understand NEEDS to execute a Java app for whatever reason).

Why a web browser NEEDS to run executable code to do its job, I'll never understand - it's nothing more than a renderer, like Ghostscript, except you don't see Ghostscript executing in-built shell commands or machine code in the Postscript its trying to render (though even that's had its fair share of problems, they are NOTHING compared to a browser flaw). Does Internet Explorer even have options to let you selectively load Flash/Java? No (and even on Firefox, it's an additional plugin). Opera has it available by default, though.

Hell, Intel, nVidia, Windows Update etc. encourage you to run an ActiveX or Java app so they can "detect your hardware" to choose the best drivers - does that not throw warning bells to people about how much access it would have to the system if you allowed it? And because it's the largest companies (and even the suppliers of the damn OS) that encourage it, people think that's okay.

The problem of viruses is NOT computer related, it's entirely user-related. Not updating software, not running AV (though I'm against the whole idea of AV, personally, when managing your computer properly works so much better), not clicking Yes, inserting untested storage devices, having Autorun enabled, not having the most basic firewall, etc. The holes that are there are there because of the design / choices / implementation of the OS manufacturer, sure, but they get exploited because of the choices of the user.

The systems that OS vendors have deployed against viruses include anti-virus (the biggest scam of our time, as far as I'm concerned), forcing Autorun off after 10 years of OS deployment, running browsers in separate processes to explorer windows and other ridiculous half-measures.

At no point is there a mention of complete isolation (as in a chroot-style environment - why does a browser EVER need to write to anything other than a single downloads directly that the OS won't let you run programs directly from it?), or of just not executing this crap by default. How many programs actually assign Windows ACL permissions to their folders, for example? Hell, historically WMF's were nothing more than a list of GDI-executed

Re:We're all nerds here

[Spodi]

I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows.

Mmm, and it surely isn't because Windows is popular, easy, and familiar, making it much more common among the technologically illiterate. The problem isn't so much the OS, its the user.

Re:We're all nerds here

[jader3rd]

Were you running as admin?

Re:We're all nerds here

[tlhIngan]

I can hear the booo and hisses already, but this is a large reason why I fucking hate Windows. Let's be real here, everyone getting hacked by these knuckleheads are idiots themselves (to a degree) AND running windows. But what about this: I just imaged and updated my Windows 7 64 system, only use Firefox, and have Microsoft AV (free) enabled. I was minding my own business surfing the web in what I thought was a fairly secure setup, some random popup or link injected code through what I believe was a flash vulnerability (again the box was only a month old) and installed some fucked up rootkit that MS AV actually found the next day. WTF? 0-day exploits CRUSH windows, despite the UAV etc, some how this shit still gets through. Yes, I could have done probably xyz things to protect myself, which I would believe if I were running XP, but this is a 1Mo old version of 7, automatic updates, and I only use firefox. FML.
 

That's the problem, you used Firefox. Firefox runs as local user on all Windows systems, while IE and I believe Chrome can run in "low integrity mode" on Windows Vista and higher.

Yes, IE and Chrome end up more secure than Firefox, as hard as it is to believe.

Low integrity mode is a sandbox mode where Windows will disallow all access to the filesystem (except to one well known restricted spot), the registry is virtualized (thorugh UAC), interaction is limited through certain IPC (low integrity processes cannot send window messages to higher integrity processes nor keystrokes/mouse movements) and all processes creates are also low-integrity. Basically, it's the same as running your browser as nobody on Linux.

IE has to jump through hoops in order to download a file - it doesnloads it then kicks off a helper program through IPC to move the file (IE proper only has access to the sandbox filesystem - it cannot read nor write anywhere else and requires a helper to download and upload files). The helper is the one that displays the dialog boxes for the download (and the low-integrity process as no say - keeping drive by downloads from happening).

Your second problem is Flash. The buggiest and most insecure plugin for a browser. It's so bad Firefox has to run it as a separate process, Chrome started the process separation thing, etc. Even worse, there's nothing to prevent that Flash drive-by from infecting a Mac, Android or Linux box.

Yeah, but...

[Kamiza Ikioi]

They created something truly devious in the game over trojan. We all just lost.

Reducing effect of Zeus

[derekmelber]

This is a nasty infection and can cause significant damage. From what I have read, Zeus can attack both users who are local admins and those that are non-admins. The difference is that the attack of non-admins is only for that user, where if the user is a local admin, every user is infected! To reduce the attack surface and reduce the overall effectiveness of Zeus, you should make all users non-admins! Software to help with that is PowerBroker Windows Desktops (www.beyondtrust.com), which runs on Windows XP, Vista, and 7, as well as server OSs by microsoft. This software can ensure that users can run all of their required apps, even if they require local admin privileges. Removing the user from being a local admin can also stop the effectiveness of over 95% of all other malicious apps that might attack the computer, according to Microsoft.

Derek Melber, MVP

APK is a cunt.

[bmo]

What is your major malfunction?

--
BMO