Slashdot Mirror

← Back to Stories (view on slashdot.org)

Sykipot Trojan Variant Stealing DoD Smartcard Credentials

Posted by Soulskill on from the tax-money-well-spent dept.

Trailrunner7 writes "A new research report says variants of the Sykipot Trojan have been found that can steal Dept. of Defense smartcard credentials. The research, published in a blog post Thursday, is the latest by Alien Vault to look at Sykipot, a Trojan horse program known to be used in targeted attacks against the defense industry. The new variants, which Alien Vault believes have been circulating since March, 2011, have been used in 'dozens of attacks' and contain features that would allow remote attackers to steal smart card credentials and access sensitive information."

6 of 44 comments (clear)

  1. Ouch! by jd · · Score: 4, Interesting

    Those cards are heavily used. It's not like this would only impact e-mail, the cards are pretty much used for everything.

    --
    It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
    1. Re:Ouch! by HBI · · Score: 3, Informative

      They are frequently reissued and new certs generated. This causes its own issues, though. The reissued cards cost money and time, and they cause an issue when trying to decrypt old mail, for instance. Specifically, you can't.

      The whole PKI infrastructure thing has not been a glowing success in its largest known implementation.

      --
      HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
    2. Re:Ouch! by jank1887 · · Score: 3, Informative

      smart cards are not used without passwords. there's still a 'something you know' aspect to go along with something you have. it's just not the traditional login/password.

  2. That's what they want you to think by dak664 · · Score: 4, Funny

    There is a trojan within the trojan to guide the black helicopters to your home. In fact I risk the BSOD just posting this.

  3. Re:Authentication 101 by Jumperalex · · Score: 4, Informative

    If the Trojan can pull pki credentials it can keylog pins.

    --
    If you can't be good, be good at it!
  4. Well, only sort of... by Thad+Zurich · · Score: 5, Insightful

    The trojan steals "use" of the inserted card, and probably the PIN. The private key remains safely in the card, and the trojan can't use it once the card is removed. The defenses are (1) don't use smart card on untrusted computer, or (2) if no other choice, use smart card only long enough to accomplish a specific task. The smart card PIN can be changed by the user, so it may not even be necessary to revoke the credential after an exposure. However, the trojan also gains temporary use of the card holder's digital signature -- meaning that authentic digitally-signed spear phishing emails could be sent under the card-holder's email account. If the card is inserted but the PIN is never entered, then a trojan might maliciously enter several random PINs and block the card as a DoS attack...