Feeds

Tracking website eyeballs SpyEye

Security researcher plays Trojan peekaboo

Intelligent flash storage arrays

A website designed to track the control system of the SpyEye crimeware Trojan has been established.

The site, spyeyetracker.abuse.ch*, was set up by Swiss security researcher Roman Hüssy, and modelled on his successful Zeustracker website. The latter site, which was established in early 2009, has helped security researchers to track the activities of the infamous botnet, which is linked to numerous instances of banking fraud.

Chatter on Russian cybercrime forums has suggested the developer of ZeuS has handed over development of the customisable crimeware toolkit to the miscreant behind SpyEye. For now, at least, malicious activities associated with ZeuS far outnumber those associated with SpyEye.

Zeustracker reports 497 ZeuS C&C servers, with 204 of these command nodes active on Tuesday morning. Its sister site pinpoints 61 SpyEye command and controls servers, 29 of which are active.

Both ZeuS and SpyEye are toolkits that allow the creation of customised Trojans. Each is sold through carding and other black-market forums for hundreds of dollars per licence.

Anti-malware detection of Trojans created by both tools is far from satisfactory, with 40.9 per cent detection for SpyEye and 36.9 per cent for ZeuS, according to the respective tracker sites run by Hüssy.

Other strains of financial malware and crimeware toolkits doing the rounds include Bugat, Clampi and Gozi. Bugat was distributed via a high-profile phishing campaign targeting LinkedIn users last month, an attack that captured the attention of security researchers and makes the malware a potentially good candidate for closer tracking in future. ®

*Both The SpyEye and Zeustracker websites link to live cybercrime domains. Casual surfers are strongly advised not to follow links from either site.

Intelligent flash storage arrays

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.