Feeds

Apache plug-in doles out Zeus attack

Points victims to ‘Sweet Orange’ exploit server, slurps banking credentials

Beginner's guide to SSL certificates

Anti-virus outfit Eset has discovered a malicious Apache module in the wild that serves up malware designed to steal banking credentials.

As the company states in this post, the module, dubbed Linux/Chapro, is already being used to inject a version of Win32/Zbot (Zeus) into content served by the compromised Web servers.

The attack points the victim to a Lithuanian server running the Sweet Orange exploit kit. The Sweet Orange authors claim it has a 10 to 25 percent infection rate and can drive 150,000 unique users to its customers, according to ThreatPost.

The process described by Eset goes like this: a user requests a supposedly-innocent Web page from a compromised server, which contacts its command and control server. The C&C machine sends compromised content – like an iframe – back to the Web server, which sends the malicious content to the end user.

That leaves the user infected with Zeus, and under control of the exploit hosting server.

“This complicated case spreads across three different countries, targeting users from a fourth one, making it very hard for law enforcement agencies to investigate and mitigate,” Pierre-Marc Bureau, Eset's security intelligence program manager, wrote in the blog post. “It is not clear at this point in time if the same group of people are behind the whole operation, or if multiple gangs collaborated, perhaps with one to drive traffic to the exploit pack and sell the infected computers to another gang operating a botnet based on Win32/Zbot.”

The attack is carefully designed not to draw attention to itself, Bureau writes. It doesn’t try to serve the malicious frame to search engine robots, and it ignores users connecting to a compromised site over SSH, to avoid infecting site administrators. Cookies and IP address logs are used to avoid sending the exploit to any user more than once. ®

Internet Security Threat Report 2014

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Managing SSL certificates with ease
The lack of operational efficiencies and compliance pitfalls associated with poor SSL certificate management, and how the right SSL certificate management tool can help.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.