Feeds

Apache plug-in doles out Zeus attack

Points victims to ‘Sweet Orange’ exploit server, slurps banking credentials

Providing a secure and efficient Helpdesk

Anti-virus outfit Eset has discovered a malicious Apache module in the wild that serves up malware designed to steal banking credentials.

As the company states in this post, the module, dubbed Linux/Chapro, is already being used to inject a version of Win32/Zbot (Zeus) into content served by the compromised Web servers.

The attack points the victim to a Lithuanian server running the Sweet Orange exploit kit. The Sweet Orange authors claim it has a 10 to 25 percent infection rate and can drive 150,000 unique users to its customers, according to ThreatPost.

The process described by Eset goes like this: a user requests a supposedly-innocent Web page from a compromised server, which contacts its command and control server. The C&C machine sends compromised content – like an iframe – back to the Web server, which sends the malicious content to the end user.

That leaves the user infected with Zeus, and under control of the exploit hosting server.

“This complicated case spreads across three different countries, targeting users from a fourth one, making it very hard for law enforcement agencies to investigate and mitigate,” Pierre-Marc Bureau, Eset's security intelligence program manager, wrote in the blog post. “It is not clear at this point in time if the same group of people are behind the whole operation, or if multiple gangs collaborated, perhaps with one to drive traffic to the exploit pack and sell the infected computers to another gang operating a botnet based on Win32/Zbot.”

The attack is carefully designed not to draw attention to itself, Bureau writes. It doesn’t try to serve the malicious frame to search engine robots, and it ignores users connecting to a compromised site over SSH, to avoid infecting site administrators. Cookies and IP address logs are used to avoid sending the exploit to any user more than once. ®

New hybrid storage solutions

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.