Feeds

Apache plug-in doles out Zeus attack

Points victims to ‘Sweet Orange’ exploit server, slurps banking credentials

Next gen security for virtualised datacentres

Anti-virus outfit Eset has discovered a malicious Apache module in the wild that serves up malware designed to steal banking credentials.

As the company states in this post, the module, dubbed Linux/Chapro, is already being used to inject a version of Win32/Zbot (Zeus) into content served by the compromised Web servers.

The attack points the victim to a Lithuanian server running the Sweet Orange exploit kit. The Sweet Orange authors claim it has a 10 to 25 percent infection rate and can drive 150,000 unique users to its customers, according to ThreatPost.

The process described by Eset goes like this: a user requests a supposedly-innocent Web page from a compromised server, which contacts its command and control server. The C&C machine sends compromised content – like an iframe – back to the Web server, which sends the malicious content to the end user.

That leaves the user infected with Zeus, and under control of the exploit hosting server.

“This complicated case spreads across three different countries, targeting users from a fourth one, making it very hard for law enforcement agencies to investigate and mitigate,” Pierre-Marc Bureau, Eset's security intelligence program manager, wrote in the blog post. “It is not clear at this point in time if the same group of people are behind the whole operation, or if multiple gangs collaborated, perhaps with one to drive traffic to the exploit pack and sell the infected computers to another gang operating a botnet based on Win32/Zbot.”

The attack is carefully designed not to draw attention to itself, Bureau writes. It doesn’t try to serve the malicious frame to search engine robots, and it ignores users connecting to a compromised site over SSH, to avoid infecting site administrators. Cookies and IP address logs are used to avoid sending the exploit to any user more than once. ®

The essential guide to IT transformation

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New twist as rogue antivirus enters death throes
That's not the website you're looking for
ISIS terror fanatics invade Diaspora after Twitter blockade
Nothing we can do to stop them, says decentralized network
prev story

Whitepapers

A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.