Carberp Banking Trojan Goes Commercial; Adds Bootkit and $40K Price Tag
Contributed by: Email on 12/15/2012 04:52 PM
[
Comments
]
You can say one thing for the underground malware distribution market, theres certainly never a lack of drama. Weeks after the banning of Aquabox, the keeper of the Citadel banking Trojan, from an underground forum, another player has popped up to fill the market gap, this time with a new version of the Carberp Trojan.
This is a first for the Carberp gang, which until now had never sold its malware in the open, said Limor Kessem, communications specialist and team leader for RSA Securitys FraudAction team. The new version of the banking malware comes with beefed up data-stealing capabilities and the addition of the Rovnix bootkit and builder kit for a hefty $40,000 price tag. For fees ranging between $2,000 and $10,000, customers can buy the kit as a service, sans the builder and bootkit.
The addition of Rovnix, Kessem said, is an especially interesting twist in that it infects a computers volume boot record, giving it ring0 privileges and making not only difficult to detect, but clean up.
This is more sophisticated and costly than other malware; weve seen no one charge $40,000 for malware. They dont feel its an exaggerated price, Kessem said. We havent seen whos buying it, but they believe there will be demand. You have to have resources and know-how to operate the malware. Malware doesnt come with an install wizard. You have to have knowledge about systems and Windows internals; its not simple to do. Whoever buys this will have to know what theyre doing.
The high price tag, Kessem said, is a deterrent to anyone buying the kit as a whole, customizing it and selling off variants. After some members of the Carberp gang were arrested earlier this year in Russia, the gang pulled back its efforts.
Theyre willing to sell some, but for the most part they want to be private and careful, Kessem said. Buyers of the $10,000 monthly service subscription have to have extensive knowledge of how to operate the malware, she said, but the lower end subscriptions are likely for beginners and wont have access to the malware itself.
Citadels Aquabox, meanwhile, shifted his strategy during the summer when he decided he would sell only to people he knew or were vouched for by current customers. When Citadel was updated in October, he pulled back support as well for new customers and that led to a dispute from one botnet operator that led to Aquaboxs ultimate dismissal from the trading forum.
Carberp started out as straightforward data-stealing banking malware, but quickly evolved with plug-ins that removed antimalware software or detected and killed other malware on an infected PC. Communication to and from the malware and command and control servers is also encrypted using a randomly generated RC4 key that is sent with a HTTP request.
Today, Kaspersky Lab researcher Denis Maslennikov wrote a report on a Carberp conducting man in the mobile attacks, that similar to Zitmo and SpitMo, intercept transaction authorization numbers (TANs) sent via SMS to a user to authenticate transactions.
Carberp in the mobile behaves similarly to Zitmo (Zeus in the mobile) or SpitMo (SpyEye in the mobile) in that it attacks Android devices and intercepts the SMS messages containing the TANs and redirects them to the attacker, who can then carry out transactions as if they were the victim.
Carberp in the mobile alters the victims online banking page on the fly, asking them to install an update that is required for log in. The user would be required to enter their mobile number and receive a link to the phony update via SMS message or QR code. The user would be instructed to download the update on their PC and mobile device, infecting both.
Maslennikov said one of Russias most popular banks Sberbank is under attack, and a QR code was leading users to the SberSafe application, the alleged security upgrade that has been in Google Play since Nov. 30. He said the app has been downloaded at least 100 times, as have other similar malicious apps.
This is a first for the Carberp gang, which until now had never sold its malware in the open, said Limor Kessem, communications specialist and team leader for RSA Securitys FraudAction team. The new version of the banking malware comes with beefed up data-stealing capabilities and the addition of the Rovnix bootkit and builder kit for a hefty $40,000 price tag. For fees ranging between $2,000 and $10,000, customers can buy the kit as a service, sans the builder and bootkit.
The addition of Rovnix, Kessem said, is an especially interesting twist in that it infects a computers volume boot record, giving it ring0 privileges and making not only difficult to detect, but clean up.
This is more sophisticated and costly than other malware; weve seen no one charge $40,000 for malware. They dont feel its an exaggerated price, Kessem said. We havent seen whos buying it, but they believe there will be demand. You have to have resources and know-how to operate the malware. Malware doesnt come with an install wizard. You have to have knowledge about systems and Windows internals; its not simple to do. Whoever buys this will have to know what theyre doing.
The high price tag, Kessem said, is a deterrent to anyone buying the kit as a whole, customizing it and selling off variants. After some members of the Carberp gang were arrested earlier this year in Russia, the gang pulled back its efforts.
Theyre willing to sell some, but for the most part they want to be private and careful, Kessem said. Buyers of the $10,000 monthly service subscription have to have extensive knowledge of how to operate the malware, she said, but the lower end subscriptions are likely for beginners and wont have access to the malware itself.
Citadels Aquabox, meanwhile, shifted his strategy during the summer when he decided he would sell only to people he knew or were vouched for by current customers. When Citadel was updated in October, he pulled back support as well for new customers and that led to a dispute from one botnet operator that led to Aquaboxs ultimate dismissal from the trading forum.
Carberp started out as straightforward data-stealing banking malware, but quickly evolved with plug-ins that removed antimalware software or detected and killed other malware on an infected PC. Communication to and from the malware and command and control servers is also encrypted using a randomly generated RC4 key that is sent with a HTTP request.
Today, Kaspersky Lab researcher Denis Maslennikov wrote a report on a Carberp conducting man in the mobile attacks, that similar to Zitmo and SpitMo, intercept transaction authorization numbers (TANs) sent via SMS to a user to authenticate transactions.
Carberp in the mobile behaves similarly to Zitmo (Zeus in the mobile) or SpitMo (SpyEye in the mobile) in that it attacks Android devices and intercepts the SMS messages containing the TANs and redirects them to the attacker, who can then carry out transactions as if they were the victim.
Carberp in the mobile alters the victims online banking page on the fly, asking them to install an update that is required for log in. The user would be required to enter their mobile number and receive a link to the phony update via SMS message or QR code. The user would be instructed to download the update on their PC and mobile device, infecting both.
Maslennikov said one of Russias most popular banks Sberbank is under attack, and a QR code was leading users to the SberSafe application, the alleged security upgrade that has been in Google Play since Nov. 30. He said the app has been downloaded at least 100 times, as have other similar malicious apps.
Comments
