Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Smart malware steals from SSL streams


  • Please log in to reply

#1
Retired Tech

Retired Tech

    Retired Staff

  • Retired Staff
  • 20,563 posts
A new variant of the Russian Gozi Trojan has been discovered that is capable of stealing data during secure socket layer (SSL) transactions.

The Trojan is one of the most sophisticated yet found and has a variety of features designed to make it difficult to locate. When it detects an SSL transaction it activates and begins key-logging the infected computer to steal account details.

In addition the Trojan makes itself difficult to detect by constantly changing its coding so that signature-based systems will not detect it.

It also has its own compression software and will compress and extract portions of its code to further disguise itself.

"It is bad enough that this new version of Gozi can encrypt and rotate its program code to bypass conventional signature detection," said Geoff Sweeney, chief technical officer at security analysis software company Tier-3.

"But the fact that it can switch a key-logging function on and off when the infected PC reaches an e-banking web page makes it almost undetectable using conventional IT security technology.

http://uk.news.yahoo...am-6315470.html
  • 0

Advertisements


#2
Rainey777417

Rainey777417

    Member

  • Member
  • PipPip
  • 30 posts
Hi there!
I got the chills when I read this!
I THINK THIS IS WHAT HAS GOT ME!!!

As of this week, I can no longer access (sign-in) MSN Hotmail, MSN Explorer or any of my secure sites!
I did a diagnostic for Windows XP Home Edition and it came up with; (part of report)

WARN This machine has more than one ethernet or more than one wireless adapter (Redirecting user to support call).

HTTP, HTTPS, FTP Diag: HTTPS:

WARN Error 12169 connecting to www.microsoft.com. The supplied certificate is invalid.
(It did connect)

HTTPS: Error 12169 connectiong to www.passport.net. The supplied cerfificate is invalid.
(Successfully connected to ftp.microsoft.com).

Error: Could not make an HTTPS connection.
*****************************************

Now, it detected "new hardware" for 2 wks that I ignored because I had not installed anything new...???
I unplugged one ethernet cable yesterday to see if it would make a difference; re above ethernet warning.... (It did not)

I looked into SSL certificates online...and it seems people buy them!??? IS that normal? Do they expire? Never heard of this before.

ARE MY BANK ACCTS. AND CREDIT CARDS CURRENTLY AT RISK?
SHOULD I ADVISE BANKS AND FREEZE CARDS AT THIS POINT!
:whistling:

The other day, AVAST detected (2x on same run) Win:32 Nilage-GC[TRj] Malware (Trojan)
I put that in the chest...but, it may have changed it's identity since?! Who knows?

Exhausted, Confused....and Nervous....

I've run the following numerous times: Spybot S&D, AVAST, SpywareBlaster, Spyware Guard, Ad-Aware, AVG Anti spyware last night....(Zone Alarm is on)
Cannot use On-Line Kaspersky....it is expired for me.

Truly appreciate any advice/hints you can offer....
DOES IT SOUND LIKE MY SSL STREAMS HAVE BEEN STOLEN??? :blink:
THX A MIL......Loraine
  • 0

#3
Retired Tech

Retired Tech

    Retired Staff

  • Topic Starter
  • Retired Staff
  • 20,563 posts
I would contact the bank by telephone as a precaution.

Please follow the procedures outlined here: Malware Removal Guide

You will need a PC which can connect to the internet

Run all the programmes as advised then post a current Hijack This Log in a new topic in the Malware Forum

For the purpose of accurate malware analysis, Hijack This Logs are only dealt with in the Malware Forum. Posting them anywhere else will result in a delayed response

If you are unable to run any of the programmes, please ask for advice in the Malware Forum
  • 0

#4
Retired Tech

Retired Tech

    Retired Staff

  • Topic Starter
  • Retired Staff
  • 20,563 posts
Have moved the log here

http://www.geekstogo...e...9.html&st=0

Please do not reply to it until one of the Malware Team posts to it, then reply as required
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP