M@il Magazine 24...
ALERT & Warning: New Round of VERY SERIOUS Facebook / bank account hacks
by Sean Gallagher, Uptime (Ars Technica)  
January 11, 2012

The latest variant of Ramnit, the Windows malware responsible for the recent theft of at least 45,000 Facebook logins, is the latest example of how malware writers and cyber-criminals take “off-the-shelf” hacks and bolt them together to teach old viruses new tricks. Facebook passwords aren’t the only thing that the Ramnit virus can grab—thanks to the integration of some of the code from the Zeus botnet trojan, Ramnit can now be customized with modules for all manners of remote-controlled mayhem. 

“Ramnit is an interesting beast,” said Amit Klein, CTO of web security services firm Trusteer in an interview with Ars. “Until last summer, it was just a generic worm spreading around by infecting files. Then they retrofitted it with financial fraud capabilities.” 

The evolved version of Ramnit is a potent threat to enterprises, he said, because it can capture any data in a web session—and as more companies move to web-based software as a service for enterprise applications, that could include almost anything. 

First sighted by researchers in 2010 in its initial form, Ramnit spreads by attaching itself to Windows executable files (.EXE. .SCR and .DLL files) as well as to HTML documents. In some variants spotted earlier this year by Microsoft researchers, it also attached itself to Microsoft Office documents. Versions have also been spotted that install themselves onto USB drives when they’re connected, and create an Autorun script that launches the virus’ installer when the drive is plugged into another PC. 

Ramnit infections exploded in the summer of 2011. According to a report from Symantec, Ramnit accounted for over 17 percent of the malware blocked by the company’s antivirus software in July. Researchers at the security firm Seculert found through the installation of a “sinkhole” that between September and December of 2011, over 800,000 individual Windows PCs were infected with the virus and reporting back to a command and control network. 

However it arrives on a victim’s PC, the virus runs an installer that unpacks Ramnit’s payload on the system, changing Windows’ registry file to automatically launch the malware at startup. Ramnit uses a hidden browser instance to create a communications link, establishing a connection to a hacker’s command and control network. It can then load modules that injectjava_script and HTML into web browser sessions on the infected machine—a capability borrowed from the Zeus botnet, Klein told us. 

“We’ve found traces of the Zeus code” in Ramnit, he said, and those were specifically related to Zeus’ ability to sniff for connections to banking systems and load “webinject” modules to steal account data. That capability also allows hackers to defeat security measures such as two-factor authentication and certificate-signed transactions, giving them the ability to hijack online banking sessions and ride on the backs of users through corporate security to web mail and other systems. 

The Facebook attack is most likely part of an effort by hackers to simply distribute Ramnit more widely, using the accounts to spread links that infect additional computers with the virus or other malware. So it seems unlikely that we’ve heard the last of Ramnit. 

Read this and other articles at M@il Magazine 24