Protect your corporate IT network from hackers and other unwanted intruders with Proxy Sentinel™. Click here for all the details and get the peace of mind you deserve.
Back to our Homepage Proxy Sentinel™ high performance Internet proxy server and secure firewall solution Firewall Sentinel™ secure & powerful Internet firewall solution About Internet Security.ca and GCIS Frequently Asked Questions on Internet security issues Internet Security Industry News - Stay informed of what's happening Contact Internet Security.ca today and order your Proxy Sentinel™ or Firewall Sentinel™ server now!

Hackers unleash new Citadel Trojan that targets password managers

If you need reliability when it comes to SMTP servers, get the best, get Port 587.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!

Share on Twitter.

November 21, 2014

Click here to order the best deal on a HP enterprise dedicated server and at a great price.

Cybercriminals have unleashed a new variant of the Citadel Trojan virus that targets password managers.

The malware is designed to steal a victim's master passphrase, thus unlocking his or her database of website passwords in the process.

The software runs a nasty key logger to intercept what people type into the Password Safe and KeePass password management software on infected Windows computers.

The Nexus Personal Security Client (an authentication product used by big companies as well as online service providers) is also targeted.

The Citadel malware works by injecting itself into explorer.exe processes and hooking into APIs. It also downloads a configuration file from a central command server.

"The configuration file then instructs the malware to start key-logging (capturing user keystrokes) when some processes are running," said Dana Tamir, director of enterprise security at IBM Trusteer.

For now, it's still not clear how widespread the malware infection is, nor who is masterminding it. The crooks involved scrubbed their central command-and-control (C&C) server some time shortly before Trusteer latched onto the contagion.

"Once Citadel installs itself on a machine, it then opens communication channels with a command-and-control server and registers with it. The malware then receives a configuration file that tells it how it should operate," explained Tamir.

"An analysis of the configuration file used by this variant of Citadel shows that the attackers were using a legitimate web server as the C&C. But by the time the IBM Trusteer research lab received the configuration file, the C&C files were already removed from the server, so researchers were not able to identify who is behind this configuration."

IBM Trusteer has passed on its research to the makers of the targeted software. We'll keep you posted on these and other developments.

Source: IBM.

Get a powerful Linux Dual-Core dedicated server for less than $2.67 a day!


Home | Proxy Sentinel™ | Firewall Sentinel™ | FAQ | News | Sitemap | Contact
Copyright © Internet Security.ca    Terms of use    Privacy agreement    Legal disclaimer