Free Newsletter
Register for our Free Newsletters
Access Control
Deutsche Zone (German Zone)
Education, Training and Professional Services
Government Programmes
Guarding, Equipment and Enforcement
Industrial Computing Security
IT Security
Physical Security
View All
Other Carouselweb publications
Carousel Web
Defense File
New Materials
Pro Health Zone
Pro Manufacturing Zone
Pro Security Zone
Web Lec
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor
ProSecurityZone Sponsor

Zeus Targeting Enterprise Access Gateways

Trusteer : 17 November, 2010  (Technical Article)
Amit Klein, Trusteer's CTO explains how Zeus is stealing logon credentials to enterprise access gateways.
We're all familiar with Zeus, the king of financial malware. It is infamous for targeting banks, credit unions and financial institutions. Zeus silently steals password and account information from customers of these institutions, and uses their credentials to execute fraudulent money transfers.

A less well known fact is that Zeus now also targets and attacks companies.

Once Zeus is installed on a victim's machine, it fetches a configuration file from one of its command and control servers. The configuration file instructs Zeus which websites and applications to target, which information to steal, and how to steal it. This information is encrypted and is usually hard to capture. As part of our ongoing research we capture and decrypt Zeus configurations to study them. Some of the Zeus 2.0 configurations we recently decrypted include the following code:

In English, this string tells Zeus the following:

The '@' means 'capture a screenshot of the text within the mouse's vicinity when the left button is clicked'
The */citrix/* further specifies that this screenshot should be captured when the text '/citrix/' appears in the browser address bar.
This code instructs Zeus to take a screen shot every time the left button is clicked while the browser's URL includes the term '/citrix/'.

What Zeus is doing here is trying to capture login credentials from users of the Citrix Access Gateway, a popular SSL VPN solution used by businesses to provide secure remote access to applications and data inside their protected network. Criminals always seek the path of least resistance. In the case of enterprise networks the least secure path is through mobile and remote employee computers, which are outside the control of most internal IT departments.

Citrix is well aware and concerned about the threat of keyloggers and their ability to capture a user's login information for the Citrix Access Gateway. In order to protect against this type of attack, Citrix developed a virtual keyboard solution. According to the Citrix website: 'Keyloggers are becoming an increasing threat on the internet, and pose a risk to security of corporate networks. They are applications that run silently on a PC or internet kiosk and record the keystrokes entered by a user for later review. They pose a risk because they can capture usernames and passwords entered, which can then be reviewed and used in obtaining unauthorized access to the corporate network."

The Citrix Access Gateway allows companies to customize the logon page to include a virtual on-screen keyboard which replaces the physical keyboard. So instead of typing a password on the physical keyboard, mouse clicks are used to press the keys drawn on screen. This approach prevents keyloggers from capturing keystrokes, since there are none to capture.

The Zeus configuration snippet shown above is specifically designed to defeat the virtual keyboard capability in the Citrix Access Gateway. By capturing screenshots within the vicinity of the pointer during mouse clicks, Zeus is able to read the user's password which will clearly show up as the sequence of keys the mouse pointer was pointing at when the mouse was clicked.

This attack code clearly illustrates that Zeus is actively targeting enterprises and specifically remote access connections into secure networks. Fraudsters are no longer satisfied with simply going after bank accounts. They are also targeting intellectual property and sensitive information contained in company IT networks and applications. Users of remote access VPN systems like the Citrix Access Gateway (employees, contractors, and partners) are purposely being targeted because their computers are unmanaged and can easily be compromised with sophisticated malware like Zeus. As a result, corporate

IT departments should be aware of this threat and take steps to protect their unmanaged computers and remote sessions. These include limiting VPN access to specific applications and users, maintaining up to date malware protection on remote devices, using a secure browsing service to protect VPN connections, and educating users on computer hygiene and secure browsing best practices.
Bookmark and Share
Home I Editor's Blog I News by Zone I News by Date I News by Category I Special Reports I Directory I Events I Advertise I Submit Your News I About Us I Guides
   © 2012
Netgains Logo