Trusteer warns of W32.Silon Trojan.

INTERNET BUSINESS NEWS-(C)1995-2009 M2 COMMUNICATIONS

Trusteer issued on Wednesday a security advisory on a new Trojan called W32.Silon that bypasses security tokens, banking card readers and uses a two pronged approach to steal login information.

The provider of customer protection for online businesses said its Rapport browser security service has blocked repeated attempts by the W32.Silon Trojan to compromise consumer Internet banking accounts.

W32.Silon is a new malware variant that intercepts Internet Explorer web browser sessions and has been associated with fraud incidents at several banks. Trusteer retrieved and analysed a sample of this Trojan, which is designed to steal generic login information and commit bank-specific fraud.

To steal user credentials, the Trojan performs its initial attack when a user initiates a web login session and enters their username and password. The malware intercepts the login POST request, encrypts the requested data and sends it to a command & control (C&C) server.

When it targets users of online banking applications that are protected by transaction authentication devices such as tokens or banking card readers, W32.Silon waits until the user has logged on and then injects dynamic html code into the login flow between the user and the bank's web server.

The malware presents authentic looking web pages that appear to be from the bank and asks the user to employ their transaction authentication device. Then the user is asked to enter information from the device into the webpage and this information is used by the criminals to execute fraudulent transactions on behalf of the user.

Findings gathered from a sample of the new malware are available in a report, available at http://www.trusteer.com/webform/w32silon-malware-analysis, that explains its functionality, as well as how to detect and remove W32.Silon.

((Comments on this story may be sent to [e-mail]))