Anatomy of a Trojan

[Alrik Fassbauer]

Hello, everyone.

This is an extremely interesting, yet frightening read :
http://www.secureworks.com/research/threats/gozi/?threat=gozi

Frightening, because it shows how much work is put into the assemblage of Trojans nowadays.

I think you should know this, so that's why I've posted it here.

And I can only advise you to read it. Sorry, that I repeat myself, but to me this is very important, and I've learned a lot.

Alrik

[magerette]

A lot of this was above my head, but even without full comprehension, that's a chilling report.

[Corwin]

Interesting read. Made me do a quick scan of my rig; it was clean!! :)

[dteowner]

What's so technical about latex? ;)

[magerette]

dte, you devious type, it took me hours to get that.

(Usually with **that** type of Trojan, the scary part is **not** having one.:uhoh: )

[Corwin]

I still don't 'get it'!! Must be an americanism!! :)

[Danicek]

Pretty nice, entertaining and deep article. I've never seen anything going into such details (no doubt there are such articles out there but I've never tried to find one).

[Alrik Fassbauer]

I just heard today that hackers have begun opening WLAN hot spots with similar names than those of commercial companies - and are opening them for everyone who needs a hot spot. THEN they ask for money ...

Yuck.

[dteowner]

I still don't 'get it'!! Must be an americanism!! :)AFAIK, it's a world-wide brand. Gotta get down in the gutter with me, Corwin. Apologies to Alrik for soiling a serious thread.

[Danicek]

To get it back on topic...

When reading this, one has to conclude that there is no real way to avoid this. You don't have to go to xxx sites, you don't have to be dumb to click on strange message boxes. You simply visit normally looking site and the rest is done for you.

I would say that bit advanced users are protected not thanks to their knowledge but thanks to the fact that they are usually using different browser (note: I'm not saying that IE is the worst but it is the most used so holes in it are looked for and used). Afterall even an advanced user has no chance to identify that a process hidden by rootkit and not identified by antivirus software is there.

Other than that, good firewall may be very important in this scenario. If the information collected has to be used by someone, they must be sent outside.

[Khass]

Hehe. I somehow managed to avoid viruses and trojans and the like almost altogether over these past 3-4 years, and I can say I've visited many dubious sites and downloaded many weird things. Yet the world around still twists and turns whenever things like this appears on the internets; I just look at it and snicker inside myself. Like a wise network administrator once told me, "many dvd's, many backups, many systems saved from fists 'n kicks".

[Alrik Fassbauer]

I was free of viruses ofer the last months, I think even since two years. Good luck ! :) ;)

One attempt of hackers is to just hack "casual" sites, with which no-one would expect a trojan or real virus to stay inside. And so, the people lower their shields and thus allow the virus/trojan to come in ... Even official sites of companies were affected in the past. And here in Germany even a government's site (was I think one or two years ago now).

[Wulf]

The opening post was a very interesting read....thanks Alrik. It shows how far hackers are prepared to go in todays fraudulent societies.

Malware can be almost as troublesome, even worse in some cases.
i found one in my email titled...."notavirus" (a hard to remove re-spawner)

[Corwin]

I think malware has now superceded viruses as the bane of computing!!

[magerette]

Somewhat on topic, any WoW players hope you have heard of this one (http://news.bbc.co.uk/2/hi/technology/6526851.stm)

Interesting to hear that you can blackmarket sell a WoW account for more than a credit card!

[Danicek]

I think malware has now superceded viruses as the bane of computing!!

Yeah, in most cases it is far better to have your harddrive formatted than to have your credit card data stolen.