Information Security Blog

What the ZeuS!?! Information security update

0 Flares

ZeuS_bot

ZeuS (aka Zbot, PRG, Wsnpoem and Gorhax) is a Trojan kit designed to generate a binary that installs a suite of data theft tools on a victim’s system. ZeuS is most often spread via drive-by downloads or phishing attacks. Once infected with ZeuS, the victim system:

• Performs keystroke logging for HTTPS, HTTP, FTP, and POP3 traffic.
• Takes screen shots at relevant times to capture supplemental login data.
• Modifies web page content on-the-fly to hide its illicit activity.
• Transmits collected data via Jabber IM to the attacker’s servers, providing real-time credential data, circumventing one-time password access controls.
• Generates SPAM.
• Monitors a pool of Command and Control (C&C) servers on the Internet for new instructions, including software updates.

If you’re concerned about ZeuS, I recommend the following:

1) Browse smart. Check what you’re clicking on, make sure any links or attachments you’re provided are from trusted sources, and when they arrive without warning, check with the sender that they are kosher. Keep your browser, e-mail, and anti-virus patched and up-to-date.

2) Check for signs of infection. ZeuS is normally detected post infection either by communication with its C&C servers or by anti-spyware software.

• In a home or small business environment – Examine the host for signs of compromise by running anti-spyware software. I recommend scanning with both Malwarebytes Anti-Malware (http://www.malwarebytes.org/mbam.ph) and SUPERAntiSpyware (http://www.superantispyware.com/superantispyware.html?rid=3596). If both scan as clean, odds are that you’re clean. If you’re still concerned, you can also run GMER (http://www.gmer.net/), a rootkit detection tool, and HijackThis (http://free.antivirus.com/hijackthis/), a windows configuration and integrity checker.

• In a corporate environment – Since checking every host may not be feasible, examine any available network logs for any unexplained network connectivity. If suspect traffic is discovered, you can compare the suspect IP against the list of known infections at https://zeustracker.abuse.ch/monitor.php. If that’s inconclusive, you can scan the suspect host with the above anti-spyware software.

3) Eliminate the infection. Perform the remediation recommended by Malwarebytes Anti-Malware and SUPERAntiSpyware, followed up by a full-system AV scan. Once all infections have been addressed, repeat the antimalware and AV scans until clean.

21
JUN

Best Practices for Firing A Network Security Administrator

Want to know how to fire a Network Admin? Need to know what precautions to take? Firing any employee can be a stressful event. Firing one who has significant knowledge of and privileged access to your Information Technology/Security infrastructure is even more stressful, as the risks are so notable.

Is ISO 27001 Right for (Y)our Organization?

Thinking about ISO 27001 Certification? View our free On-Demand ISO 27001 Webinar

How to deal with increasing threats
How to manage multiple regulatory requirements
How to handle client requests for attestation
To validate that significant changes did not have unanticipated results

Free Whitepaper: Five Best Practices for SIEM

The promise of SIEM is the consolidation of all relevant Security Event Logs from disparate sources into a single unified and normalized data store.

Simplify compliance monitoring/reporting
Vastly improve Incident Detection & Incident Response
Contextualize event information with other business relevant information

Free Download: ISO 27001 Implementation Roadmap

Have no fear – our “roadmap” will guide you, step by step, through the entire ISO 27001 process.

Getting to ISO 27001 certification is a process made up of things you already know – and things you may already be doing!

Free Whitepaper: Stop Wasting Money on Penetration Testing

Penetration Testing is most frequently performed to:

Substantiate the net effectiveness of a mature control environment
Prove to a third party that an environment is secure/trustworthy
Quickly assess the security of a less mature control environment (in a sense a technical risk assessment)
To validate that significant changes did not have unanticipated results

Free Download: A Best Practices Guide to Database Security

Because data is only as secure as the systems & processes it relies on – a holistic approach to data security is essential. This roadmap is not meant to be exhaustive but rather to stimulate the necessary thought process to put you on the path to good data security.