The “Gameover” malware that the FBI warned users about earlier this month is a preview of the next version of the even-more-notorious Zeus money-stealing Trojan, a security researcher said today.
“Gameover represents the latest and greatest source code package from the Zeus author,” said Don Jackson, director of Dell SecureWorks’ counter-threat unit. “[New features] in Gameover will be rolled into the final Zeus version 3, which is in beta and will wrap up soon if it hasn’t already.”
Two weeks ago, the FBI warned of increased action by Gameover, including rounds of spam that tried to dupe recipients into infecting their PCs with the malware, which like Zeus, is designed to pillage individuals’ and companies’ bank accounts.
Jackson, who has been tracking the Zeus malware and its developer for years, said that Gameover posed a new and more dangerous threat because it had been created by the maker of Zeus specifically at the behest of one of his biggest clients.
“The crew using Gameover has requested a lot of changes in the Zeus functionality,” said Jackson, adding that the hacker crew using Gameover has direct access to Zeus’ maker because it pays him well and often for support.
“The Zeus author now has only three or four major clients,” said Jackson. The criminal coder abandoned all his “small fish” to focus on supporting a handful of customers who pay top dollar for his work.
Almost a year ago, Zeus’s creator halted development after the software’s source code leaked to the Internet. Subsequently, other security researchers noticed that many of Zeus’ features were rolled into another crimeware construction kit called SpyEye. Last August, experts at Moscow-based Kaspersky Lab highlighted a botnet dubbed “Ice IX” that was reportedly built atop the older Zeus source code.
Jackson believes that the maker of Zeus decided to turn those events to his advantage.
“He dumped all his small fishes,” said Jackson, “which not only takes the heat off him, but also removes him from resellers. It lets him concentrate and focus on what would be next for Zeus.”
The additions demanded by the Gameover gang, which the Zeus developer quickly created, included a new, more distributed form of command-and-control (CC) that uses a peer-to-peer function to update infected machines when or if a botnet’s single CC server is discovered by authorities and taken offline.
Gameover, which Jackson said should be considered a “private version” of Zeus, also supports the use of complex Web injections that allow criminals to bypass multi-factor authentication now used by many financial institutions to stymie account plundering.
And the crew apparently asked for changes to Zeus that would let the gang rent third-party botnets that specialize in conducting distributed denial-of-service (DDoS) attacks, Jackson added.
According to both Jackson and the FBI, the Gameover gang has launched DDoS attacks against banks and other financial institutions immediately after emptying accounts of funds. Those DDoS attacks are likely meant as diversions that give the criminals a longer head start before their money-stealing efforts are uncovered.
“All these changes were negotiated with the Zeus author,” said Jackson. “DDoS attacks attract a lot of attention, so it makes sense that [the Gameover crew] wants to distance themselves somewhat from them.”
If, as Jackson suspects, Gameover is a preview of the next Zeus, it may mean more aggressive attacks by the other groups that pay the Zeus author to maintain the newest version and support their fix and change requests.
The small number of top criminal gangs using Zeus — Jackson believes there are four at the most — account for the vast majority of the malware’s financial impact. “These crews are very professional, very well-run, and they’re experienced in the criminal underground,” said Jackson. “They know how to interact with the author of Zeus, and are constantly reinvesting in the tools they use.”
Most experts, including Jackson, think that these gangs operate out of Eastern Europe, primarily Russia and Ukraine.
Jackson also confirmed the FBI’s assertion that the Gameover crew has sometimes fed stolen funds directly to high-end jewelry stores, where associates have set up accounts to purchase easily-transported, high-value merchandise such as precious stones and expensive watches.
“That really speeds up the typical mule operation with a lot less risk,” said Jackson, referring to the term used for people hired by cybercriminals to launder money by turning it into physical goods that can be resold.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg’s RSS feed . His e-mail address is gkeizer@computerworld.com .
See more articles by Gregg Keizer .
Read more about cybercrime and hacking in Computerworld’s Cybercrime and Hacking Topic Center.
Article source: http://www.pcworld.com/article/248614/researcher_traces_gameover_malware_to_maker_of_zeus.html
View full post on National Cyber Security » Virus/Malware/Worms