An attack that targeted online customers of at least 50 financial institutions in the Europe, the US and Asia-Pacific has been shut down, a security expert said today.
The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike website for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense.
To be infected, a user had to be lured to a website that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft's software, Websense said.
The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a website rigged with the malicious code.
Once lured to the website, an unpatched computer would download a Trojan horse in a file called "iexplorer.exe”, which then downloads five additional files from a server in Russia. The websites displayed only an error message and recommended that the user shut off their firewall and antivirus software.
If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's website that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible.
The technique is known as a pharming attack. Like phishing attacks, pharming involves the creation of look-alike websites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser.
"It takes a lot of work but is quite clever," Gonzalez said. "The job is well done."
The websites hosting the malicious code, which were located in Germany, Estonia and the UK, had been shut down by ISPs as of Thursday morning, along with the look-alike websites, Gonzalez said.
It was unclear how many people may have fallen victim to the attack, which went on for at least three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said.
The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots of the bot controller.