Windows IT Pro is the authoritative and independent resource for windows nt, windows 2000, windows 2003, windows xp. Features a collection of resources and magazines for windows IT professionals.
  
  
  Advanced Search 


March 23, 2006

MetaFisher Still Stealing Sensitive Data

RSS
Subscribe to Windows IT Pro | See More Security Articles Here | Reprints | Or get the Monthly Online Pass—only $5.95 a month!
MetaFisher - a Trojan discovered over a month ago - is still wreaking havoc against unsuspecting users. The Trojan, also knows as Spy-Agent, installs itself when a user visits a malicious Web page by taking advantage of the Windows Metafile vulnerability addressed by Microsoft in their bulletin, MS06-001. Once active the Trojan downloads files that assimilate the affected computer into a botnet.

Ken Dunham of iDefense provided screenshots (seen below) of the attacker's management interface for the botnet. The screenshots reveal that so far over 552,000 systems have become part of the botnet and that the majority are computers located in Brazil and the United States. The interface also allows attackers to query the botnet to find specific bank account information. 

Dunham said that what makes MetaFisher more dangerous than other phishing bots is its ability to use HTML injection techniques to gather sensitive financial information after a person authenticates to a targeted bank acount.

"MetaFisher has been spreading, under the radar, for months, compromising hundreds of thousands if not millions of accounts for financial fraud," said Dunham. "[It's] the most sophisticated bot to date, targeting financials in Spain, the United Kingdom, and Germany."

Screen 1: Bot propagation tracking (click the image for a larger view):



Screen 2: Options screen, used for querying bots for information (click the image for a larger view):

End of Article



Reader Comments

You must log on before posting a comment.

If you don't have a username & password, please register now.




Top Viewed ArticlesView all articles
WinInfo Short Takes: Week of November 24, 2008

An often irreverent look at some of the week's other news, including a Vista Capable dismissal request, Zune price reductions, Morrow musings, Novell and Microsoft sitting in a tree ... two years later, Yahoo!, IE 6 on Windows Mobile, and so much more ...

Command Prompt Tricks

One reader shares his tip for setting up the command prompt to reflect a remote path. ...

Next Version of Exchange Named Exchange 2010?

Microsoft apparently inadvertently announced the official name of the next version of Exchange Server. ...


Security Whitepapers The Impact of Messaging and Web Threats

Why SaaS is the Right Solution for Log Management

Protecting (You and) Your Data with Exchange Server 2007

Related Events Top 10 Email Security Challenges and Solutions

Introduction to Identity Lifecycle Manager "2"

SQL Server Security: How to Secure, Monitor & Audit Your Databases

Check out our list of Free Email Newsletters!

Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys

Related Security Resources Become a VIP member of the Windows IT Pro community!
Get it all with the VIP CD and VIP access. A $500+ value for only $279!

Subscribe to Windows IT Pro!
Solve your toughest technical problems with our experts and access 10,000 + articles online. 30% off

Monthly Online Pass - Only $5.95!
Get instant access to 10,000+ articles from Windows IT Pro Magazine!

TechNet Virtual Labs
Evaluate and test Microsoft's newest products.


Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro Windows Dev Pro IT Job Hound ITTV
IT Library Technology Resource Directory Connected Home Windows Excavator Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 Copyright © 2008 Penton Media, Inc., All rights reserved. Terms and Use | Privacy Statement | Reprints and Licensing