Silentbanker virus

cybergal · 01-18-2008, 12:57 PM

Is Linux less likely to be affected by this virus? Is there a way of checking our systems to tell if we have been compromised? As it seems that the banks can't protect us, are there any specific steps we can take other than not banking online?

I'm running Ubuntu 6.06 LTS on a Toshiba Satellite laptop, with a dial-up connection.

TIA

dive · 01-18-2008, 01:18 PM

Not been able to get much specific info on this trojan, but it does look like it attacks user's PCs rather than the bank's websites. This usually indicates a windows-oriented attack. Could also target browser vulnerabilities too but I can't find any info to state this or that, say, running a linux version of a browser would be targeted at all. Best to keep an eye out for it and hope that symantec or someone puts out more specific details of it.

Quote:

Since the Trojan is downloaded to individual computers, usually during routine Web-surfing, consumers have to look to their own computer security, not their bank's, for protection.

Quote:

Computer users who don't have up-to-date anti-virus security software installed, or who haven't updated their web browser to fix flaws that are allowing the Trojan to proliferate, are particularly open to attack.

"[Silentbanker] sits on the website, and unbeknownst to you it downloads to your system," said Huger, who added the hackers behind Silentbanker are probably also trying to send the virus out via e-mail.

internetSurfer · 01-18-2008, 09:05 PM

Trojan.Silentbanker

Something of concern:

Italian Bank's XSS Opportunity Seized by Fraudsters

To mitigate against this attack use
the NoScript plugin for Firefox.

To configure NoScript go to:

Tools > Add-ons > NoScript > Options > Plugins

Additional restrictions for untrusted sites

Check > Forbid <IFRAME>
Check > Apply these restrictions to trusted sites too

-

rsmits · 01-22-2008, 01:24 PM

Quote:

Originally Posted by cybergal

Is Linux less likely to be affected by this virus? Is there a way of checking our systems to tell if we have been compromised? As it seems that the banks can't protect us, are there any specific steps we can take other than not banking online?

I'm running Ubuntu 6.06 LTS on a Toshiba Satellite laptop, with a dial-up connection.

TIA

This appears to be a Windows only virus. The informaton below comes from Symantec

Discovered: December 17, 2007
Updated: January 8, 2008 12:54:17 PM
Also Known As: Spy-Agent.cm [McAfee]
Type: Trojan
Infection Length: 54,189 bytes and 98,304 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

Trojan.Silentbanker is a Trojan horse that records keystrokes, captures screen images, and steals confidential financial information to send to the remote attacker.

Bob

cybergal · 01-22-2008, 02:37 PM

Thanks to everyone for the replies. I installed NoScript yesterday. My bank had advice on their Website for Windows users only. Although I didn't expect them to mention Linux, they would probably have mentioned Mac if they were known to have been affected. So far so good...I hope!

cam34 · 01-24-2008, 03:22 PM

Quote:

Originally Posted by rsmits

Trojan.Silentbanker is a Trojan horse that records keystrokes, captures screen images, and steals confidential financial information to send to the remote attacker.

This Virus also changes DNS Records on affected computer generating Man-in-the-Middle attacks DEFEATING One Time Passwords generated by security tokens used by bacnks etc!!! It also modifies webpages on the fly adding forms to request additional information if needed.

This virus is a well produced and professionally developed changing its routines almost daily, with encryption added to help avoid detection. Very serious bad boy!!

unSpawn · 01-24-2008, 06:23 PM

Quote:

Originally Posted by cam34

serious bad boy!!

Listen, it's *microsoft only*, so no (this being the Linux Security forum).

cybergal · 01-24-2008, 11:32 PM

http://www.linuxquestions.org/questi.../?daysprune=-1
Could there be a connection here? Linux servers infected to transfer virus/trojans to Windows OS and apps? Not good for OpenSource.

SlowCoder · 01-30-2008, 02:44 PM

Quote:

Originally Posted by cybergal

http://www.linuxquestions.org/questi.../?daysprune=-1
Could there be a connection here? Linux servers infected to transfer virus/trojans to Windows OS and apps? Not good for OpenSource.

Are you talking about this thread: http://www.linuxquestions.org/questi...-sites-616089/ ?

That issue has not been determined to be a Linux vulnerability. Their best guess is that the attackers obtained a list of root passwords. Once compromised, the Linux servers are used to attack random Windows clients which DO have vulnerabilities. Not good for ClosedSource.