Raid millions of bank accounts. New easy-to-use tool. Yours for $5,000 Cybercrooks have put on sale a new professional-grade Trojan toolkit called KINS that will pose plenty of problems for banks and their customers in the months and years ahead. KINS promises the ease of use of bank-account-raiding software nasty ZeuS combined with the technical support offered by the team behind Citadel (which …
"easily infect machines running Windows 8 and x64 operating systems, and features technology to embed itself in computers so that it's activated almost as soon as the machines are powered on."
That is worrying, as anything that good/stealthy is best killed by booting the machine off a live CD to scan and nuke it. Of course, with secure boot enabled that could be a problem, though we were led to believe it would stop this sort of root-kit ability to pre-empt AV tools.
Anyone had experience of using the Bitlocker or Kaspersky rescue CDs with a Win8 machine? Did you need to disable secure boot, and was that easy enough to do?
and..
"so that it's activated almost as soon as the machines are powered on..."
so it activates before it receives any power!? thats impressive!!
"KINS is specifically designed not to infect systems in Russia and the Ukraine by avoiding computers with Russian language keyboard settings..."
i'll just add a russian laguage keyboard... disaster averted!!
@Daniel B. - >"I don't quite blame El Reg for not giving details, it might be that the press release doesn't give us the juicy bits yet."
Read the security blog post that's linked in the article. They don't have much more info yet - no one has seen the malware, just a description of it by its creator/seller.
I remember Steve Gibson warning about uPNP (circa 2000) and the massive hole it left in any security measures you might take - I think he used to refer to it as Universal Plug n Pray - I think the FBI were also vehemently against it for a while - until MS "got with the program" I suppose.
That the RDP service is on by default in Windows is ludicrous. How many people who don't know how to enable a service are going to use RDP? And if they don't know enough to enable a service they definitely shouldn't be playing with RDP.
As for domestic routers - most of the manufacturers have only just stopped using a single username and password (usually "admin" and "password") for router management. Given that your router is the first line of defence this is a sorely neglected security tool.
If RDP were the only vector for this to spread or communicate, then it would not be a problem. More likely, it is just one way out of several, so this could be a real problem once it has gotten into a corporate network. Using an alternative to RDP or changing the default port it uses might have more effect.
I'm afraid this is mostly you :)
The banks themselves are, generally, fairly secure, it's the users that cause the problems. If anything you should applaud your bank for implementing more security on the user end instead of just eating the loses and making them up with more fees for everyone.
If there's a definable user problem with your widget you should put together a simple analysis of the issue and let the bank and the manufacturer know. I can tell you from experience that usable customer feedback is priceless. Most users just scream BROKEN SUX U GUYZ BLOW and that's really, really difficult to work with.
My bank just forced me to start using a hand held token generator to access my account, pay bills, make transfers etc.
Yay! Welcome to the club, we've been toting keyfob tokens for e-banking since 2007, by law!!! Depending on the system used by said generator, it'll be secure enough to hamper phishing attempts. Only one bank uses SecurID, but the others use one that does seem to have the generated numbers time-fixed so that the code is only valid for a short time.
I do wonder why banks in other countries haven't done this already?
@AC: My bank just forced me to start using a hand held token generator to access my account
HSBC, who think they are hot sh*t when it comes to security despite their web sites being hacked, only allows a single 'SecureKey' per retail customer account although they allow commercial accounts to have two.
As I have accounts in several countries it means I have an equally impressive array of secure keys - all hanging on the wall next to my work station. Fortunately, someone cracked the secure key and now I can access my bank accounts from my Samsung Note which has a code generating program in it.
BTW, SecureKeys, and similar, have a battery mounted under the bottom L/H of the keyboard. THEY CATCH FIRE, have a picture, so be careful where you keep them.
"KINS is designed to spread using popular exploit packs such as Neutrino. KINS is capable of easily infecting machines running Windows 8 and other x64 operating systems."
What other x64 operating systems does it run on?
What is the attack vector to get onto the system in the first place?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
