ZeusTracker and the Nuclear Option

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Citat:One of the scarier realities about malicious software is that these programs leave ultimate control over victim machines in the hands of the attacker, who could simply decide to order all of the infected machines to self-destruct. Most security experts will tell you that while this so-called "nuclear option" is an available feature in some malware, it is hardly ever used. Disabling infected systems is counterproductive for attackers, who generally focus on hoovering as much personal and financial data as they can from the PCs they control.

But try telling that to Roman Hüssy, a 21-year-old Swiss information technology expert, who last month witnessed a collection of more than 100,000 hacked Microsoft Windows systems tearing themselves apart at the command of their cyber criminal overlords.

...



According to Hüssy, among Zeus's many features is the "kos" option, which stands for "kill operating system." The help file distributed with Zeus kits includes the following Google-translated explanation of this feature:

kos - incapacitate OS, namely grip branches HKEY_CURRENT_USER registry and / or HKEY_LOCAL_MACHINE. If you have sufficient privileges - fly to "blue screen", in other cases creates the brakes. Following these steps, loading OS will not be possible!

[Link mogu videti samo ulogovani korisnici]



Ima neko bez ažurnog Windowsa, antivirusa i firewalla?

• 0Niko još nije pohvalio poruku.
  Registruj se da bi pohvalio/la poruku!

Još jedno interesantno štivo na tu temu, ujedno i analiza "kos" malware-a
Citat:
What could be the possible intention of an attacker to take the victim's computer offline? To disappear and hide all tracks, making further analysis harder? Talking about banking trojans, obviously it is not. As we have seen non of these methods lead to a significant data loss, the trojan binaries are not removed, neither registry startup entries. The point more probably for a phisher is to earn time. Taking the victim away from Internet connection - before the unwanted money transfer is realized and further actions could be taken.


[Link mogu videti samo ulogovani korisnici]