New computer virus Gauss hits banks in Middle East
Similar to FlameBy Marc Chacksfield August 10th0 COMMENTS
http://www.techradar.com/us/news/internet/new-computer-virus-gauss-hits-banks-in-middle-east-1091769
A new highly destructive computer virus has been found which has the rather nasty habit of stealing bank account data. Apparently state-sponsored (although it's anyone's guess which state is responsible at this point), the Guass virus is targeting Middle East banks, slurping out bank account passwords and key-logging data.
Kaspersky has highlighted the dangers of the virus on its website, noting: "After looking at Stuxnet, Duqu and Flame, we can say with a high degree of certainty that Gauss comes from the same 'factory' or 'factories'. "All these attack toolkits represent the high end of nation-state-sponsored cyber-espionage and cyberwar operations."
Going viral
The arrival of Gauss will be a worry for many – State-sponsored viruses, like Flame, are usually used for government intelligence but given Gauss seems to be stealing passwords there is now the added problem of data theft.
The arrival of Gauss will be a worry for many – State-sponsored viruses, like Flame, are usually used for government intelligence but given Gauss seems to be stealing passwords there is now the added problem of data theft.
Speaking about the arrival of the virus, James Todd, technical lead for Europe at FireEye, said: "While the discovery of the Flame virus may have shocked security experts worldwide, it seems that this was just the tip of the iceberg."With suggestions that Gauss could in fact be linked to the laboratories that created Flame, Stuxnet and Duqu, it appears that the state-sponsored cyber threat might be more dynamic, fast-moving and incestuous than previously thought.
"Many consider credential stealing malware a social problem and pretty harmless compared to targeted attacks. Gauss destroys that myth.
"Though it seems that this virus is currently intended for the theft of bank details, social networking information and other web passwords, we cannot underestimate the seriousness of this discovery and its potential to morph into a virus capable of attacking control systems and other critical infrastructure, as has been suggested."
Gauss virus: Stuxnet-like cyberweapon hits Middle East banks
Virus comes from the same 'factory' as Stuxnet and can wait to unleash attack till it reaches the right target, Kaspersky reportsReuters in Boston
The Guardian, Thursday 9 August 2012
http://www.guardian.co.uk/technology/2012/aug/09/stuxnet-gauss-virus-kaspersky
A new cyber surveillance virus has been found in the Middle East that can spy on banking transactions and steal login and passwords, according Kaspersky Lab, a leading computer security firm.
Dubbed Gauss, the virus may also be capable of attacking critical infrastructure and was very likely built in the same laboratories as Stuxnet, the computer worm widely believed to have been used by the US and Israel to attack Iran's nuclear programme, Kaspersky Lab said on Thursday.
The Moscow-based firm said it found Gauss had infected more than 2,500 personal computers, the bulk of them in Lebanon, Israel and the Palestinian territories. Targets included Lebanon's BlomBank, ByblosBank and Credit Libanais, as well as Citibank and eBay's PayPal online payment system.
Officials with the Lebanese banks said they were unaware of the virus. PayPal spokesman Anuj Nayar said the company was investigating the matter but was not aware of any increase in "rogue activity" as a result of Gauss. A Citibank spokeswoman declined to comment.
Kaspersky Lab would not speculate on who was behind Gauss, but said the virus was connected to Stuxnet and two other related cyber espionage tools, Flame and Duqu. The US department of defense declined to comment.
"After looking at Stuxnet, Duqu and Flame, we can say with a high degree of certainty that Gauss comes from the same 'factory' or 'factories,'" Kaspersky on its website. "All these attack toolkits represent the high end of nation-state-sponsored cyber-espionage and cyberwar operations."
Jeffrey Carr, an expert on cyber-warfare who runs security firm Taia Global, said the US government has long monitored Lebanese banks for clues about the activities of militant groups and drug cartels. He said Gauss was likely built by adapting technology deployed in Flame.
"You've got this successful platform. Why not apply it to this investigation into Lebanese banks and whether or not they are involved in money laundering for Hezbollah?" he said.
New York's state banking regulator this week accused Britain's Standard Chartered Plc of violating US anti-money laundering laws by scheming with Iran to hide more than $250bn of transactions.
Experts said that surveillance viruses like Gauss are perfect tools for government intelligence units to gather information for such investigations, though they did not specifically link Gauss to the Standard Chartered case.
According to Kaspersky Lab, Gauss can also steal passwords and other data, and send information about system configurations.
Modules in the virus have internal names that researchers believe were chosen to pay homage to famous mathematicians and philosophers, including Johann Carl Friedrich Gauss, Kurt Godel and Joseph-Louis Lagrange.
Kaspersky Lab said it called the virus Gauss because that is the name of the most important module, which implements its data-stealing capabilities.
One of the firm's top researchers said Gauss also contains a module known as "Godel" that may include a Stuxnet-like weapon for attacking industrial control systems. Stuxnet, discovered in 2010, was used to attack computers that controlled the centrifuges at a uranium enrichment facility in Natanz, Iran.
Roel Schouwenberg, a senior researcher with Kaspersky, said the Godel code may include a similar "warhead."
Godel copies a compressed, encrypted program onto USB drives. That program will only decompress and activate when it comes in contact with a targeted system.
While Kaspersky has yet to fully crack Godel's code, Schouwenberg said he suspects it is a cyber weapon designed to cause physical damage and that its developers went to a lot of trouble to hide its purpose, using an encryption scheme that could take months or even years to unravel.
Meanwhile, a UN agency that advises countries on protecting infrastructure plans to send an alert on the mysterious code.
A new cyber surveillance virus has been found in the Middle East that can spy on banking transactions and steal login and passwords, according Kaspersky Lab, a leading computer security firm.
Dubbed Gauss, the virus may also be capable of attacking critical infrastructure and was very likely built in the same laboratories as Stuxnet, the computer worm widely believed to have been used by the US and Israel to attack Iran's nuclear programme, Kaspersky Lab said on Thursday.
The Moscow-based firm said it found Gauss had infected more than 2,500 personal computers, the bulk of them in Lebanon, Israel and the Palestinian territories. Targets included Lebanon's BlomBank, ByblosBank and Credit Libanais, as well as Citibank and eBay's PayPal online payment system.
Officials with the Lebanese banks said they were unaware of the virus. PayPal spokesman Anuj Nayar said the company was investigating the matter but was not aware of any increase in "rogue activity" as a result of Gauss. A Citibank spokeswoman declined to comment.
Kaspersky Lab would not speculate on who was behind Gauss, but said the virus was connected to Stuxnet and two other related cyber espionage tools, Flame and Duqu. The US department of defense declined to comment.
"After looking at Stuxnet, Duqu and Flame, we can say with a high degree of certainty that Gauss comes from the same 'factory' or 'factories,'" Kaspersky on its website. "All these attack toolkits represent the high end of nation-state-sponsored cyber-espionage and cyberwar operations."
Jeffrey Carr, an expert on cyber-warfare who runs security firm Taia Global, said the US government has long monitored Lebanese banks for clues about the activities of militant groups and drug cartels. He said Gauss was likely built by adapting technology deployed in Flame.
"You've got this successful platform. Why not apply it to this investigation into Lebanese banks and whether or not they are involved in money laundering for Hezbollah?" he said.
New York's state banking regulator this week accused Britain's Standard Chartered Plc of violating US anti-money laundering laws by scheming with Iran to hide more than $250bn of transactions.
Experts said that surveillance viruses like Gauss are perfect tools for government intelligence units to gather information for such investigations, though they did not specifically link Gauss to the Standard Chartered case.
According to Kaspersky Lab, Gauss can also steal passwords and other data, and send information about system configurations.
Modules in the virus have internal names that researchers believe were chosen to pay homage to famous mathematicians and philosophers, including Johann Carl Friedrich Gauss, Kurt Godel and Joseph-Louis Lagrange.
Kaspersky Lab said it called the virus Gauss because that is the name of the most important module, which implements its data-stealing capabilities.
One of the firm's top researchers said Gauss also contains a module known as "Godel" that may include a Stuxnet-like weapon for attacking industrial control systems. Stuxnet, discovered in 2010, was used to attack computers that controlled the centrifuges at a uranium enrichment facility in Natanz, Iran.
Roel Schouwenberg, a senior researcher with Kaspersky, said the Godel code may include a similar "warhead."
Godel copies a compressed, encrypted program onto USB drives. That program will only decompress and activate when it comes in contact with a targeted system.
While Kaspersky has yet to fully crack Godel's code, Schouwenberg said he suspects it is a cyber weapon designed to cause physical damage and that its developers went to a lot of trouble to hide its purpose, using an encryption scheme that could take months or even years to unravel.
Meanwhile, a UN agency that advises countries on protecting infrastructure plans to send an alert on the mysterious code.
No comments:
Post a Comment
Please feel free to comment or make suggestions