Massive Botnet Stealing Financial Info

July 30, 2009 – 6:00 PM

A ferocious piece of malware that’s infected up to a million PCs is stealing a “tremendous” amount of financial information from consumers and businesses that log on to their bank, stock broker, credit card, insurance, job hunting and favorite e-shopping sites, a noted botnet researcher said today.

“Clampi is the most professional thieving pieces of malware I’ve ever seen,” said Joe Stewart, director of malware research for SecureWorks’ counter-threat unit. “We know of few others that are this sophisticated and wide-ranging. It’s having a real impact on users.”

The Clampi Trojan horse has infected anywhere between 100,000 and 1 million Windows PCs, said Stewart — “We don’t have a good way of counting at this point,” he acknowledged — and targets the user credentials of 4,500 Web sites.

That’s an astounding number, said Stewart, who has identified 1,400 of the 4,500 total. “There are plenty of other banking Trojans out there, but they usually target just 20 or 30 sites.”

Hackers sneak Clampi onto PCs by duping a user into opening an e-mailed file attachment or by using a multi-exploit toolkit that tries attack code for several different Windows vulnerabilities, Stewart said. Once on a machine, the Trojan monitors Web sessions, and if the PC owner browses to one of the 4,500 sites, it captures usernames, passwords, PINs and other personal information used to log on to those sites, or to fill out forms.

Source:
http://www.pcworld.com/article/169333/botnet_spreading.html?tk=rss_news