Warning: New IE spyware steals online banking passwords

[Mark R]

Link

The second half of the file consists of a Win32 DLL that is installed by the file dropper under WindowsXP as a randomly named .dll file under C:\WINDOWS\System32\. This DLL is installed as a "Browser Helper Object" (BHO) under Internet Explorer.

A "Browser Helper Object" is a DLL that allows developers to customize and control Internet Explorer. When IE 4.x and higher starts, it reads the registry to locate installed BHO's and then loads them into the memory space for IE. Created BHO's then have access to all the events and properties of that browsing session. This particular BHO watches for HTTPS (secure) access to URLs of several dozen banking and financial sites in multiple countries.

Make sure your AV is up-to-date (although I can't see anything matching this description on symantec's site).

Consider using a different browser which is not affected by this exploit.

 

[n0cmonkey]

SSDH

 

[Schadenfroh]

nice

 

[Schadenfroh]

Originally posted by: Mark R
Link
Consider using a different browser which is not affected by this exploit.

or dont click "yes" when something wants to install

 

[ArmchairAthlete]

:: Prepares for flood of Firefox fanboys screaming that you need Firefox and patting eachother on the back for using it ::

 

[n7]

Originally posted by: ArmchairAthlete
:: Prepares for flood of Firefox fanboys screaming that you need Firefox and patting eachother on the back for using it ::

You know it :thumbsup:

 

[n0cmonkey]

Originally posted by: ArmchairAthlete
:: Prepares for flood of Firefox fanboys screaming that you need Firefox and patting eachother on the back for using it ::

No, you don't need it. But in the interests of simplicity, it makes things easier. Or mozilla, which I think is just years ahead of firefox.

 

[drag]

Originally posted by: Schadenfroh

Originally posted by: Mark R
Link
Consider using a different browser which is not affected by this exploit.

or dont click "yes" when something wants to install

I don't think it gave you the option to answer "do you want to install this trojen spyware on your computer y/n?".

It was via a timed pop-under that originated from a cracked http server.

The HTML here attempts to exploit a known flaw in Internet Explorer to load and execute a .chrn file. (continues)

see here

Then after it loads that file on the computer it tries to download and execute a img1big.gif, which is realy a self-executable compressed archive containing 2 parts, one file that is automaticly ran to install the second file, which is the .DLL file that allows the attacker to take over the browser.

The thing is suppose to store interactions with various https banking websites for something like 60 different banks or something like that.

So if your using IE and happen to have gotten that pop-under from anywere, then you had no real choice it would probably get installed. Don't know if there is a patch to fix this .chrn flaw thing.

Although it did get thwarted because the user that was using IE was using a restricted account (didn't go into it the details on this point) so didn't have any rights to install anything. So you can still say that as long as you use a user account you'll be safe from this particular IE-based attack.

 

[imported_chrisbtx]

Yet another reason NOT to use IE.

Dump it and go for something much better like Mozilla, Firefox, Opera, etc. as stated above.

 

[n0cmonkey]

IE is just like a porno. Always the same stuff, just a different hole.

 

[AFB]

lol

 

[Abhoth]

lol too and I use Mozilla... Although, many financial institutions cater to IE. I've had some refuse access because my browser was out of date! hahhahhahaaa. Others use twitches and tweaks particualr to IE, thus you can't get there using other browsers. My feeling is that if Mozilla don't get there, they don't deserve my business.

 

[n0cmonkey]

The financial institution I belong to works perfectly with Mozilla. No errors, no warnings, just good old fashioned poor financial decisions with the ease of a mouse click. Sites that do not try to use correct HTML should be ostracized.

 

[Bulldog13]

Originally posted by: n0cmonkey
IE is just like a porno. Always the same stuff, just a different hole.

8:35 in the morning at work and finally cracked a smile :beer:

 

[sandorski]

Originally posted by: Abhoth
lol too and I use Mozilla... Although, many financial institutions cater to IE. I've had some refuse access because my browser was out of date! hahhahhahaaa. Others use twitches and tweaks particualr to IE, thus you can't get there using other browsers. My feeling is that if Mozilla don't get there, they don't deserve my business.

You said it.

Why people continue using IE after a constant stream of exploits, fixes, and yet more exploits baffles me. I even heard the News suggesting using a non-IE browser, it seems people are catching on finally.

 

[CTho9305]

Originally posted by: n0cmonkey
The financial institution I belong to works perfectly with Mozilla. No errors, no warnings, just good old fashioned poor financial decisions with the ease of a mouse click. Sites that do not try to use correct HTML should be ostracized.

Bank of America works fine with Mozilla. You should give names, since it's good advertising for them .

 

[1sikbITCH]

BankofAmerica didn't work fine for Firefox 0.8, though. It would only let me click on one javascript link, and then after that none of them would work anymore. This was from work, home, and my parents house. So, I couldn't Transfer Funds, and then after that click on Pay Bills, etc. All links that tried to run javascript were like that for me.

I had to open IE to go to my bank. It felt like I was using some ATM on a deserted street at 3am, just praying I don't get mugged
It's fixed in 0.9 though.

 

[bernie48]

Originally posted by: 1sikbITCH
BankofAmerica didn't work fine for Firefox 0.8, though. It would only let me click on one javascript link, and then after that none of them would work anymore. This was from work, home, and my parents house. So, I couldn't Transfer Funds, and then after that click on Pay Bills, etc. All links that tried to run javascript were like that for me.

I had to open IE to go to my bank. It felt like I was using some ATM on a deserted street at 3am, just praying I don't get mugged
It's fixed in 0.9 though.

That's good to know - I had problems too...

 

[CTho9305]

Originally posted by: bernie48

Originally posted by: 1sikbITCH
BankofAmerica didn't work fine for Firefox 0.8, though. It would only let me click on one javascript link, and then after that none of them would work anymore. This was from work, home, and my parents house. So, I couldn't Transfer Funds, and then after that click on Pay Bills, etc. All links that tried to run javascript were like that for me.

I had to open IE to go to my bank. It felt like I was using some ATM on a deserted street at 3am, just praying I don't get mugged
It's fixed in 0.9 though.

That's good to know - I had problems too...

I dunno, FireFox sucks. I use mozilla .

 

[Sid59]

wamu works with Firefox and both WAMU and Firefox ROCK.

 

[n0cmonkey]

Originally posted by: CTho9305

Originally posted by: n0cmonkey
The financial institution I belong to works perfectly with Mozilla. No errors, no warnings, just good old fashioned poor financial decisions with the ease of a mouse click. Sites that do not try to use correct HTML should be ostracized.

Bank of America works fine with Mozilla. You should give names, since it's good advertising for them .

It's a local credit union.

 

[kt]

Originally posted by: 1sikbITCH
BankofAmerica didn't work fine for Firefox 0.8, though. It would only let me click on one javascript link, and then after that none of them would work anymore. This was from work, home, and my parents house. So, I couldn't Transfer Funds, and then after that click on Pay Bills, etc. All links that tried to run javascript were like that for me.

I had to open IE to go to my bank. It felt like I was using some ATM on a deserted street at 3am, just praying I don't get mugged
It's fixed in 0.9 though.

I've been using Fireforx 0.8 with BofA for quite sometime now. I haven't run into any problems. I've done all of the above stuff you mentioned.

 

[Slogun]

Originally posted by: chrisbtx
Yet another reason NOT to use IE.

Dump it and go for something much better like Mozilla, Firefox, Opera, etc. as stated above.

I'm interested in dumping IE due to the newext exploits.

I did install Firefox, which is supposed to be the "next generation browser" from Mozilla, yet some people seem to be saying Mozilla is best.
Can anyone shed some light?

 

[TheBoyBlunder]

<insert Firefox is SO MUCH BETTER comment here>

 

[drag]

Originally posted by: Slogun

Originally posted by: chrisbtx
Yet another reason NOT to use IE.

Dump it and go for something much better like Mozilla, Firefox, Opera, etc. as stated above.

I'm interested in dumping IE due to the newext exploits.

I did install Firefox, which is supposed to be the "next generation browser" from Mozilla, yet some people seem to be saying Mozilla is best.
Can anyone shed some light?

Firefox and Mozilla both come from the Mozilla project. Firefox is "Next Gen." because it's going to replace Mozilla browser proper.

Mozilla itself is not just a browser, it includes a news reader, a mail reader, and a couple other things. Firefox is just a browser. It's designed to be much more flexible with the extensions and stuff like that, but Mozilla is currently the stable version you should be using if you don't want mess around with changes and little bugs all the time.

So Mozilla itself is much more mature, but Firefox is not as bloated and is eventually going to be the next generation of Mozilla.

It's actually a realy good change, Mozilla itself is based on the original old-school Netscape code. And over the time it's been changed, warped, replaced, stomped on etc etc etc. So it works well but with all that history it's hard to get new developers because the time it takes to learn how everything works is daunting.

By splitting up the browser into it's different parts, you end up with a product that is easier to work with, debug, and people only use the features that they need. Hence all the extensions and stuff, prevents feature bloat, but adds lots of new features. You can have your cake and eat it too.

Also people who say that Mozilla is better have generally been using it for years now. They (and I) known about IE for years, and everybody else is just figuring out what we knew all the time.

If you can't make up your mind, use firefox if having something quick and fun is important, use Mozilla if stability and mature features is wanted and initial openning speed isn't a issue (what does a extra 2-3 seconds openning time if you leave your browser open for days?)

(I use firefox on my desktop and Mozilla on my laptop, so go figure)