Users have been warned about a new version of the Russian Trojan known as Gozi currently doing the rounds. The malware has been circulating on the web since 17 April and has already stolen personal data from more than 2,000 home users worldwide.
The compromised information includes bank and credit card account numbers, Social Security numbers and online payment account numbers as well as usernames and passwords. As with its predecessor, the new version of Gozi is programmed to steal information from encrypted Secure Sockets Layer (SSL) streams and send the stolen information to a server in Russia.
The variant was discovered by Don Jackson, a security researcher at Atlanta-based SecureWorks who also discovered the original Gozi Trojan horse back in January.
Jackson said the new version was very similar to the original Gozi code, but features two core enhancements. One of them is its use of a new and hitherto unseen "packer" utility that encrypts, mangles, compresses and even deletes portions of the Trojan horse code to evade detection by standard, signature-based anti-virus tools. The original Gozi, in contrast, used a fairly commonly known packing utility called Upack, which made it slightly easier to detect than the latest version.
This version of Gozi also has a new keystroke-logging capability for stealing data, in addition to its ability to steal data from SSL streams. According to Jackson, the keystroke logger appears to be activated when the user of an infected computer visits a banking Web site or initiates an SSL session. It is still unclear how exactly the keystroke logger knows to turn itself on and capture information, Jackson said.
Apart from those two differences, the variant is identical to Gozi, Jackson said. The Trojan horse takes advantage of a previously fixed vulnerability in the iFrame tags of Internet Explorer to infect systems. Users typically appear to be infected when visiting certain hosted websites, community forums, social networking sites and those belonging to small businesses.
The server to which the stolen data was being sent to was located on a Russian network. The upstream Internet service provider for the network was a company based in Panama, Jackson said. After being informed about the Gozi Trojan horse and its data cache, the service provider appears to have "no-routed" the destination, meaning the rogue server has effectively been cut off from the Internet, he said.
SecureWorks has also contacted law enforcement authorities and informed them about the data cache, Jackson said. In addition, SecureWorks has made a signature for detecting the Gozi version available to other vendors so they can include it in their anti-virus products, he said. So far, about 15 out of the top 30 providers of antivirus tools have incorporated the signature into their products and are able to detect and stop Gozi with varying degrees of efficiency, he said.
Each customer-generated query had a price associated with it, with transactions being conducted using a currency unity called WMZ, a WebMoney unit that is roughly equivalent to US$1. The server was managed by a Russian group called 76Service, which in turn had purchased the Gozi code from a set of Russian hackers calling themselves the HangUp Team.