Attackers use Citadel malware to target password management
Source: Lucian Constantin
A new Citadel configuration steals the master keys for two password managers and a secure authentication program
Attackers have started using the Citadel Trojan program to steal master passwords for password management applications and other authentication programs.
The Citadel malware has typically been used to steal online banking credentials and other financial information by modifying banking sites on the fly when opened by users in their local browsers. The technique is known as a man-in-the-browser attack.
However, earlier this year, security researchers from Trusteer, a subsidiary of IBM, reported that Citadel also was being used in targeted attacks against petrochemical companies.
The same researchers recently found a Citadel configuration on a customer's computer that targeted password management programs. In particular, the malware was configured to initiate a key-logging operation if any of the following files were running: Personal.exe, PWsafe.exe and KeePass.exe.
Personal.exe is part of neXus Personal Security Client, an application that provides cryptographic APIs for online applications to communicate with authentication smart cards inserted into PCs. The product is designed to let users "conduct secure financial transactions, e-commerce and other security-dependent services directly from the desktop," according to the vendor.
PWsafe.exe is associated with Password Safe, an open-source password management application originally designed by cryptographer and security expert Bruce Schneier and KeePass.exe is a process associated with another open-source password manager called KeePass.
"Because the configuration file instructs the malware to capture keystrokes related to widely used password management and authentication solutions, we can't know who, exactly, is the target of the attack," the IBM researchers wrote in a blog post. "It might be an opportunistic attack, where the attackers are trying to see which type of information they can expose through this configuration, or a more targeted attack in which the attackers know that the target is using these specific solutions."
Password management applications are not only used to store passwords. Most of them also have form-filling capabilities, so they can also store credit card information and other personal details that users regularly need to provide on shopping or other sites. By compromising the master password for these programs, the attackers behind the Citadel malware can get access to all of this sensitive information as well.
Using password management applications is generally a good idea because they make it easy to use strong, individual passwords for every online account, which is a highly recommended security practice. However, there are multiple attack vectors that users should take into consideration when using such programs, and malware infections is one of them.
Fortunately, most password management programs offer two-factor authentication, including Password Safe, which supports YubiKey hardware tokens as a second authentication factor. These options should always be turned on in order to avoid master passwords becoming single points of failure.
| }
|