Infosec: Rock Phish threat deepens

Infosec Europe 2008

Security firm RSA has warned that the software kit behind half of the world's phishing attacks has been upgraded.

The Rock Phish software has been used in attacks on over 40 European and US financial institutions.

The tool has been very successful, using innovations including unique URL generation to defeat blacklists. But Rock Phish has not used malware as part of its attack until recently.

The fake phishing pages now include a Trojan dubbed Zeus, so that once a victim's financial data has been harvested the Trojan allows the computer to be controlled remotely.

• INFOSEC VIDEO: Interview with Ed Gibson, chief security advisor at Microsoft UK

"The victim is duped into visiting a phishing site," said Uriel Maimon from the RSA 24x7 Anti-Fraud Command Center.

"Whether or not the victim surrenders his/her credentials into the site is irrelevant, as many people click on phishing links but do not fill in meaningful information.

"However, with this new attack twist the victim will still be infected with a Trojan."

The group behind the Rock Phish attacks did not develop the Trojan themselves, but purchased it for the job in much the same way as a legal software developer.

Zeus is a very flexible and persistent Trojan which can be used to steal data, make the infected machine part of a botnet and even take regular screenshots of a user's activity.

"The Zeus Trojan has many startling capabilities," said Maimon. "As I look on this blissful union of fraud and crime technologies, I can only envy the criminals who can find such coupling."

The Rock Phish software has become something of a cause célèbre in the IT security industry since it surfaced.

The creators have been described as the Kaiser Söze of the online world, and no-one is sure whether the creator is a single person or a hacking group.

RSA is confident that it is a hacking group behind the code, and no-one disputes that the software has been astonishingly successful.

Hundreds of millions of pounds have been siphoned out of users' bank accounts over the past four years.