Feodo botnet Protection ?

CloneRanger · Oct 22, 2010

Dermot7 has a thread here -

https://www.wilderssecurity.com/showthread.php?t=285016

From the linked www

Here are some high level features offered by this malware:

1. Bot herders can supply a list of URLs (mostly of banking sites) so that the malware can start intercepting these web pages. What this means is that whenever a user tries to visit these web sites, the malware will start submitting the web form data back to its CnC. These web forms and the data inside them will be intercepted well before its gets encapsulated into HTTPS. All the information including login credentials will be in hands of bot herders in plain text.

2. It's fully capable of Man in the Browser (MITB) attacks. This means that it can intercept original web contents coming from legitimate servers in order to append its own crafted HTML. This is normally done to ask the user for more information than was originally requested by the actual server, like your PIN numbers, Social Security number etc.

3. It can also steal HTML pages from your browsing sessions. Sound strange? Well for any successful MITB attack, the attacker needs to know about the HTML being served by the legitimate server. Just imagine an attacker wants to modify HTML pages for the Wells Fargo "Add New Payee" web page. Unless the attacker himself has an account with Wells Fargo, he may not know the contents of this page. By stealing this private page while a legitimate user is browsing to it, the attacker is in a perfect position to prepare his future MITB attack.

http://blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html
Click to expand...

I expect at some point, if not already you will detect this, so i'm NOT asking about Prevx blocking by DEF's detection. What i'd like to know is, if/when variants of this appear Without having Prevx the DEF's for it/them, would PSOL prevent any/all of the above, and if so fully ?

TIA

PrevxHelp · Oct 23, 2010

CloneRanger said:

I expect at some point, if not already you will detect this, so i'm NOT asking about Prevx blocking by DEF's detection. What i'd like to know is, if/when variants of this appear Without having Prevx the DEF's for it/them, would PSOL prevent any/all of the above, and if so fully ?
Click to expand...

This is the core benefit of SafeOnline Everyone tends to test the antikeylogging/screen grabber protection but those are a very, very small portion of the full protection of SafeOnline. Feodo/Caberp/Zeus/Silon/SpyEye/Bancos/Torpig/and many more are the actual threats, and that's where SafeOnline shows its best

CloneRanger · Oct 23, 2010

Excellent news

Log in or Sign up

Feodo botnet Protection ?

CloneRanger Registered Member

PrevxHelp Former Prevx Moderator

CloneRanger Registered Member

Log in or Sign up

Feodo botnet Protection ?

CloneRanger Registered Member

PrevxHelp Former Prevx Moderator

CloneRanger Registered Member

Useful Searches