SpyEye Trojan attacks Verizon's online payment page

Thanks Ron a real nasty! Prevx Blog: http://www.prevx.com/blog/168/SpyEye-the-infostealing-trojan-leader.html

TH

 

Hi Ron and Triple Helix,

I'm a bit confused by the article: it appears to suggest that Verizon's payment page had been attacked.

But this article states that it's the customer's computer that was compromised by the trojan, which does the code injection:

Trusteer: SpyEye Trojan Targeting Verizon Customers
http://antivirus.about.com/b/2011/05/18/trusteer-spyeye-trojan-targeting-verizon-customers.htm

How do you see this?

thanks,

-rich

 

As far as I can understand, it's attacked from the consumer PC when visiting the payment page.
Afaict, the MITM/HTML injection is only happening from that PC and not in anyway from the payment system itself (which wouldn't be a MITM attack).

The Trusteer CTO Amit Klein statement further on, does leave some room for interpretation;
"Whether it’s on consumer machines, call center computers, or point of sale systems, attackers are targeting endpoints to steal readily available payment card data....", but I think that sentence was only aimed at the 'financial malware trend', mentioned in the article.

(I've emailed Trusteer, asking for a tad of clarification. Perhaps they'll respond).

 

I think that this is the case. SpyEye gets onto the consumer's PC (by various methods) which then sets up the injection attack.

thanks,

-rich