Nice article I’ve found on Infoworld.com about the evaluation of phishing and its latest appearance in form of spear phishing (the method Megapanzer is used).

Fraudsters hone their attacks with spear phishing

In my previous column, I said that the No. 1 way to reduce IT security risks in your organization is to “simply” prevent end-users from installing stuff they shouldn’t. This, of course, is much easier said than done.

Although infected innocent Web sites results in a large percentage of security breaches, fraudulent emails still abound. Unfortunately, long gone are the days when it was easy to identify malicious phishing email by their strange subject lines and horrible grammar.

Today’s phishers, at the very least, are grammatically correct. The ones without enough education or experience to use language correctly naturally made less money and fell out of the criminal business early on; either that, or they hired smarter people.

The next generation of phishing messages, which is still prevalent today, strongly resembles legitimate messages from our banks, cable companies, online electronic payment services, and credit card companies. Everything in the emails looks legitimate, including the graphics that originate from the real company’s Website. (The ones that included a notice to watch out for fake phishing messages always made me giggle.) The only thing that’s fake in the entire message is the link that victims are required to click to complete the requested action.

This form of phishing is pretty effective, but the messages at least contain a small clue (the bogus URL link) to users that they should evaluate the legitimacy of the request. Today’s browsers, with antiphishing features, might even warn an end-user against loading the bogus site.

But now end-users are being targeted by a new form of phishing, called “spear phishing,” which specifically targets a user or company. Spear-phishing emails look more authentic than the aforementioned breed, often including the user’s complete name or referring to a real project that the user is working on. Spear phishers often gather this information by doing tactical research or even breaking into a database, and it’s effective enough to fool even the savviest end-users.

Read more here.

Ruben

The video shows in seven simple steps how to take over an ebanking session of a victim and which tools you need to accomplish this stunt.
The weakest link in the chain is (obviously) not the bank itself but the trustful user,  who executed the trojan horse he received by a patient attacker. Once an attacker is on the victim system, he has full control and power to deceive the victim and make him believe everything is just fine. Hostnames are redirected to the attackers proxy server and SSL certificates are injected in the certificate store. So in reality, nothing is just fine!

In the following video, the ebanking server was not hacked. Only my machine was infected which allowed me to intercept the encrypted data. Everyhing you see happened inside my local network and no foreign machines were affected.

Here the link to Rapidshare to download the video : Megapanzer 0.1

Both Youtube and Vimeo removed the video after some time so the next place to see for how long the video will stay online is Metacafe. But the quality is rather bad and probably it’s me who will move it to an other video portal.

I guess it is necessary to add some further clearing words about the purpose of all this here to avoid confusion …

The last year many of the sites that hosted source code, documentation and discussion boards about malware were urged to close down. None of them reappeared and only some few of the same kind replaced the old abandoned ones. Mainly they had to close the doors because besides being accused of conspirative behavior the maintainer of the sites offered working, undetectable and harmful programs ready to download and ready to use. There were even people that were sent to prison because they not only shared information but also released malware into the wild.

If we would follow the same concept and obstinately ignore the signs we saw in the past probably we would encounter the same fate and had to close this place soon, too. What you will find here is documentation about malware with background information and if you want to leave comments on all the publications you can use the comments form (comments are moderated). And to state it explicitly : we don’t offer precompiled binaries you can download and distribute.