News

Screen-Capture Trojans Ramp Up

In hopes of fighting Internet fraud, some online banking sites make customers use "virtual keypads" -- a method of entering passwords on the screen, generally with a mouse.

The system is designed to thwart keystroke-logging programs that capture everything a user types. Now those virtual keypads appear just as vulnerable to snoops.

A Spanish security company, Hispasec Systems, has revealed details of "Trojan horse" programs that can capture video imagery of an unsuspecting person's computer use. If the user enters a PIN on a bank's virtual keypad, the dastardly program is a witness.

Like most Trojan horses, the ones detected by Hispasec are slipped onto users' computers when they visit certain Web sites, often through spam links, said Hispasec researcher Bernardo Quintero. Often, users have no clue if they were hit. When Quintero's group tested whether more than 30 anti-virus programs would block a recent video-logging Trojan, only six did so.

Gartner Inc. security analyst Avivah Litan said screen-capture programs that attacked virtual keypads emerged as early as 2003, when banks in Brazil fell prey. She said the technique has remained relatively rare because the programs consume a lot of bandwidth and storage, and there have tended to be a lot of easier targets.

But that may be changing. Quintero said Wednesday that a newly detected Trojan combines keystroke-logging and video-capture functions -- and instead of recording the entire screen, the program just grabs images of the immediate area near where the user clicks the mouse. The spy receives a smaller file, making the attack easier to pull off.

All this points to an enduring security truth: No single measure -- especially one that is apparent to fraud artists -- is likely to guarantee safety.

Litan says banks would be wise to focus more resources on behind-the-scenes software that can analyze Web banking sessions to gauge their legitimacy.

"Banks should stop implementing patchwork solutions and get it right the first time," she said.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.