News

Screen-Capture Trojans Ramp Up

In hopes of fighting Internet fraud, some online banking sites make customers use "virtual keypads" -- a method of entering passwords on the screen, generally with a mouse.

The system is designed to thwart keystroke-logging programs that capture everything a user types. Now those virtual keypads appear just as vulnerable to snoops.

A Spanish security company, Hispasec Systems, has revealed details of "Trojan horse" programs that can capture video imagery of an unsuspecting person's computer use. If the user enters a PIN on a bank's virtual keypad, the dastardly program is a witness.

Like most Trojan horses, the ones detected by Hispasec are slipped onto users' computers when they visit certain Web sites, often through spam links, said Hispasec researcher Bernardo Quintero. Often, users have no clue if they were hit. When Quintero's group tested whether more than 30 anti-virus programs would block a recent video-logging Trojan, only six did so.

Gartner Inc. security analyst Avivah Litan said screen-capture programs that attacked virtual keypads emerged as early as 2003, when banks in Brazil fell prey. She said the technique has remained relatively rare because the programs consume a lot of bandwidth and storage, and there have tended to be a lot of easier targets.

But that may be changing. Quintero said Wednesday that a newly detected Trojan combines keystroke-logging and video-capture functions -- and instead of recording the entire screen, the program just grabs images of the immediate area near where the user clicks the mouse. The spy receives a smaller file, making the attack easier to pull off.

All this points to an enduring security truth: No single measure -- especially one that is apparent to fraud artists -- is likely to guarantee safety.

Litan says banks would be wise to focus more resources on behind-the-scenes software that can analyze Web banking sessions to gauge their legitimacy.

"Banks should stop implementing patchwork solutions and get it right the first time," she said.

Featured

  • Microsoft Offers Support Extensions for Exchange 2016 and 2019

    Microsoft has introduced a paid Extended Security Update (ESU) program for on-premises Exchange Server 2016 and 2019, offering a crucial safety cushion as both versions near their Oct. 14, 2025 end-of-support date.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Notebook

    Microsoft Centers AI, Security and Partner Dogfooding at MCAPS

    Microsoft's second annual MCAPS for Partners event took place Tuesday, delivering a volley of updates and directives for its partners for fiscal 2026.

  • Microsoft Layoffs: AI Is the Obvious Elephant in the Room

    As Microsoft doubles down on an $80 billion bet on AI this fiscal year, its workforce reductions are drawing scrutiny over whether AI's ascent is quietly reshaping its human capital strategy, even as official messaging avoids drawing a direct line.