Elaborate 'pharming' attack targeted 50 banks

An attack this week that targeted online customers of at least 50 financial institutions in the U.S., Europe, and Asia-Pacific has been shut down, a security expert said Thursday.

The attack was notable for the extra effort put into it by the hackers, who constructed a separate look-alike Web site for each financial institution they targeted, said Henry Gonzalez, senior security researcher for Websense Inc.

To be infected, a user had to be lured to a Web site that hosted malicious code exploiting a critical vulnerability revealed last year in Microsoft's software, Websense said.

The vulnerability, for which Microsoft had issued a patch, is particularly dangerous since it requires a user merely to visit a Web site rigged with the malicious code.

Once lured to the Web site, an unpatched computer would download a Trojan horse in a file called "iexplorer.exe," which then downloads five additional files from a server in Russia. The Web sites displayed only an error message and recommended that the user shut off their firewall and antivirus software.

If a user with an infected PC then visited any of the targeted banking sites, they were redirected to a mock-up of the bank's Web site that collected their login credentials and transferred them to the Russian server, Gonzalez said. The user was then passed back to the legitimate site where they were already logged in, making the attack invisible.

The technique is known as a pharming attack. Like phishing attacks, pharming involves the creation of look-alike Web sites that fool people into giving away their personal information. But where phishing attacks encourage victims to click on links in spam messages to lure them to the look-alike site, pharming attacks direct the victim to the look-alike site even if they type the address of the real site into their browser.

"It takes a lot of work but is quite clever," Gonzalez said. "The job is well done."

The Web sites hosting the malicious code, which were located in Germany, Estonia, and the U.K., had been shut down by ISPs as of Thursday morning, along with the look-alike Web sites, Gonzalez said.

It was unclear how many people may have fallen victim to the attack, which went on for about three days. Websense did not hear of people losing money from accounts, but "people don't like to make it public if it ever happens," Gonzalez said.

The attack also installed a "bot" on users' PCs, which gave the attacker remote control of the infected machine. Through reverse engineering and other techniques, Websense researchers were able to capture screenshots of the bot controller.

The controller also shows infection statistics. Websense said at least 1,000 machines were being infected per day, mostly in the U.S. and Australia.