Ruh Roh, Now The Bad Guys Are Using Open Source Too

Malware developers using the open source model to commit crime

What is good for the goose, is good for the gander, right?  Open source has been so successful in giving us software like Linux, Apache, Hadoop, etc., why wouldn't the open source method work with other types of software?  Probably no one expected that the criminals behind vast malware trojans would adopt open source methods to make their malware more dangerous, but they have.  According to this report from Seculert Research, the makers of Citadel, a variant of the Zeus Trojan are using open source models to hone their code and make the Trojan more dangerous. 

Not only open source, but the Citadel creators are also deploying it from a SaaS model and using a CRM type of system with forums and message board to communicate with the consumers using the Trojan to commit criminal activity.  You have to hand it to these guys, they are using cutting edge techniques to make their product better. Too bad they don't put this much effort into a legitimate business, but then again they probably wouldn't make as much money.

The story around Citadel was originally broke by my friend Brian Krebs on his Krebs On Security blog.  The developers behind Citadel reached out to consumers of malware Trojans who had grown frustrated with the lack of support from the folks creating these trojans (I am not kidding, they want support and maintenance for their viruses). Citadel is based on the venerable Zeus Trojan that was originally open sourced last year. 

Now users of Citadel can request functionality, donate modules, beta test and help each other with support questions thanks to the system Citadel has set up. This has resulted according to Seculert is Citadel adding:

• AES Encryption – The customer can decide whether to encrypt the malware configuration file and communication with the C&C server, with RC4 encryption (used by old Zeus versions) or AES encryption.
• Avoiding Trackers Detection – Zeus tracking websites (e.g. Zeus Tracker, Malware URL, etc.) help in shutting down Zeus botnets by reporting on new Zeus C&C servers. Citadel now requires a specific botnet key in order to download malware updates and configuration files, in a hope to not be detected by those trackers.
• Security vendors websites blacklist – Machines infected with Citadel cannot access websites of information security vendors. This blocks the option to download new security products, or get updates from currently installed products (e.g. Anti-Virus updates).
• Trigger-based Video Recording – Record videos (using MKV codec) of the infected machine activity, in case the victim visits a specific website. A customer can decide whether to receive a malware builder with or without this module, mainly because this feature requires a lot of space on the malware C&C server.

All of this innovation has also been done at a faster rate to. It seems the opens soure model is serving as an evolutionary catalyst. But it gets even better, using the Citadel Trojan, users get a License, Users Manual and release notes. Some legitimate software companies don't do that good a job.  Again it is a shame that they are doing all of this for a nefarious purpose.

According to the Seculert folks with the success of the Citadel system, we may see more open source models being deployed in the malware world. But hey why think only the good guys would have a monopoly on open source.  

• Security
• Cybercrime
• Alan Shimel
• citadel
• malware
• open source
• Seculert
• trojan
• Zeus