Attackers Find Value in the Master Key to Password Managers

A treasure trove of passwords, plus the keys to unlock multiple accounts – open-source password managers and cryptographic software client are being hit with a variant of a banking Trojan, Citadel, as reported by Threatpost.com and discovered by IBM Trusteer Researchers.

Now instead of targeting specific banking websites and gaining just one set of credentials, attackers are smartly redirecting efforts to gain access to a single application with several account credentials, including the free managers KeePass and Password Safe.

The malware turns on keylogging whenever certain processes associated with the manager and client (including Personal.exe, PWsafe.exe, and KeePass.exe) are running in order to steal the one master password that unlocks a vault of passwords, including automated one-time passwords generated by the service in order to relieve users from memorizing complicated, unique passwords across all of their different applications.

The cryptographic software, neXus Personal Security Client is also being targeted by the same malware variant. The software is a third-party client that provides cryptographic APIs, allowing users to conduct financial transactions, e-commerce and other security services directly from their desktop.

The client also provides support for smart cards, tokens, and PIN-pad readers. One of their case studies listed on their site includes major auto manufacturer, Volkswagon. The company’s security practices include the use of a smart card that allows for Windows login, email encryption and signature, authentication to web applications via browser, login to SAP applications, mainframes and more.

Yet, if an attacker gets access to these authentication clients and password managers, then they could potentially breach corporate networks of major companies and steal intellectual property, delete critical parts of their IT infrastructure, and wreak all types of havoc on the inside.

It’s no surprise that attackers are first targeting a way to get an inventory of passwords, as 61 percent of data breach victims attribute their fraud experience to the breach of their credentials, according to The Consumer Data Insecurity Report (PDF) by Javelin Strategy & Research.

As a report from McAfee on Citadel (variant of Zeus) stated:

The Zeus malware platform was originally designed to steal currency, frequently in small amounts from thousands of victims. Citadel’s developers, however, have clearly recognized that sometimes data, particularly authentication credential data, can be more valuable than currency.

While it’s possible for attackers to steal the primary authentication credentials through these type of malware attacks, you can still stop them with the use of out-of-band two-factor authentication, whether with a smartphone application or the use of a hardware device, like a token.

And naturally, you should set up two-factor authentication with your password managers and authentication client software to ensure criminals can’t access them remotely.