Cookies help us display personalized product recommendations and ensure you have great shopping experience.

By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
SmartData CollectiveSmartData Collective
  • Analytics
    AnalyticsShow More
    data driven insights
    How Data-Driven Insights Are Addressing Gaps in Patient Communication and Equity
    8 Min Read
    pexels pavel danilyuk 8112119
    Data Analytics Is Revolutionizing Medical Credentialing
    8 Min Read
    data and seo
    Maximize SEO Success with Powerful Data Analytics Insights
    8 Min Read
    data analytics for trademark registration
    Optimizing Trademark Registration with Data Analytics
    6 Min Read
    data analytics for finding zip codes
    Unlocking Zip Code Insights with Data Analytics
    6 Min Read
  • Big Data
  • BI
  • Exclusive
  • IT
  • Marketing
  • Software
Search
© 2008-25 SmartData Collective. All Rights Reserved.
Reading: Attackers Find Value in the Master Key to Password Managers
Share
Notification
Font ResizerAa
SmartData CollectiveSmartData Collective
Font ResizerAa
Search
  • About
  • Help
  • Privacy
Follow US
© 2008-23 SmartData Collective. All Rights Reserved.
SmartData Collective > Uncategorized > Attackers Find Value in the Master Key to Password Managers
Uncategorized

Attackers Find Value in the Master Key to Password Managers

thu@duosecurity.com
thu@duosecurity.com
4 Min Read
SHARE

A treasure trove of passwords, plus the keys to unlock multiple accounts – open-source password managers and cryptographic software client are being hit with a variant of a banking Trojan, Citadel, as reported by Threatpost.com and discovered by IBM Trusteer Researchers.

A treasure trove of passwords, plus the keys to unlock multiple accounts – open-source password managers and cryptographic software client are being hit with a variant of a banking Trojan, Citadel, as reported by Threatpost.com and discovered by IBM Trusteer Researchers.

More Read

What Does Your TV Say About You and Your Voting Intentions?
A Great CTO and Pot Shots from the Peanut Gallery
World’s Smallest LED Is a Single Molecule
Attending Times Open
Are You Letting Your Customers Know that You Still Exist?

Now instead of targeting specific banking websites and gaining just one set of credentials, attackers are smartly redirecting efforts to gain access to a single application with several account credentials, including the free managers KeePass and Password Safe.

The malware turns on keylogging whenever certain processes associated with the manager and client (including Personal.exe, PWsafe.exe, and KeePass.exe) are running in order to steal the one master password that unlocks a vault of passwords, including automated one-time passwords generated by the service in order to relieve users from memorizing complicated, unique passwords across all of their different applications.

The cryptographic software, neXus Personal Security Client is also being targeted by the same malware variant. The software is a third-party client that provides cryptographic APIs, allowing users to conduct financial transactions, e-commerce and other security services directly from their desktop.

The client also provides support for smart cards, tokens, and PIN-pad readers. One of their case studies listed on their site includes major auto manufacturer, Volkswagon. The company’s security practices include the use of a smart card that allows for Windows login, email encryption and signature, authentication to web applications via browser, login to SAP applications, mainframes and more.

Yet, if an attacker gets access to these authentication clients and password managers, then they could potentially breach corporate networks of major companies and steal intellectual property, delete critical parts of their IT infrastructure, and wreak all types of havoc on the inside.

It’s no surprise that attackers are first targeting a way to get an inventory of passwords, as 61 percent of data breach victims attribute their fraud experience to the breach of their credentials, according to The Consumer Data Insecurity Report (PDF) by Javelin Strategy & Research.

As a report from McAfee on Citadel (variant of Zeus) stated:

The Zeus malware platform was originally designed to steal currency, frequently in small amounts from thousands of victims. Citadel’s developers, however, have clearly recognized that sometimes data, particularly authentication credential data, can be more valuable than currency.

While it’s possible for attackers to steal the primary authentication credentials through these type of malware attacks, you can still stop them with the use of out-of-band two-factor authentication, whether with a smartphone application or the use of a hardware device, like a token.

And naturally, you should set up two-factor authentication with your password managers and authentication client software to ensure criminals can’t access them remotely. 

TAGGED:hackerspasswordsprivacysecurity
Share This Article
Facebook Pinterest LinkedIn
Share

Follow us on Facebook

Latest News

langgraph and genai
LangGraph Orchestrator Agents: Streamlining AI Workflow Automation
Artificial Intelligence Exclusive
ai fitness app
Will AI Replace Personal Trainers? A Data-Driven Look at the Future of Fitness Careers
Artificial Intelligence Big Data Exclusive
crypto marketing
How a Crypto Marketing Agency Can Use AI to Create Powerful Native Advertising Strategies
Blockchain Exclusive Marketing
data driven insights
How Data-Driven Insights Are Addressing Gaps in Patient Communication and Equity
Analytics Big Data Exclusive

Stay Connected

1.2kFollowersLike
33.7kFollowersFollow
222FollowersPin

You Might also Like

Ad Industry Groups Begin New Anti-Regulatory Campaigns

4 Min Read

Rangaswami on sharing and privacy

3 Min Read
home security and big data
Big DataExclusiveSecurity

3 Crucial Ways Smart Data Eliminates Home Security Threats

8 Min Read

Disrupting Nation State Hackers With the Security Basics

5 Min Read

SmartData Collective is one of the largest & trusted community covering technical content about Big Data, BI, Cloud, Analytics, Artificial Intelligence, IoT & more.

giveaway chatbots
How To Get An Award Winning Giveaway Bot
Big Data Chatbots Exclusive
ai chatbot
The Art of Conversation: Enhancing Chatbots with Advanced AI Prompts
Chatbots

Quick Link

  • About
  • Contact
  • Privacy
Follow US
© 2008-25 SmartData Collective. All Rights Reserved.
Go to mobile version
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?