Cookies help us display personalized product recommendations and ensure you have great shopping experience.

By using this site, you agree to the Privacy Policy and Terms of Use.
Accept
SmartData CollectiveSmartData Collective
  • Analytics
    AnalyticsShow More
    data analytics and truck accident claims
    How Data Analytics Reduces Truck Accidents and Speeds Up Claims
    7 Min Read
    predictive analytics for interior designers
    Interior Designers Boost Profits with Predictive Analytics
    8 Min Read
    image fx (67)
    Improving LinkedIn Ad Strategies with Data Analytics
    9 Min Read
    big data and remote work
    Data Helps Speech-Language Pathologists Deliver Better Results
    6 Min Read
    data driven insights
    How Data-Driven Insights Are Addressing Gaps in Patient Communication and Equity
    8 Min Read
  • Big Data
  • BI
  • Exclusive
  • IT
  • Marketing
  • Software
Search
© 2008-25 SmartData Collective. All Rights Reserved.
Reading: Attackers Find Value in the Master Key to Password Managers
Share
Notification
Font ResizerAa
SmartData CollectiveSmartData Collective
Font ResizerAa
Search
  • About
  • Help
  • Privacy
Follow US
© 2008-23 SmartData Collective. All Rights Reserved.
SmartData Collective > Uncategorized > Attackers Find Value in the Master Key to Password Managers
Uncategorized

Attackers Find Value in the Master Key to Password Managers

thu@duosecurity.com
thu@duosecurity.com
4 Min Read
SHARE

A treasure trove of passwords, plus the keys to unlock multiple accounts – open-source password managers and cryptographic software client are being hit with a variant of a banking Trojan, Citadel, as reported by Threatpost.com and discovered by IBM Trusteer Researchers.

A treasure trove of passwords, plus the keys to unlock multiple accounts – open-source password managers and cryptographic software client are being hit with a variant of a banking Trojan, Citadel, as reported by Threatpost.com and discovered by IBM Trusteer Researchers.

More Read

IT Security Lessons from the World’s Biggest Data Breaches
First CloudCamp Frankfurt
Why Marketing Has a Branding Problem
Make it Simple, Focused, High-Performance, and Polished: My Web Philosophy
Fixmo Secures Strategic Investment from Samsung Ventures

Now instead of targeting specific banking websites and gaining just one set of credentials, attackers are smartly redirecting efforts to gain access to a single application with several account credentials, including the free managers KeePass and Password Safe.

The malware turns on keylogging whenever certain processes associated with the manager and client (including Personal.exe, PWsafe.exe, and KeePass.exe) are running in order to steal the one master password that unlocks a vault of passwords, including automated one-time passwords generated by the service in order to relieve users from memorizing complicated, unique passwords across all of their different applications.

The cryptographic software, neXus Personal Security Client is also being targeted by the same malware variant. The software is a third-party client that provides cryptographic APIs, allowing users to conduct financial transactions, e-commerce and other security services directly from their desktop.

The client also provides support for smart cards, tokens, and PIN-pad readers. One of their case studies listed on their site includes major auto manufacturer, Volkswagon. The company’s security practices include the use of a smart card that allows for Windows login, email encryption and signature, authentication to web applications via browser, login to SAP applications, mainframes and more.

Yet, if an attacker gets access to these authentication clients and password managers, then they could potentially breach corporate networks of major companies and steal intellectual property, delete critical parts of their IT infrastructure, and wreak all types of havoc on the inside.

It’s no surprise that attackers are first targeting a way to get an inventory of passwords, as 61 percent of data breach victims attribute their fraud experience to the breach of their credentials, according to The Consumer Data Insecurity Report (PDF) by Javelin Strategy & Research.

As a report from McAfee on Citadel (variant of Zeus) stated:

The Zeus malware platform was originally designed to steal currency, frequently in small amounts from thousands of victims. Citadel’s developers, however, have clearly recognized that sometimes data, particularly authentication credential data, can be more valuable than currency.

While it’s possible for attackers to steal the primary authentication credentials through these type of malware attacks, you can still stop them with the use of out-of-band two-factor authentication, whether with a smartphone application or the use of a hardware device, like a token.

And naturally, you should set up two-factor authentication with your password managers and authentication client software to ensure criminals can’t access them remotely. 

TAGGED:hackerspasswordsprivacysecurity
Share This Article
Facebook Pinterest LinkedIn
Share

Follow us on Facebook

Latest News

data analytics and truck accident claims
How Data Analytics Reduces Truck Accidents and Speeds Up Claims
Analytics Big Data Exclusive
predictive analytics for interior designers
Interior Designers Boost Profits with Predictive Analytics
Analytics Exclusive Predictive Analytics
big data and cybercrime
Stopping Lateral Movement in a Data-Heavy, Edge-First World
Big Data Exclusive
AI and data mining
What the Rise of AI Web Scrapers Means for Data Teams
Artificial Intelligence Big Data Exclusive

Stay Connected

1.2kFollowersLike
33.7kFollowersFollow
222FollowersPin

You Might also Like

Your Movements Speak for Themselves: Space-Time Travel Data is Analytic Super-Food!

17 Min Read

Breaches of data confidentiality can be costly

2 Min Read

What the Consumer Really Thinks of Data Privacy [INFOGRAPHIC]

1 Min Read
data security breach
Uncategorized

HIPAA in a HITECH World: HIPAA Violations on the Rise

19 Min Read

SmartData Collective is one of the largest & trusted community covering technical content about Big Data, BI, Cloud, Analytics, Artificial Intelligence, IoT & more.

AI and chatbots
Chatbots and SEO: How Can Chatbots Improve Your SEO Ranking?
Artificial Intelligence Chatbots Exclusive
ai chatbot
The Art of Conversation: Enhancing Chatbots with Advanced AI Prompts
Chatbots

Quick Link

  • About
  • Contact
  • Privacy
Follow US
© 2008-25 SmartData Collective. All Rights Reserved.
Go to mobile version
Welcome Back!

Sign in to your account

Username or Email Address
Password

Lost your password?