SpyEye Trojan Source Code Made Public
Security firm Damballa announced recently that the source code for the SpyEye Trojan has been leaked to the public, giving other malware developers easy access to the toolkit.
According to the Sean Bodmer, a senior threat intelligence analyst at Damballa, the leak of the SpyEye code puts one of the world’s largest botnet criminal enterprises at risk to all sorts of horizontal and vertical attacks by world governments, law enforcement, security vendors and even other criminals desiring to increase their monetary footprint across the Internet.
First was detected in 2009, the malware targets sensitive information from online banking accounts in order to steal money from account owners. Most recently, it has been targeting banks and financial institutions in the United States and the United Kingdom.
Before it was made public, SpyEye was available for purchase on underground markets and was sold for as much as $10,000. Now, it is much easier and cheaper for criminals to find a leaked version.
The source code was “leaked by an infamous French security researcher named Xyliton, part of the Reverse Engineers Dream Crew,” wrote Bodmer on the company’s blog. “He was able to locate a copy of SpyEye builder 1.3.45 and created a walkthrough/tutorial that enables the reader, once in possession of SpyEye builder, to crack the hardware identification which has been secured using VMProtect, a licensing tool that locks an installation of software to a particular physical device.”
Bodmer explained SpyEye has been a major threat to experts for quite some time, but the leak of its source code now raises concerns that newer, more malicious versions could potentially hit the market now that it can be accessed by a much larger crowd.
“Now that SpyEye has been ousted, it is only a matter of time before this becomes a much larger malware threat than any we have seen to date,” wrote Bodmer. “So for the next few months, please hold onto your seats people… this ride is about to get very interesting.”
Related posts:
