Is Limbo 2 the ultimate trojan?

NEW TROJAN : Is Limbo 2 the ultimate trojan?

Sue Marquette Poremba

July 18 2008

http://www.scmagazineus.com/Is-Limbo-2-the-ultimate-trojan/article/112637/

Prevx, an internet security company headquartered in Derby, England, has discovered a new trojan designed to steal information from large banking institutions. Jacques Erasmus, director of malware research, told SCMagazineUS.com on Friday that the Limbo 2 trojan may be the most sophisticated trojan yet released.

Erasmus said he had been monitoring some underground Russian forums and managed to get a sample of the Limbo 2 trojan a week ago.

“This was by far the most sought-after trojan in the underground,” he said.

Part of the attraction of this trojan is its stealth characteristics. It offers its own cryptor that obfuscates the trojan, making it virtually impossible to detect. Erasmus said that the Limbo 2 trojan has been able to bypass anti-virus software.

“It also has a unique technique to steal bank information,” he added. “It can inject a code into a live banking site. If you log into a bank, it is able to hijack your connection and adds an extra field into the page.”

That extra field then harvests the user's personal information.

“This is a very organized and cataloged trojan,” Erasmus explained.

Computers are infected with the trojan through various methods: botnet deployments, bundled into downloaded installs, and through web exploits.

Even though the Limbo 2 trojan is able to sneak past anti-virus vendors today, Dave Marcus of McAfee Avert Labs, says that once vendors confirm the existence of Limbo 2, protection against it would quickly be made available.

“Information about this trojan is very sketchy, and we haven't been able to find anything under the name Limbo 2 yet,” Marcus told SCMagazineUS.com on Friday.

When a new piece of malware comes out, it isn't uncommon for it to evade anti-virus scanners, Marcus continued.

“But it doesn't go unnoticed for long,” he said, “and once someone gets a sample of it, information is shared among the malware researchers so everyone has protection.”