{"id":6041,"date":"2014-07-07T10:40:41","date_gmt":"2014-07-07T17:40:41","guid":{"rendered":"https:\/\/www.paloaltonetworks.com\/blog\/?p=6041"},"modified":"2014-07-07T10:35:08","modified_gmt":"2014-07-07T17:35:08","slug":"banking-security-best-practices-zeus-cryptolocker","status":"publish","type":"post","link":"https:\/\/origin-researchcenter.paloaltonetworks.com\/blog\/2014\/07\/banking-security-best-practices-zeus-cryptolocker\/","title":{"rendered":"Banking Security: Best Practices for Zeus and Cryptolocker"},"content":{"rendered":"

Over the last few weeks we had a new episode in the on-going saga between the banking system and the Zeus and Cryptolocker families of malware. The UK National Crime Agency issued an unprecedented warning over GOZeuS and CryptoLocker PC malware<\/a>, which has already enabled cyber criminals to steal hundreds of millions of pounds through the theft of bank login credentials. A similar alert was raised in the US by the US-Cert<\/a>.<\/p>\n

Below are some recommended best practices from John Harrison, our resident threat prevention expert, to ensure optimum and continuous protection from the \u201cCrypto\u201d and \u201cZeus\u201d families, which respectively include Cryptolocker, CryptoDefense, or Cryptowall and P2PZeus, Zbot, GameOverZeus or GOZ, and may continue to resurface as other, as yet-undefined versions. Note that these best practices are applicable to many of malware families.<\/p>\n

Background on Zeus and Cryptolocker:<\/strong><\/p>\n

GameOver Zeus (GOZ) is a bank credential-stealing malware first identified in 2011 that has plagued the banking industry since then. It\u2019s often used by cybercriminals to target Windows based personal computers and web servers and carry out command-control attacks.<\/p>\n

Like many malware families today, Zeus and Cryptolocker utilize various Domain Generation Algorithms (DGA) to reach out to their command and control servers via DNS to establish contact and receive instructions. There are up to 1,000 domains per day that these families may reach out to. This can be one of the crucial breadcrumbs that help us detect them.<\/p>\n

As part of the proactive takedown initiated by the FBI in 2014, Palo Alto Networks and other companies, received intelligence that included about 250,000 URLs that\u00a0P2PZeus\u00a0and Cryptolocker will reach out to for the next 3 years.<\/p>\n

    \n
  1. Use IPS signatures to prevent vulnerabilities\u00a0from being exploited by client-side attacks that could drop Zeus or Cryptolocker.\u00a0<\/strong>Consider inline blocking with a strict IPS policy. Prevent the client-side vulnerability from being exploited with a drive-by download that would drop the malware on the system.<\/li>\n<\/ol>\n
      \n
    1. Use Palo Alto Networks AV signature coverage for Cryptolocker and Zbot.\u00a0<\/strong>Cryptolocker\u00a0can come via social engineering through PDFs\/Office documents or ZIP attachments that include\u00a0malicious\u00a0files. Unfortunately, names are not the best way to identify these malicious files. Our threat prevention features will automatically block known malicious files. We have added coverage for many samples under the \"Virus\/Win32.generic.jnxyz\" type name:<\/li>\n<\/ol>\n