Citadel malware now targets password management applications

A new Citadel configuration steals the master keys for two password managers and a secure authentication program

Attackers have started using the Citadel Trojan program to steal master passwords for password management applications and other authentication programs.

The Citadel malware has typically been used to steal online banking credentials and other financial information by modifying banking sites on the fly when opened by users in their local browsers. The technique is known as a man-in-the-browser attack.

However, earlier this year, security researchers from Trusteer, a subsidiary of IBM, reported that Citadel also was being used in targeted attacks against petrochemical companies.

The same researchers recently found a Citadel configuration on a customer's computer that targeted password management programs. In particular, the malware was configured to initiate a key-logging operation if any of the following files were running: Personal.exe, PWsafe.exe and KeePass.exe.

Personal.exe is part of neXus Personal Security Client, an application that provides cryptographic APIs for online applications to communicate with authentication smart cards inserted into PCs. The product is designed to let users "conduct secure financial transactions, e-commerce and other security-dependent services directly from the desktop," according to the vendor.

PWsafe.exe is associated with Password Safe, an open-source password management application originally designed by cryptographer and security expert Bruce Schneier and KeePass.exe is a process associated with another open-source password manager called KeePass.

"Because the configuration file instructs the malware to capture keystrokes related to widely used password management and authentication solutions, we can't know who, exactly, is the target of the attack," the IBM researchers wrote in a blog post. "It might be an opportunistic attack, where the attackers are trying to see which type of information they can expose through this configuration, or a more targeted attack in which the attackers know that the target is using these specific solutions."

Password management applications are not only used to store passwords. Most of them also have form-filling capabilities, so they can also store credit card information and other personal details that users regularly need to provide on shopping or other sites. By compromising the master password for these programs, the attackers behind the Citadel malware can get access to all of this sensitive information as well.

Using password management applications is generally a good idea because they make it easy to use strong, individual passwords for every online account, which is a highly recommended security practice. However, there are multiple attack vectors that users should take into consideration when using such programs, and malware infections is one of them.

Fortunately, most password management programs offer two-factor authentication, including Password Safe, which supports YubiKey hardware tokens as a second authentication factor. These options should always be turned on in order to avoid master passwords becoming single points of failure.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Trusteeronline safetyIBMsecurityAccess control and authenticationspywaremalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?