Zeus leaks give tools to researchers, attackers

Crimeware leak could aid both the good and bad

The source code and a manual to the popular crimeware creation kit Zeus has been leaked, perhaps giving defenders additional tools to fight infections but also raising concerns that criminals may use the source code to create a rapidly expanding compendium of variants.

Nearly a week ago, copies of the source code to Zeus appeared on the Internet, according to Danish security firm CSIS. The release comes about the same time that a manual describing Zeus's functionality also appeared on the Web. While having access to the source code could be a boon to researchers, security professionals also worried that having access to the code could result in a spurt of innovation among criminals.

"It remains to be seen whether we see different flavors of Zeus appearing over the next few days, weeks or even months," says Paul Wood, senior analyst with Symantec.cloud. "Of course, the ability then is for the other bad guys to take advantage of some of the technology that they don't have in their tool kit and build that into their own technology, because there are certainly a quite a lot of interesting features in the Zeus toolkit."

In 2004, the creator of the Agobot bot software posted his code to the public. Soon after, Agobot variants skyrocketed, turning the code for the software into one of the largest families of malware detected on the Internet.

Zeus is already popular and is frequently used as the means to steal money from victims' bank accounts. Yet, the source code could help criminals create more variations on the source code, says Wood.

The release of the code comes around the same time as the publication of a manual for the software. In a tweet on Wednesday, Mikko Hyponnen, chief research officer for security firm F-Secure, highlighted the document.

"Gives a good idea on how organized these guys are," he posted.

Yet, the public outing of both the source code and manual can help defenders create better ways of detecting variants of the Zeus code, says Symantec.cloud's Wood.

"The other side of the coin really is the ability to understand how these components are generated by looking at the source code, which enables us to put in place better rules to identify that type of malicious activity," Wood says. "If we can understand a bit about how they work, that allows us to build better rules to detect them.

Unfortunately, the code has not yet revealed much about the author or authors. In an analysis posted on Wednesday, Derek M. Jones, a visiting professor at Kingston University focusing on forensics software engineering, concluded that there is a single author who had some professional development experience and had very strong English skills. Extending those conclusions is difficult, he says.

"There has been some research where people have tried to do some author attribution," he says. "But the problem is that people look for patterns, but in code, there is not a lot of patterns."

Or, as F-Secure Hypponen deadpans, " They're Russian. That should help us a lot in finding them."

Read more about malware/cybercrime in CSOonline's Malware/Cybercrime section.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags cybercrimebotnetslegalsoftwaredata protectionapplicationssymantecf-securezeusData Protection | MalwareSymantec.cloudmalware toolkitsmalware source codeRussian cybercrime

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Robert Lemos

CSO (US)
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?