Citadel malware now targets password management applications

A new Citadel configuration steals the master keys for two password managers and a secure authentication program

Attackers have started using the Citadel Trojan program to steal master passwords for password management applications and other authentication programs.

The Citadel malware has typically been used to steal online banking credentials and other financial information by modifying banking sites on the fly when opened by users in their local browsers. The technique is known as a man-in-the-browser attack.

However, earlier this year, security researchers from Trusteer, a subsidiary of IBM, reported that Citadel also was being used in targeted attacks against petrochemical companies.

The same researchers recently found a Citadel configuration on a customer's computer that targeted password management programs. In particular, the malware was configured to initiate a key-logging operation if any of the following files were running: Personal.exe, PWsafe.exe and KeePass.exe.

Personal.exe is part of neXus Personal Security Client, an application that provides cryptographic APIs for online applications to communicate with authentication smart cards inserted into PCs. The product is designed to let users "conduct secure financial transactions, e-commerce and other security-dependent services directly from the desktop," according to the vendor.

PWsafe.exe is associated with Password Safe, an open-source password management application originally designed by cryptographer and security expert Bruce Schneier and KeePass.exe is a process associated with another open-source password manager called KeePass.

"Because the configuration file instructs the malware to capture keystrokes related to widely used password management and authentication solutions, we can't know who, exactly, is the target of the attack," the IBM researchers wrote in a blog post. "It might be an opportunistic attack, where the attackers are trying to see which type of information they can expose through this configuration, or a more targeted attack in which the attackers know that the target is using these specific solutions."

Password management applications are not only used to store passwords. Most of them also have form-filling capabilities, so they can also store credit card information and other personal details that users regularly need to provide on shopping or other sites. By compromising the master password for these programs, the attackers behind the Citadel malware can get access to all of this sensitive information as well.

Using password management applications is generally a good idea because they make it easy to use strong, individual passwords for every online account, which is a highly recommended security practice. However, there are multiple attack vectors that users should take into consideration when using such programs, and malware infections is one of them.

Fortunately, most password management programs offer two-factor authentication, including Password Safe, which supports YubiKey hardware tokens as a second authentication factor. These options should always be turned on in order to avoid master passwords becoming single points of failure.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwareIBMspywareonline safetyAccess control and authenticationTrusteer

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?