Citadel malware now targets password management applications

A new Citadel configuration steals the master keys for two password managers and a secure authentication program

Attackers have started using the Citadel Trojan program to steal master passwords for password management applications and other authentication programs.

The Citadel malware has typically been used to steal online banking credentials and other financial information by modifying banking sites on the fly when opened by users in their local browsers. The technique is known as a man-in-the-browser attack.

However, earlier this year, security researchers from Trusteer, a subsidiary of IBM, reported that Citadel also was being used in targeted attacks against petrochemical companies.

The same researchers recently found a Citadel configuration on a customer's computer that targeted password management programs. In particular, the malware was configured to initiate a key-logging operation if any of the following files were running: Personal.exe, PWsafe.exe and KeePass.exe.

Personal.exe is part of neXus Personal Security Client, an application that provides cryptographic APIs for online applications to communicate with authentication smart cards inserted into PCs. The product is designed to let users "conduct secure financial transactions, e-commerce and other security-dependent services directly from the desktop," according to the vendor.

PWsafe.exe is associated with Password Safe, an open-source password management application originally designed by cryptographer and security expert Bruce Schneier and KeePass.exe is a process associated with another open-source password manager called KeePass.

"Because the configuration file instructs the malware to capture keystrokes related to widely used password management and authentication solutions, we can't know who, exactly, is the target of the attack," the IBM researchers wrote in a blog post. "It might be an opportunistic attack, where the attackers are trying to see which type of information they can expose through this configuration, or a more targeted attack in which the attackers know that the target is using these specific solutions."

Password management applications are not only used to store passwords. Most of them also have form-filling capabilities, so they can also store credit card information and other personal details that users regularly need to provide on shopping or other sites. By compromising the master password for these programs, the attackers behind the Citadel malware can get access to all of this sensitive information as well.

Using password management applications is generally a good idea because they make it easy to use strong, individual passwords for every online account, which is a highly recommended security practice. However, there are multiple attack vectors that users should take into consideration when using such programs, and malware infections is one of them.

Fortunately, most password management programs offer two-factor authentication, including Password Safe, which supports YubiKey hardware tokens as a second authentication factor. These options should always be turned on in order to avoid master passwords becoming single points of failure.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Trusteeronline safetyIBMsecurityAccess control and authenticationspywaremalware

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?