Citadel malware now targets password management applications

A new Citadel configuration steals the master keys for two password managers and a secure authentication program

Attackers have started using the Citadel Trojan program to steal master passwords for password management applications and other authentication programs.

The Citadel malware has typically been used to steal online banking credentials and other financial information by modifying banking sites on the fly when opened by users in their local browsers. The technique is known as a man-in-the-browser attack.

However, earlier this year, security researchers from Trusteer, a subsidiary of IBM, reported that Citadel also was being used in targeted attacks against petrochemical companies.

The same researchers recently found a Citadel configuration on a customer's computer that targeted password management programs. In particular, the malware was configured to initiate a key-logging operation if any of the following files were running: Personal.exe, PWsafe.exe and KeePass.exe.

Personal.exe is part of neXus Personal Security Client, an application that provides cryptographic APIs for online applications to communicate with authentication smart cards inserted into PCs. The product is designed to let users "conduct secure financial transactions, e-commerce and other security-dependent services directly from the desktop," according to the vendor.

PWsafe.exe is associated with Password Safe, an open-source password management application originally designed by cryptographer and security expert Bruce Schneier and KeePass.exe is a process associated with another open-source password manager called KeePass.

"Because the configuration file instructs the malware to capture keystrokes related to widely used password management and authentication solutions, we can't know who, exactly, is the target of the attack," the IBM researchers wrote in a blog post. "It might be an opportunistic attack, where the attackers are trying to see which type of information they can expose through this configuration, or a more targeted attack in which the attackers know that the target is using these specific solutions."

Password management applications are not only used to store passwords. Most of them also have form-filling capabilities, so they can also store credit card information and other personal details that users regularly need to provide on shopping or other sites. By compromising the master password for these programs, the attackers behind the Citadel malware can get access to all of this sensitive information as well.

Using password management applications is generally a good idea because they make it easy to use strong, individual passwords for every online account, which is a highly recommended security practice. However, there are multiple attack vectors that users should take into consideration when using such programs, and malware infections is one of them.

Fortunately, most password management programs offer two-factor authentication, including Password Safe, which supports YubiKey hardware tokens as a second authentication factor. These options should always be turned on in order to avoid master passwords becoming single points of failure.

Join the CSO newsletter!

Error: Please check your email address.

Tags Trusteeronline safetyIBMsecurityAccess control and authenticationspywaremalware

More about CitadelTrusteer

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts