German cop Trojan has 64-bit brother

Big brother Trojan has a bigger sibling

Researchers at security vendor Kaspersky have discovered a version of the German R2D2 “Federal Trojan” that has a slightly longer list of targets and also supports the more secure 64-bit version of Windows.

The version discovered by the Chaos Computer Club earlier this month could only be used to capture communications on 32-bit Windows target machines from Skype.

Security vendors pointed out at the time that it could also capture information from MSN Messenger, Yahoo Messenger and take screen shots of pages within several widely-used browsers, including Firefox and Internet Explorer, but not Chrome.

The 64-bit version was also designed to capture data from popular messaging service ICQ and a host of other VoIP products, such as Low-Rate Voip, paltalk, SimpPro and sipgate X-lite, according to Kaspersky Lab.

In all it infects 15 applications.

Despite its expanded list of target applications, the newly discovered rootkit only provided “a rudimentary privilege escalation interface” compared with the earlier version.

The newer trojan also contains a bogus 1024 bit RSA certificate that would be used by the operating system to validate the applications.

“It is well known that 64 bit kernel modules must carry a valid digital signature that can be checked by the operating system, or loading the driver fails,” said Kaspersky’s Tillman Werner.

A user must intentionally install the certificate in order for the rootkit’s driver to install, however the alert that would pop up to user highlights that the CA Root certificate should not be trusted.

That certificated was issued by what appears to be a fictitious certificate authority, Goose Cert, on April 11, 2010.

Follow @CSO_Australia and sign up to the CSO Australia newsletter.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Have an opinion on security? Want to have your articles published on CSO? Please contact CSO Content Manager for our guidelines.

Tags WindowsChaos Computer ClubR2D2 Federal Trojan

More about Brother International (Aust)CA TechnologiesICQKasperskyKasperskyMessengerMSNRSASkypeYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Liam Tung

Latest Videos

More videos

Blog Posts