Cyber Risks · Krebs on Security

A Closer Look at Rapport from Trusteer

Summary: Trusteer's Rapport software works by taking control of Windows APIs to detect and block processes that try to intercept sensitive data, such as keyloggers and form grabbers that hook the WinInet API to steal credentials before encryption. Trusteer CEO Mickey Boodaei said roughly 50 banks in North America use the technology, that updates ship almost weekly, and that targeted malware samples have appeared specifically to disable Rapport.

What's compelling: Boodaei noted that antivirus detection of the most advanced ZeuS variants dropped from about 50 percent to close to zero, and S21sec confirmed a ZeuS sample that downloads a second file to render Rapport useless - so a bank-mandated install is a layer, not a guarantee, against organized crime that is actively working around it.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related