Shifu: Cuddly Cartoon Character or Dangerous Trojan

Shifu, a highly effective banking Trojan, appears to be making its way toward the US after previously targeting Japanese banks. In an article appearing in Security Intelligence, an IBM website, Shifu has been detected in the UK, and is spreading rapidly; likely headed to the U.S.

Shifu (the Japanese name for “thief”) appeared in Japan during August of this year. It quickly made its way into the UK, leaving experts wondering “Where to next?” According to the Security Intelligence website, the remainder of Europe and the U.S. are targets ripe for picking.

Besides targeting financial accounts, it also sets sights on point of sale (POS) systems and can snatch payment card details in the same manner as those who breached networks of Target and other retail organizations.

Keeping Shifu from its goal keeps experts busy wondering what can be done to stop it. Both corporations and individuals have become victims of Shifu, falling prey to the tactics it employs. Security approaches preventing “popular” banking malware like Dyre (which intercepts user information when it passes from a browser to the website) and Dridex (which uses MS Word Macros to steal banking credentials), are also effective fighting Shifu.

However, some basic steps can be taken to minimize your vulnerability. Here are just a few safety precautions you can use as a defense against Shifu.

• Keep updated anti-malware software on computers. Use the automatic update features when possible so that you don’t forget to apply them when they are released.

• Familiarize yourself with your financial institution’s policies regarding email attachments. Knowing before is the best alternative to knowing after it’s too late. In most cases, financial organizations will recommend you log into your account through its website to read documents it sends to you. 

• Use pop-up blockers. Prevent these annoying, and potentially harmful pop-ups from reaching you in the first place. 

• Check into ad blocking software. These will block ads on the fringes of websites and prevent clicking on ads unintentionally. While certainly not every ad contains malware, cyber criminals are using them more frequently to do their dirty deeds.

Shifu uses the best algorithms and technologies from many different types of malware including Zeus and Gozi to steal authentication information including passwords, authentication keys, security certificates, and of course user credentials. It also can grab data from smartcards if attached to a reader. All of this is what makes it more frightening.

Experts are left trying to determine not only the future of Shifu, but its history as well. Looking into what makes it work so well, experts are finding that parts of its structure are familiar. Shifu currently looks to online banking Trojans like Dridex and Dyre for its base. Stealing passwords and other sensitive information is nothing new for banking Trojans, but it’s nevertheless damaging. It also has capabilities to affect some European banking platforms, but until recently, only attacks on Japanese institutions were found to be active.

Acknowledging Shifu and how to combat it as the powerful financial Trojan it is, may keep it from wreaking havoc on banking and other worldwide industries. Shifu uses common tactics from other Trojans, but then focuses on what makes it different. In this case, Shifu protects itself from other malware, looking for suspicious files lending themselves to encroachment. Experts find it’s not so much a question of Shifu hitting the US, but inevitably a question of when it will.