Sunbelt Software reports that the Bank of India's Web site has been hacked and is used to distribute an enormous amount of malware, including rootkits and trojans, to the bank visitors. "It's very destructive stuff," says Alex Eckelberry, president of security firm Sunbelt Software.
Eckelberry says some of Sunbelt's employees was doing research during the past few hours and accidentally visited the Web site and determined it was infected with at least a dozen malware programs attempting to infect any vulnerable machine used by someone visiting Bankofindia.com.
The following malware has been distributed trough the Bank of India website : Email-Worm.Win32.Agent.l Rootkit.Win32.Agent.dw Rootkit.Win32.Agent.ey Trojan-Downloader.Win32.Agent.cnh Trojan-Downloader.Win32.Small.ddy Trojan-Proxy.Win32.Agent.nu Trojan-Proxy.Win32.Wopla.ag Trojan.Win32.Agent.awz Trojan-Proxy.Win32.Xorpix.Fam Trojan-Downloader.Win32.Agent.ceo Trojan-Downloader.Win32.Tibs.mt Trojan-Downloader.Win32.Agent.boy Trojan-Proxy.Win32.Wopla.ah Trojan-Proxy.Win32.Wopla.ag Rootkit.Win32.Agent.ea Trojan.Pandex Goldun.Fam Backdoor.Rustock Trojan.SpamThru Trojan.Win32.Agent.alt Trojan.Srizbi Trojan.Win32.Agent.awz Email-Worm.Win32.Agent.q Trojan-Proxy.Win32.Agent.RRbot Trojan-Proxy.Win32.Cimuz.G TSPY_AGENT.AAVG (Trend Micro) Trojan.Netview?
"We have Indian employees here trying to share this information with them now, which we're also sharing with organizations such as CERT," Eckelberry says. "It's a huge payload of malicious code," which Sunbelt is still analyzing, he says.
The payload from the Bank of India site is said to be attempting a number of Internet Explorer exploits to break into computers that may not be fully patched. Other types of software-application exploits may also be involved, which Sunbelt is still analyzing.
"Somehow the hackers managed to insert this code into the Web site," Eckelberry says. "We're seeing lots of rootkits and trojans, though not yet a keylogger."
Sunbelt says the situation is still fluid and every effort is being made to notify Bank of India, described as a government-operated site with more than 2,000 branches.
