Automation continues to grow in the industry and that includes tools for bad guys that are trying to break into systems.
The latest automated system is “Private Grabber,” a commercial rootkit that can “grab” any form of communication transmitted over SSL, but usually aims at stealing login credentials, said Webroot’s Dancho Danchev.
Danchev tested it by grabbing a test username and password for a Microsoft account.
With Ring 3 rootkit functionality, and supporting Windows XP/Vista/7/8, the rootkit sells for as little as $75, payable with Liberty Reserve, Western Union, Money Gram or PayPal.
“Potential customers also don’t get a DIY builder, but a bin file that’s individually crypted per customer. Surprisingly, customers will get the updates over email,” the researcher said.
“Next to the built-in rootkit functionality, the ‘form grabbing’ rootkit also takes advantage of ‘Smart API hooking’, and only hooks the functions responsible of transmitting form related data, making it extremely fast and efficient, according to its author,” he said.