Zeus leaks give tools to researchers, attackers

The source code and a manual to the popular crimeware creation kit Zeus has been leaked, perhaps giving defenders additional tools to fight infections but also raising concerns that criminals may use the source code to create a rapidly expanding compendium of variants.

Nearly a week ago, copies of the source code to Zeus appeared on the Internet, according to Danish security firm CSIS. The release comes about the same time that a manual describing Zeus’s functionality also appeared on the Web. While having access to the source code could be a boon to researchers, security professionals also worried that having access to the code could result in a spurt of innovation among criminals.

“It remains to be seen whether we see different flavors of Zeus appearing over the next few days, weeks or even months,” says Paul Wood, senior analyst with Symantec.cloud. “Of course, the ability then is for the other bad guys to take advantage of some of the technology that they don’t have in their tool kit and build that into their own technology, because there are certainly a quite a lot of interesting features in the Zeus toolkit.”

In 2004, the creator of the Agobot bot software posted his code to the public. Soon after, Agobot variants skyrocketed, turning the code for the software into one of the largest families of malware detected on the Internet.

Zeus is already popular and is frequently used as the means to steal money from victims’ bank accounts. Yet, the source code could help criminals create more variations on the source code, says Wood.

The release of the code comes around the same time as the publication of a manual for the software. In a tweet on Wednesday, Mikko Hyponnen, chief research officer for security firm F-Secure, highlighted the document.

“Gives a good idea on how organized these guys are,” he posted.

Yet, the public outing of both the source code and manual can help defenders create better ways of detecting variants of the Zeus code, says Symantec.cloud’s Wood.

“The other side of the coin really is the ability to understand how these components are generated by looking at the source code, which enables us to put in place better rules to identify that type of malicious activity,” Wood says. “If we can understand a bit about how they work, that allows us to build better rules to detect them.

Unfortunately, the code has not yet revealed much about the author or authors. In an analysis posted on Wednesday, Derek M. Jones, a visiting professor at Kingston University focusing on forensics software engineering, concluded that there is a single author who had some professional development experience and had very strong English skills. Extending those conclusions is difficult, he says.

“There has been some research where people have tried to do some author attribution,” he says. “But the problem is that people look for patterns, but in code, there is not a lot of patterns.”

Or, as F-Secure Hypponen deadpans, “They’re Russian. That should help us a lot in finding them.”