Airport VPN hacked using Citadel malware
The pervasive Citadel trojan, typically reserved for financial theft, was used to beat two-factor authentication and hack into the virtual private network (VPN) of a major international airport, researchers revealed Tuesday.
Security firm Trusteer discovered the attack, which launched a two-step assault on its victims in order to compromise the airport's VPN.
The man-in-the-browser (MITB) assault first used form-grabbing malware, which steals data entered into web forms before it is passed over the internet, to steal the airport employees' VPN usernames and passwords, Amit Klein, Trusteer's chief technology officer, said in a blog post on Tuesday. Next, screen-capturing technology was employed to take a snapshot of an image created by the VPN's strong authentication product.
