Trusteer Rapport Security Circumvention

[barkley () usa net]

Hi,


Trusteer is an innovative software to combat fraud, thus it's global uptake in the financial sector. Trusteer also 
seems quite adamant that their software is bullet-proof, their website pretty much sums it up. However, on having a 
closer look and some tinkering, I discovered a complete no brainer vector for circumventing Trusteer's security. I've 
tested this on various XP platforms successfuly, please feel free to notify the vendor as you wish and/or to publish 
whatever you feel appropriate under the circumstances.


http://www.trusteer.com/solutions
http://www.trusteer.com/product-0
http://www.trusteer.com/product/technology
Trusteer Rapport locks down your browser once you connect to a sensitive website such as your bank. Any malicious 
software that tries to ride on the browser is left out of the locked down browser, and cannot access  your sensitive 
information and transactions. Rapport also locks down communication between your browser and the bank, preventing any 
network-based attack from diverting traffic to fraudulent locations.


The following illustrates how malware on entering a system by whichever means, and on detecting Trusteer's services, 
can easily (automated/scripted) disable Trusteer's security for whatever malevolent purposes.


Step-by-step illustration, how to easily circumvent Trusteer's security.

Firstly, disable Trusteer's service (RapportMgmtService.exe) in your active Hardware Profile. Trusteer doesn't protect 
this option, thus this is a good starting point for now.
i.e.
[HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_RAPPORTMGMTSERVICE\0000]
"CSConfigFlags"=dword:00000001

NOTE: This in fact disables Trusteer's service (RapportMgmtService.exe) in the Services.msc GUI
i.e.
Services.msc > "Rapport Management Service" > "Log On" > "Hardware Profile" > "Disabled"


On the very next reboot, at least one reboot is required to disable the kernel driver (RapportPG.sys), Trusteer's 
service (RapportMgmtService.exe) should now be inactive/disabled, and thus you'll be able to rename Trusteer's now 
unprotected folders.
i.e. Command Prompt
C:\> cd \"Program Files"
C:\> rename Trusteer TrusBeer

NOTE: At this point the web browser's not protected by Trusteer, nor is Trusteer's software & system settings 
protected, thus pretty much open to your imagination.


The following step is not required, especially seeing as Trusteer's service (RapportMgmtService.exe) was disabled 
previously in the active Hardware Profile. However, should you also wish to reconfigure Trusteer's now unprotected 
drivers & services to start manually, or even disable/delete completely, you may or may not have to reboot one more 
time, as the following step may need another reboot to take advantage of the previously now renamed unprotected folders 
in the previous step.
i.e. Command Prompt
C:\> sc config RapportMgmtService start= demand
C:\> sc config RapportPG start= demand


Should you wish to cover your tracks (you'll also have to clear event logs), rename Trusteer's home folder back to the 
original and restore the Hardware Profile registry entry.
i.e.
[HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_RAPPORTMGMTSERVICE\0000]
"CSConfigFlags"=dword:00000000

i.e. Command Prompt
C:\> cd \"Program Files"
C:\> rename TrusBeer Trusteer


Cheers

Andrew Barkley
(-_-)