Two million logins and passwords from services such as Facebook, Google and Twitter have been found on a Netherlands-based server, part of a large botnet using controller software nicknamed “Pony.”
Another company whose users’ login credentials showed up on the server was ADP, which specializes in payroll and human resources software, wrote Daniel Chechik, a security researcher with Trustwave’s SpiderLabs.
It’s expected that cybercriminals will go after main online services, but “payroll services accounts could actually have direct financial repercussions,” he wrote.
ADP moved US$1.4 trillion in fiscal 2013 within the U.S., paying one in six workers in the country, according to its website.
Facebook had the most stolen credentials, at 318,121, followed by Yahoo at 59,549 and Google at 54,437. Other companies whose login credentials showed up on the command-and-control server included LinkedIn and two Russian social networking services, VKontakte and Odnoklassniki. The botnet also stole thousands of FTP, remote desktop and secure shell account details.
It wasn’t clear what kind of malware infected victims’ computers and sent the information to the command-and-control server.
Trustwave found the credentials after gaining access to an administrator control panel for the botnet. The source code for the control panel software, called “Pony,” was leaked at some point, Chechik wrote.
The server storing the credentials received the information from a single IP address in the Netherlands, which suggests the attackers are using a gateway or reverse proxy in between infected computers and the command-and-control server, he wrote.
“This technique of using a reverse proxy is commonly used by attackers in order to prevent the command-and-control server from being discovered and shut down — outgoing traffic from an infected machine only shows a connection to the proxy server, which is easily replaceable in case it is taken down,” Chechik wrote.
Information on the server indicated the captured login credentials may have come from as many as 102 countries, “indicating that the attack is fairly global,” he wrote.
Source: Network World
The exposed.su website started drawing attention in March when it offered social security numbers and other information for everyone from Beyonce to Michelle Obama and the director of the CIA. Shocked by the breadth of data, both the FBI and Secret Service launched investigations — but today the security blogger Brian Krebs has beaten them to the punch, offering a comprehensive look at how all that personal data made it to the web.
Krebs traces the exposed.su data back to another site, SSNDOB.ms, which pulled the information through compromised servers at LexisNexis and two other companies that specialize in data for background checks. With this relatively small network, hackers were able to steal nearly 3.1 million date-of-birth records and over a million social security numbers, widely considered a weak point in online security.
Krebs also reports that the malware used had no trouble evading anti-virus software. As of early September, none of the top 46 antivirus services detected the software as malicious. There’s no word yet on who was operating the network, but the FBI says their investigation is ongoing and Krebs has promised more revelations in the coming weeks.
Source: The Verge
Malware managed to pilfer over 16,000 Facebook credentials in 2012, as well as credit card information linked to user accounts, it was revealed today.
The PokerAgent botnet was in control of 800 systems, as it sought to harvest information on Facebook users running the Zynga Poker app. The botnet was most active in Israel, security company ESET said, revealing the findings today, having worked with police in the country and with Facebook to kill the threat.
Infected users did not have their own Facebook accounts hacked. Their systems were instead used to carry out nefarious activities on other user accounts for which the attackers had acquired details, as the hackers sought to cover their tracks. Those systems carrying the malware were also used to propagate and grow the botnet.
“Facebook was notified and has responded promptly by forcing password resets for all known victims,” Robert Lipovský, ESET malware researcher, told TechWeekEurope.
“We only know that the attacker had at least 16,194 unique entries in his database of stolen logins. On the one hand, there may have been more, on the other, not all of these were valid – so that number is just a rough estimate.”
ESET had no information on how much money was stolen.
The Trojan was programmed to log into Facebook accounts and collect information on Zynga Poker stats for the given Facebook ID and the number of payment methods saved in the Facebook account.
PokerAgent was only interested in gathering gender information, points and rank from poker players. It is unclear what the attackers were doing with the harvested data, but ESET suggested they were amassing databases for future attempts to steal user identities and funds.
“The code suggests that the attacker seeks out Facebook users who have something of value, worth stealing – determined by the Poker stats and credit card details saved in their Facebook account,” Lipovský wrote in a blog post. “Later, the attacker can simply abuse the credit card information themselves or they may sell the database to other criminals.”
The malware was also ordered to publish links on the infected Facebook user’s wall. Those links would lead visitors to a fake Facebook login site, where their details would also be phished.
But Facebook users should not have to worry about this threat today. ESET said the malware author seemed to have ceased actively spreading the Trojan mid-February 2012. Efforts from ESET, Israel’s Computer Emergency Response Team (CERT) and law enforcement could well have been the catalyst for the demise of PokerAgent.
ESET noted that two-factor authentication would have prevented the malware from logging into Facebook accounts.
Global spam levels continued to fall in 2012 and even the number of malicious attachments was on the wane, new figures from Kaspersky Labs have suggested.
The fall is relative of course; even with an eight-point drop, spam continued still accounted for a staggering 72 percent of all email during the year, equivalent to tens of trillions of messages moving uselessly and malevolently across the Internet every year.
The drop was consistent throughout the year, falling month-on-month, eventually dipping below the 70 percent threshold in the final three months of the year, Kaspersky said.
What is clear is that the exact percentage of spam sent to a user or network varies by country and region, with Asia now accounting for a disproportionate level of activity.
In terms of distribution, China heads the table with one in five of all spam messages sent, ahead of the US with 15.6 percent; Latin America and Europe both dropped. Asia as a whole now accounts for half of all jump email.
Malicious attachments were down slightly to 3.4 percent, although this does not include those with embedded links.
According to Kaspersky, the unprecedented fall can be explained by the gradual improvement in filtering.
Arguably, the disruption of botnets – the platform used to send most spam – has probably had a larger effect, with the downing of several large distribution networks coinciding with the start of spam’s decline in 2010.
Only this week, the Virut Botnet – a major sender of spam across Eastern Europe and the US – found itself on the ropes after the Polish national registrar disrupted its domains and command and control servers. This is only the latest in a line of botnet ‘takedowns’ in the last two years.
It could also be that there are better ways to make money from cybercrime, not least by infiltrating social media.
“This drop is the result of a gradual departure of advertisers from spam to other, more convenient and legal means of promoting goods and services,” said Kaspersky Lab’s Darya Gudkova.
“However, that doesn’t mean spam is headed the way of the dodo anytime soon. Malicious spam, fraud, and advertising of illegal goods cannot simply or easily migrate to legal platforms, due to their own inherently criminal nature. We expect that the decline in spam volumes in 2013 will be negligible at best,” he said.
Doubtless, some will disagree with Kaspersky’s numbers, which only reflect what its customers see. But they do chime with what other security companies have been saying for two years.
The spam percentages being experienced during 2012 by the Russian firm are about the same as those reported by Symantec in late 2011, for instance.
Via: Network World