Slashdot Log In
A Look At the CoreFlood Botnet
Posted by
Soulskill
on Sat Nov 08, 2008 05:03 AM
from the from-russia-with-love dept.
from the from-russia-with-love dept.
CNet is running a story about research from security expert Joe Stewart into the CoreFlood botnet, which has harvested at least "50 gigabytes of compressed data, searchable in a MySQL database," from a group of over 370,000 bot IDs. Stewart explains how the botnet operates and some of the things he's learned about the group that operates it.
"Within the 50GB file, Stewart was able to discern how the thieves culled the data. He said they run a test script against that data that will log via a proxy into the bank using the credentials captured, say by a keylogging application. The CoreFlood script will then capture the HTML data on the post long-in page. In most cases, that page also contains the account's bank balance. They do that, he said, so that after running the test they have a picture of what are the highest dollar amounts. 'I don't know whether they steal from all of them. We don't have access to the accounts; the bank is not going to tell us how much was stolen out of any given account. We're not going to get that information, but we know they're actively logging and checking accounts to collect the balance data. The only reason (the script) can see that data is to target the biggest accounts first,' he said."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Key Generator (Score:5, Interesting)
My Bank (HSBC) gives me a little keychain keygenerator that spits out a 6 digit number when I press the button. All logins must also have the key number... I wonder if this simple measure would stop dead any keylogger attacks like this, OR with enough reasonable time monitoring they could reverse engineer the generator's seeds?
Re: (Score:2, Informative)
I'd like something like that. My bank said if someone gets access to my account I'm screwed. All I have protecting me is having to answer 1 of 3 questions. Mother's maiden name, etc.
--
IP Finding [ipfinding.com]
Re:Key Generator (Score:5, Informative)
Parent
Re:Key Generator (Score:5, Interesting)
Parent
Re: (Score:3, Interesting)
Well...talking about Mothers maiden name: in one of the bank in China, their online banking software requires me to pick 5 questions to answer from 3 groups, at least one from each. The group are:
Name of family member: brothers, sisters, parents, children, uncle/aunt or grand parents.
Name of teachers: The class master, or language class teacher, or math teacher of elementary, middle, or high school.
Date of birth of the family member.
Then next time when you do sensitive process (change password / change the
Re: (Score:2)
But at least give me a mind of safe.
That's about all you get - 1.1 factor auth is crap compared to RSA keyfobs.
Re: (Score:3, Informative)
Well one thing that I didn't mention, to login into the banking system in a first place, before any of operations can be carried out, you need a digital certificate (and ordinary password and username).
It could either be a USB thumbdrive hardware form issued from the bank, or an imported PFX file.
Re: (Score:2, Funny)
Hmmm...lowish /. ID, mother's maiden name strange, ALIEN! Run!!!!!
Re: (Score:2, Funny)
My mother is called FE31BB076800267D0BA you insensitive clod!
Re: (Score:3, Funny)
Ah, memories. Mrs. FE31BB076800267D0BA always did make the best brownies back in the day.
Re:Key Generator (Score:5, Informative)
Not only do I use one of those for logging in, but any financial transaction has to be signed with the pad.
For the bank where I have my loans, I have an SSL certificate and signature to confirm my identity.
That same certificate is tied to my national identity card, meaning I can use it for a lot of other things as well.
All in all, I can't understand why the US is so far behind when it comes to online banking.
I mean, I've had this for eight years now, and it'sbeen around longer.
Much love from Sweden ;)
Parent
Re: (Score:3, Interesting)
Re: (Score:2, Insightful)
I think the Atlantic Ocean does not help too much protecting the US from Internet fraud.
Re: (Score:3, Insightful)
Uh, RTFA - you are under constant attack from Eastern European criminal organizations.
Baby steps to the solution (Score:5, Insightful)
One-time-password generators protect against replay attacks, but they do not protect against modified transactions. If an attacker has root on your system, then he can simply escalate the keylogging attack to a live modification of the transaction data.
A better approach would be to use a class 3 card terminal. That's a small computer with a strictly defined purpose and specification (and therefore tremendously easier to secure). It has a display so that you can see the transaction that you authorize, without interference from software on a compromised PC, and it has a keypad so that you can enter the PIN and confirmation, without software on a compromised PC being able to capture any of it. These devices exist. The only reason they're not being used must be that the problem is currently not big enough to justify the cost of giving every customer a card terminal.
Parent
Re: (Score:3, Funny)
Sounds like much harder to build right than a electronic voting machine...
Re: (Score:2)
yes, but I expect since real money is involved, this device will be built right.
Re:Baby steps to the solution (Score:4, Interesting)
Parent
Re: (Score:3, Informative)
Several problems with that:
Re: (Score:3, Informative)
Never happened to me, typically sms is on my cellphone 3 second after clicking "send" on page.
You can't install keyloggers on most cellphones.
It's not about two devices. It's about using cellphone instead of separate or no token.
Re: (Score:2, Informative)
> These devices exist. The only reason they're not being used must be that the problem is currently not big enough to justify the cost of giving every customer a card terminal.
Not being used in the US perhaps... I've had one for several years with Swedbank. They are also used by another major swedish bank, SEB.
http://www.seb.se/digipass
http://www.swedbank.se/sst/inf/out/infOutHjalp/0,3769,55142,00.html
Re: (Score:2)
If the validation is done on the client side, then you have the algorithm already. If the validation is done on the server, then all you're doing is taking a code from one text box and pasting it into another. What's stopping the bot from doing that?
Re:Key Generator (Score:5, Interesting)
Parent
Re: (Score:3, Informative)
This solution already exists in the form of one-time security codes like the RSA SecurID range of products.
Basically it's a PRNG which spits out a number every few minutes which is unique to the customer.
Re: (Score:3, Interesting)
Re:Key Generator (Score:4, Informative)
Why create your own if instead you could use the decades old s/key (http://tools.ietf.org/rfc/rfc1760.txt)
You distro might have this in packages called opie. Debian packages:
opie-client - OPIE programs for generating OTPs on client machines
opie-server - OPIE programs for maintaining an OTP key file
libpam-opie - Use OTPs for PAM authentication
Java implementations can be found eg: http://math.berkeley.edu/~vojta/opiekey.html [berkeley.edu]
Parent
Re: (Score:2, Informative)
The problem is that the carriers are unreliable in timing of delivery even w/o grid problems. So many times I have got text messages and even voice mail hours after it was delivered.
PS. I am with Verison Wireless
Re: (Score:3, Interesting)
The problem is that the carriers are unreliable in timing of delivery even w/o grid problems. So many times I have got text messages and even voice mail hours after it was delivered.
I've had it take 9 months. Admittedly I wasn't in my home country at the time the SMS was sent.
Re: (Score:3, Funny)
wow, I hope that wasn't for paying a bill, you might find your house foreclosed when you get back.
Re: (Score:3, Informative)
Most China payment gateway (for processing online Credit/Debit cards transaction) do this. You need type the one time password from the text message sent to the registered phone.
Generally I hate this a lot unless they offer an alternative: Think when you are traveling, which I do a lot. Luckily, the payment gateway is only used to authorize China's website online transaction, but not every other online credit card transactions so I am not seriously affected (yet).
Re: (Score:2)
Is this with HSBC in Canada? I've been looking for a new bank...
Useful information... (Score:5, Funny)
Botnets need to start logging something useful.
Like slashdot accounts with moderator points.
Security Expert Joe Stewart (Score:2, Funny)
First I thought "so that's what he's going to do without George Bush in the Whitehouse" but then I realized it's Joe the Security Expert, not Jon the Daily Show host.
I am skeptical (Score:3, Insightful)
Anytime I read "it could happen to anybody" in a security article, I am always skeptical. I think "it could happen to any *average* computer user/net surfer" is a better adage.
Most here assembled, though not 100 percent immune, are far less susceptible than an "average" user to any sort of malware infection.
Re: (Score:2)
Why? It's a drive by download against some unnamed browser (probably but not definitely IE). You don't have to visit shady sites to get those - these days they hack poorly protected legitimate sites and embed the exploit code into otherwise harmless pages.
Re: (Score:2)
"Why? It's a drive by download against some unnamed browser (probably but not definitely IE). You don't have to visit shady sites to get those - these days they hack poorly protected legitimate sites and embed the exploit code into otherwise harmless pages."
Most IT jocks (formerly nerds and geeks):
1. use less-exploitable browsers, e.g. Firefox
2. use a less-exploitable OS, e.g. Linux, OS10
3. are less likely to visit dodgy websites
4. are less likely to respond to "Cum see Brittny Speers nekkid at our website!
Re: (Score:2)
I don't think that's valid. Past exploits have used syndicated advertising, e.g. DoubleClick [theregister.co.uk], Falk [theregister.co.uk].
Office Space (Score:2)
I probably wouldn't notice a few cents missing from my account once a month, I bet there's several thousand other people who wouldn't either.
Target biggest first? (Score:5, Interesting)
"The only reason (the script) can see that data is to target the biggest accounts first,' he said."
That depends on the objective and tactics of the attacker:
Although the obvious assumption is that the attacker wishes to gain as much money as possible with a minimal chance of being caught, it may be that (s)he is less greedy and/or more cautious.
Suppose that your target is a total of, say, $200K rather than the assumed multi-millions. You are far less likely to be caught or to trigger money-laundering precautions. In a case like this your best strategy might well be to go for above-average but not top 10% balances.
Similarly, if you ARE going for the maximum while still hoping your chance of being caught is low, it may well be worth steering clear of the very highest balances as they could be more closely monitored (and some of them are probably "honeypots").
Re: (Score:3, Insightful)
Yes, but to do this properly would generally require someone to have access to the internal programming of the banking system. Making 1 cent transactions might be possible, but they will certainly show up and be more noticeable than if 1 cent just disappeared from the balance. If your account has 200 transactions a month and carries a balance over $20000, you're only going to try to balance that so many times before you give up trying to find the penny. Heck, you could lose a dollar or two at that rate a
Re:Criminal (Score:4, Interesting)
Parent
Re:Criminal (Score:4, Insightful)
Umm, no. Playing Civilization on computer can be fun even if you are not inclined being a dictator or conqueror.
Parent
Re: (Score:2, Interesting)
Maybe just technically interested. Writing and setting up a botnet like this one withing the limitations inherent to something that's illegal sounds like an interesting challenge.
..as interest in sports makes one an olympian. (Score:4, Insightful)
Parent
Re:Online banking? Sign me up!!!! (Score:4, Funny)
Parent
Re:Online banking? Sign me up!!!! (Score:4, Interesting)
Parent
Re: (Score:2, Informative)
Re: (Score:2)
Yes.
They're one time use.
Re:Online banking? Sign me up!!!! (Score:5, Informative)
Parent
Re: (Score:2)
M&T does - If you have a business account, anyway.