Massive New Spambot Ensnares 711,000,000 Email Addresses (zdnet.com) 31
An anonymous reader quotes ZDNet:
A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.
The spambot, dubbed "Onliner," is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet. Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data." Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
The spambot, dubbed "Onliner," is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet. Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data." Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
Just culls the weak in the wild (Score:2, Insightful)
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
Likely, all of which, requires some complicit user imbecility to embed.
Re: (Score:2)
80 million email servers
thats a lot of email servers!
Re: (Score:2)
80 million email servers
thats a lot of email servers!
Right, and for a total compromise of 711,000,000 users, that's what?
9 users per server?
run for the hills (Score:1)
email malware for windows? WTF?
Re:run for the hills (Score:5, Informative)
email malware for windows? WTF?
It's known as Exchange...
Re: (Score:3)
Just go to my handy website to enter your email to see if you've been affected, link will be up shortly. :^)
Too late - the "security researcher" here already has put up https://haveibeenpwned.com/ [haveibeenpwned.com]
Only a gullible fool would enter his own e-mail address in a site like that, but then again, there's no shortage of those...
Re: (Score:2)
It's appears good, it's cloudflare.com not 127.0.0.1 cloudfront.net
https://www.robtex.com/dns-loo... [robtex.com]
But does go through a lot of edge servers (can throttle network traffic to adjust loads).
Re: (Score:2)
It's appears good, it's cloudflare.com not 127.0.0.1 cloudfront.net
https://www.robtex.com/dns-loo... [robtex.com]
But does go through a lot of edge servers (can throttle network traffic to adjust loads).
Bail that answer that site is bad news, I posted too early search further I found this dire warning from Domain Registration
http://www.webhostingtalk.com/... [webhostingtalk.com] and https://www.complaintsboard.co... [complaintsboard.com] first two searching eNom Inc.
Really sorry about that.
Re: (Score:2)
You and Dan Kaminsky should get naked and be cool together.
I LOL'd https://en.wikipedia.org/wiki/... [wikipedia.org]
Crap to legit ratio (Score:2)
Re: Crap to legit ratio (Score:2)
Email accounts with passwords. That explains it. (Score:2)
I've been seeing a few cases where some miscreant obviously has access to real email conversations, and inserts something evil into it. In one case, in an ongoing conversation, an email "from" one of the participants with all the "On <date>, <foo> said:" reply chain for the legitimate conversation intact said "Check out this and let me know what you think", where "it" was the ever-popular Microsoft Word document that just said "Enable Content to view this". Of course, if the recipient does "En