Slashdot Mirror

← Back to Stories (view on slashdot.org)

Spyware Based ID Theft Ring Uncovered

Posted by Zonk on from the dirty-pool dept.

phaedo00 wrote to mention an Ars Technica article discussing a massive identity theft ring uncovered by security software firm Sunbelt. From the article:"According to one of their employees, Alex Eckelberry, during the course of one of their recent investigations into a particular Spyware application--rumored to be called CoolWebSearch--they've discovered that the personal information of those 'infected' was being captured and uploaded to a server."

3 of 143 comments (clear)

  1. Misinformation? by LFS.Morpheus · · Score: 4, Informative

    If you RTFA, you find that what they really found was that CoolWebSearch (or, more accurately, one if its variants) sends sensitive information to a server. There is no information that they have uncovered a "massive ring" of people involved. They have contacted the FBI and they'll be responsible for finding those responsible.

    I did some research on CoolWebSearch (or "CWS") which is a pretty common spyware app, and it seems there are tons of variants. The majority of these apps are designed to get you to coolwebsearch.com in order to create affiliate money for the variant's creator - or at least that was the original idea. My guess is that only some of these variants capture privacy information.

    More information on CWS is available from:
    http://en.wikipedia.org/wiki/CoolWebSearch
    http://www.google.com/search?q=CoolWebSearch

    --
    The space unintentionally left unblank.
  2. CWS claimed "affiliates" do it... by Tuxedo+Jack · · Score: 4, Informative

    But they're basically commissioning it with their PPC search engine model.

    Also, if you've not read up on CWS and what they do - and how they do it - read this:

    http://merijn.org/cwschronicles.html

    Merijn's the original developer of CWShredder, and while his recording of CWS stops at the original about:blank strain, that's enough to tell you what kind of scum pull this.

    Disclaimer: I use CWShredder in my work on SpywareInfo's antispyware boards.

    --

    Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
  3. Re:Bound to happen eventually by CaptnMArk · · Score: 4, Informative

    LOL

    It is funny how many people run anti virus and anti spyware software to clean up the mess while viruses and spyware might be still running on their machines.

    The only correct procedure is to boot from CD (or other read-only media (or perhaps move the disk to another machine and being very careful not to run anything from it).

    Then you verify hashes of all non-data files with known good values (easier said than done).

    Handling messy file formats where code and data are mixed (word, excel and to some extent html) is problematic too.

    Of course, an OS that can be actually booted from CD and has a real packaging system makes this much easier.