Slashdot Mirror
Spyware Based ID Theft Ring Uncovered
phaedo00 wrote to mention an Ars Technica article discussing a massive identity theft ring uncovered by security software firm Sunbelt. From the article:"According to one of their employees, Alex Eckelberry, during the course of one of their recent investigations into a particular Spyware application--rumored to be called CoolWebSearch--they've discovered that the personal information of those 'infected' was being captured and uploaded to a server."
If you RTFA, you find that what they really found was that CoolWebSearch (or, more accurately, one if its variants) sends sensitive information to a server. There is no information that they have uncovered a "massive ring" of people involved. They have contacted the FBI and they'll be responsible for finding those responsible.
I did some research on CoolWebSearch (or "CWS") which is a pretty common spyware app, and it seems there are tons of variants. The majority of these apps are designed to get you to coolwebsearch.com in order to create affiliate money for the variant's creator - or at least that was the original idea. My guess is that only some of these variants capture privacy information.
More information on CWS is available from:
http://en.wikipedia.org/wiki/CoolWebSearch
http://www.google.com/search?q=CoolWebSearch
The space unintentionally left unblank.
But they're basically commissioning it with their PPC search engine model.
Also, if you've not read up on CWS and what they do - and how they do it - read this:
http://merijn.org/cwschronicles.html
Merijn's the original developer of CWShredder, and while his recording of CWS stops at the original about:blank strain, that's enough to tell you what kind of scum pull this.
Disclaimer: I use CWShredder in my work on SpywareInfo's antispyware boards.
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
How can it be called ID Theft if the original owner still has his identity?
You're right. It sounds more like ID Piracy arr arr...! That's good, everyone knows the penalties for piracy are much steeper than those for theft...(ducking).
Seven puppies were harmed during the making of this post.
LOL
It is funny how many people run anti virus and anti spyware software to clean up the mess while viruses and spyware might be still running on their machines.
The only correct procedure is to boot from CD (or other read-only media (or perhaps move the disk to another machine and being very careful not to run anything from it).
Then you verify hashes of all non-data files with known good values (easier said than done).
Handling messy file formats where code and data are mixed (word, excel and to some extent html) is problematic too.
Of course, an OS that can be actually booted from CD and has a real packaging system makes this much easier.
Quite apart from the issue of identity theft.. the installation of the software itself is done illegally according to the laws of most countries. Silent drive-by downloads constitute unauthorised access.
HOWEVER.. CoolWebSearch have claimed in the past that these silent drive-by installations were the work of "affiliates" and not CoolWebSearch itself. Personally, I have always suspected that the affiliates were working in this way with the tacit approval of CoolWebSearch.
It's about time somebody got sent to jail for a LONG time for this kind of crap.
Never email donotemail@WeAreSpammers.com
And posted about a network of sites I found over a year ago on news.admin.net-abuse.email when looking at a Scientology management company I notice that someone tossed a cancel at my post within a day. (By coincidence, Sunbelt Software is up to its eyebrows in Scientology too.)
One line blog. I hear that they're called Twitters now.
Hi, I'm the author of the Ars article and the submitter of this story, Alex from sunbelt got back to me with a bit more information:
Basically, it went like this:
Patrick Jordan, our CoolWebSearch expert, was doing research on a CWS exploit. During the course of the research, he disovered that a) the machine he was testing became a spam zombie and b) it send a call back to a remote server. He traced back the remote server and found what you have heard about.
The scale is unimaginable. There are thousands of machines pinging back in a day. There is a keylogger file that grows and grows, and then is zipped off and then the cycle continues again.
It is sophisticated. There are nifty little PHP scripts that help the criminals get reports. There is a special upload area.
It's really quite sucktastic.
Downloaded on my Mac, burned to CD, installed on the ThinkPad. Next question.
"Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."