Slashdot Mirror
Tracking the Password Thieves
wiredog writes "From The Washington Post, yet another story about phishers, keyloggers, and viruses. The story is nothing new, but the author has a blog where he describes how he gathered the information that went into the story. Information including the locations of the victims, and the ISPs likeliest to be hit.
Some of the victims included "an engineer for the Architect of the Capitol" and a man who "works in computer security for IBM." One victim "was fresh out of college, where he'd just earned a degree in information security. (He was actively looking for a job in the field; I suggested he may want to go back to the classroom.)" A compromised machine was also found in "the new accounts department at Bank of America" (Score!)"
Comcast!
God: When you do things right, people won't be sure you've done anything at all.
Tags != Comments, and -1 (Troll) != -1 (I Would Respond Angrily To This Poster So They Must Be Trolling)
That chart simply looks like a demographic on the amount of users currently using those ISPs. As with spyware, it makes sense of course that the biggest population will be hit the hardest. That's effectively why alternative operating systems are impenetrable to virii and other nasty things. They aren't looked at by the majority of the 'bad people' out there. :P
127.0.0.1
I doubt it's the ISPs' fault; looking at the list it seems plausible that the "most likely" to be hit are simply the largest ISPs, so you'd expect the largest numbers of affected users to be using those ISPs.
Besides, if 2 supposed "network security" people got hit, do the ISPs really have any hope whatsoever in trying to educate their users to avoid phishing?
Don't blame me; I'm never given mod points.
"Likeliest to be hit" is a mislable. It should read "ISP's inept users" who allow themselves to become vunerable due to ignorance or carelessness.
This isn't some war between ISPs. The graph shows clearly what ISP had the most victims due to this virii. But even that isnt conclusive of anything because of the quantity of overall customers isnt revealed. Yeh sure we can say Comcast has the most, but they surely have more customers overall than say, oh Qwest.
It would appear that nobody in South Dakota has an identity worth stealing. That's gotta hurt your pride.
Only two things are infinite, the universe and human stupidity, and I'm not entirely sure about the universe - Einstein
Interesting how AOL is at the bottom of the list of ISPs likeliest to be hit. Who would have thought.
If you want news from today, you have to come back tomorrow.
Charts are nice and all, but I would life to see more work done to prevent this. Or perhaps, don't let idiots use the computer (computer license). It's the only way! The biggest security hole in computers isn't the computer, but the user. :(
"ATI cards are like buses...They're huge, red and have bad drivers."
While the above information in the article and above links is interesting, and you can sure feel for the victims, I'd be more interested in knowing what the individuals were or were not doing that allowed the viruses/hackers/keyloggers on the systems. Do these individuals/corporations not run behind a firewall? port blocker? run anti-virus software? run anti-spyware?
I'm not the end-all-be-all security expert, but when I help individuals set up a 'net connection, I make sure all firewalls are on (or the router they are using only allows the necessary ports needed for operations to be forwarded into the network). I setup free anti-virus and free anti-spyware as well. Are these places doing the same? Or do most of you guys [read: slashdot-readers] find that in general they don't?
I have never let my schooling interfere with my education.
"Likeliest" is a perfectly cromulent word.
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
Slashdot Burying Stories About Slashdot Media Owned
I suggested that one of my relatives look into computer security as a career.
/.ers on a good school for studying this?
Any recommendations from
Because college creates people who are perfectly skilled at a certain field...
Modern copyright is theft of culture from everyone and it retards the progress of the useful arts and sciences.
Besides, there is a way that ISPs can fight phishing: aggressive takedowns the of fake sites used by phishers to extract information from those folks who don't see the problem with giving their SSN to "paypall.com" and the like. I'm not informed about their current vigor in this regard, though, and would appreciate feedback from those in the know.
*Please note: I certainly believe that primary responsibility for avoiding phishing scams belongs to the consumer. I think, however, that a clever team of lawyers could convince a jury otherwise.
Tags != Comments, and -1 (Troll) != -1 (I Would Respond Angrily To This Poster So They Must Be Trolling)
The corps that are targeted for login credentials should poison the phishers lists while they are waiting for the phishers ISP to take them down.
When the poison credentials are used by the phisher the targeted corp should use their source ip and browser fingerprints help identify other compromised accounts logged in from the same source. Places like banks and pay-pal could also this information to freeze compromised accounts more quickly.
Who the one guy in Southwest Utah is. My Dad lives there...
Best Slashdot Co
I'm not so sure that what you are saying is true. I'll give you a little story. I run comcast cable at home and I setup a web server without any advertisement whatsoever. It was on port 80 so it was publicly accessible via a standard port 80 search or whatever, however, like I said, it was not advertised. I'd get either hackers or bots or whatever they were going through a list of common exploit commands on my server every single day when I'd look at the logs. Now, my web server was customized and for specific purposes, so none of these commands worked and eventually I customized it to deny access to these individuals and give them a "connection reset" return message, however, it shows what a target you are just for being on comcast's service.
People know the IP ranges. If it's zombie botnets, then there are a lot of computers on comcast that are already zombies looking to exploit you. So this puts you more at risk than being on any other ISP IMO, even if you do know what you are doing. I'd get a huge list on a daily basis of these people, they were most likely unique because some of them actually browsed the webpages when it was publicly accessible. 20-30 unique attempts a day to try to exploit a webserver that's completely advertised to the known public, I'd consider that pretty significant.
Also, email. I believe that spam networks and phishing networks target comcast users exclusively and continue to target them after getting a response back from the server that the mailbox is valid or whatever. A lot of email spam that I get isn't the result of signing up for anything, but instead a CC that also extends to a lot of other comcast subscribers. The list is usually hundreds of people long on each mailing. So somehow they are able to wholesale get the email addresses of comcast subscribers, whether it's through brute force or comcast hands them out I don't know and couldn't prove either way. But again, you are more of a target on comcast in this manner. An unsuspecting customer could easily be foiled by one of these phishing attempts and some of them look very official to the unknowing eye. Don't underestimate the guile and cunning of these snakes that lurk on the Internet to prey on their victims and don't cast the victims off as some unknowing bunch of nitwits who simply don't take basic security measures, the problem is bigger than it seems.
Judges and senates have been bought for gold; Esteem and love were never to be sold.
But "which are most likely" seems a bit stilted. For a /. write-up, that approaches the "and then there's Albania" style of writing.
Best Slashdot Co
"...a hidden software virus that recorded his every keystroke."
Yeah I know, everybody files all malware under 'virus'; but since the article comes off as somewhat technical it would be nice if this detail was correct. Keyloggers are almost always* trojans, not a viruses.
*The only reason I say "almost always" is because it would technically be possible to put keylogging functionality in a virus.
let's use proper diction here..
i'm getting really tired of everything under the sun being called "theft". It just allows certain other interest groups to keep implying greater moral bankruptcy than actually exists.
a more proper term would be "fraud".
VLC FOR MAC IS DYING! IF YOU DEVELOP, PLEASE SAVE IT!!
Windows has a specific security model designed and implemented by Microsoft.
Microsoft's choices have been disparaged by security professionals for YEARS because they violate the BASIC rules of security.
Ubuntu follows the basic rules far better than Windows. Ubuntu is far more secure than Windows.
There are different categories of threats and each category requires different security procedures. It's not that complicated. Just because Microsoft chose "user friendly" over security does not mean that security does not exist outside of Microsoft products.
That's effectively why alternative operating systems are impenetrable to virii and other nasty things.
No, no no no. Did you not intend:
That's why alternative operating systems are effectively impenetrable to virii and other nasty things.
The words of ordering make a difference!
I went to school with people who proved that you can do a college course and PASS without ever learning a single darn thing. Having a diploma or a degree is not always the best measure of knowledge in a particular field.
Thomas A. Knight
Author of The Time Weaver
A large percentage of those phishing sites are hijacked computers, themselves. Aggressive takedowns means educating sysadmins about securing their (mostly Windows) servers against attack.
Want to know how to really stop phishing? Make it unprofitable. Since it would take a decent amount of time to set up a server to provide phishers with data, it's an invetment. Thus, unlike spam zombies, they can't move from machine to machine as quickly, and generally, the site is discovered and shut down long before they abandon it. Exploiting this weakness is the key to stopping phishing and the people who perpetrate it.
When you spot a phishing site, there should be a team of phishing investigators that go to the hacked server, examine it carefully (without disabling it) and add a traffic mangler that makes most of the information bogus, but leaves the credit card numbers intact, recording them as it does so. Contact the owners of the cards immediately and tell them that they must stop using the cards because their numbers have been stolen. Then, flag the cards as stolen. That way, when the phisher swipes a fake card with the stolen number, the register displays the words "Stolen card. Call Police."
If this were consistently the response to phishing compromise of servers, the people who do this would quickly find themselves behind bars, and phishing would drop significantly. In particular, it would decimate the U.S. phishing servers, which make up the bulk of the phishing servers at last survey. Some phishing would remain on overseas servers, but at least this would diminish the problem significantly.
Check out my sci-fi/humor trilogy at PatriotsBooks.
something like a java real time hack respects no particular OS, assuming it has the ability to speak back to the internet.
if this is supposed to be a new economy, how come they still want my old fashioned money?
You might still start to get spam, if someone on your list has a compromised address list or computer.
I've often thought of generating some kind of unique e-mail address for each of my friends, to detect if my e-mail address has been compromised by them (or their PC). e.g:
asdf2344ks@gmail.com for my emails to Tom
oieo116i2k@gmail.com for my emails to Liz
The idea is they reply to that address, and mail to these addresses would aggregate to my inbox. If one of those email addresses starts to get spammed, I'll have an idea of who's responsible, change the address for them and see if it continues. After it happening a couple of times I could inform them that they may have a compromised computer and help them out etc.
I just dont have the time to implement such a scheme and rely on Gmails spam filtering which i think is pretty good.
That machine is probably secure unless the phisher speaks Spanish.
Well DUH! Of course it is.
We have this thing called "The Internet" now which means that machines can be scanned and cracked 24/7.
Hmmm, I guess that the sales or McAfee and Norton anti-virus are not real then.
Outside of the United States (at least according to the maps.)
One ring to bind them - should probably have more fiber and less rings in their diet.
Taking my money without permission is theft. T-H-E-F-T
"I've often thought of generating some kind of unique e-mail address for each of my friends, to detect if my e-mail address has been compromised by them (or their PC). e.g:
asdf2344ks@gmail.com for my emails to Tom oieo116i2k@gmail.com for my emails to Liz"
This service already exists. It's been around for a while. It's free. You only need to remember a chunk of your username, and make up the rest (instead of making up the rest of the name, I use the name of the actual site I leave my information with). I use it for every web site I'm forced to register with. It has a number of other domain names in case you don't like the spamgourmet name. Plus, it has a number of other cool features -- if you desire to delve more into it. And it's also open source, so you can easily install it on your own server and modify its functionality to your hearts content.
http://www.spamgourmet.com/
I want preinstalled NOTHING. That is it, just nothing. No windows, no shovelware, no headaches and no anoyances of paying for crap I don't want, and won't use. Just give me the option to have a empty hard drive ON ALL MODELS.
Seems simple enought to me. Then you can install what you like on it. I am sick of buying a new copy of a OS I already own again and again just to feed the MS machine.