Largest Hacking Scam in Canadian History

vieux schnock writes "Police raided several homes across Quebec on Wednesday and arrested 16 people in their investigation, which they say uncovered the largest hacking scam in Canadian history. (...) The hackers collaborated online to attack and take control of as many as one million computers around the world that were not equipped with anti-virus software or firewalls."

Comments

Spot the key words

[Silver Sloth]

The hackers collaborated online to attack and take control of as many as one million computers around the world that were not equipped with anti-virus software or firewalls

Police won't reveal what the information was used for but investigators estimate that the network profited by as much as $45 million. Hmm... as many as, as much as, or maybe they're inflating the figures to show what macho investigators they are.

Re:Spot the key words

[powerlord]

Nah, nothing so covert. Its simply that, "as many as", sounds a lot better than, "three computers we know about, but we really have no clue" or "we found 5 million deposited in their bank accounts in the last month, but the accounts have been open for nine months, so who knows how much money they could have collected previously".

Alternatively they probably have a pretty good idea of the ranges involved, but hey, high numbers make a better press release.

Obligatory:

[powerlord]

Blame Canada! ... eh?

Re:Really?

[Brian Gordon]

Are you serious? There are hundreds of millions of PCs in the world (billions?), and the vast majority of them aren't properly secured. Also the vast majority of them have 10 smiley toolbars and take 45 minutes to boot.

Re:Really?

[PrescriptionWarning]

Yes, there are that many Windows machines on the internet.

Re:So which is it?

[Anonymous Coward]

It's 16 Canadian people, or 14 Americans... it's just the exchange rate.

Hardly the first time Canada has caused problems

[elrous0]

Let us not forget Bryan Adams.

Re:So which is it?

[Iphtashu Fitz]

Both.

16 people were arrested.

14 of those 16 were arrested on Wednesday.

Re:Really?

[TheRealMindChild]

It doesn't even really matter at this point. Let's be honest... the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe. It doesn't take much to write an application that would be able to run in a restricted user account... just connect outbound on port 80 for coordination, and for payload delivery. The code would be simple enough that you could change the binary significantly enough that the fingerprinting that virus scanners use are practically worthless.

That doesn't even address the vector of replacing the setup.exe (or equivalent) on, say, an Office 2003 cd posted on thepiratebay. Obviously, the install has to run as admin, so you pretty much know, you are a shoe in for a compromised machine for anyone who tries to install it. And again, it would be such a trivial, simple application, that you could change the attacking binary pretty much at will.

That summary needs fixing.

[Shados]

The hackers collaborated online to attack and take control of as many as one million computers around the world that were not up to date with patches and didn't have users with common sense.

There, thats better.

Re:That summary needs fixing.

[zakeria]

slight correction: The hackers collaborated online to attack and take control of as many as one million MS Windows computers around the world that were not up to date with patches and didn't have users with common sense.

Haha

[ViralInfection]

From the ages of 17-26.

Wouldn't you say the RCMP is just hunting down script kiddies?

Re:Haha

[necro2607]

You're joking, right? Younger people not only have more free time to pursue the motivation to hack & crack, but also tend to have more drive to do so, and less ethical reservations about doing so. You know how a lot of techie guys say "yeah, I used to be into that, but i grew out of it", well, that's generally the case with the vast majority of "hacker types" with malicious intent, except that a fair number of them actually pursue those motivations to a much further extent than others.

I used to hang out in chat rooms with guys who were developing their own exploits in C on netBSD machines they set up on their own, etc. etc.. (mid to late 90s).. They were all in their late teens, average of around 17 or 18 years old, no joke. There were a couple guys in college who were 20 or 21 or so, but really, the teens and early 20s is pretty much the prime time to delve into 'questionable' types of endeavours in the high-tech realm.

Oh, by the way, for a little personal anecdote, I cracked/hacked/obtained/whatever the admin password for our Mac lab in my elementary school when I was 9 years old, in grade 3 or 4 (and got banned from the lab for a while of course). Then again, I used utils I found on the net (a keylogger IIRC), but I still think that required a lot more knowledge and investigation than most 9 year olds are willing to pursue. Actually, I created a custom HyperCard stack that let me execute any program I had on a floppy disk - it just had to match the same type/creator code as any of the programs that were available in At Ease. That's pure hack-mindedness at work, and no outside help was consulted. ;)

Re:From TFA:

[Anonymous Coward]

I'd assume you're always authorized to use your own computer.

Then again, in today's climate, maybe not...

Re:Really?

[GreatBunzinni]

It doesn't even really matter at this point. Let's be honest... the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG or even PDF. Some security problems exist due to the user's ignorance or idiocy but "some" isn't exactly the same thing as "all".

The Unwritten Story...

[Panaqqa]

These arrests were in Quebec. What they are not telling us is that the arrests were REALLY for not hacking into the boxes using both official languages.

Re:Really?

[CarpetShark]

That doesn't even address the vector of replacing the setup.exe (or equivalent) on, say, an Office 2003 cd posted on thepiratebay.

Why stop there? Most of the Windows OS torrents are slipstreamed. There's no reason to assume they didn't slipstream a few viruses, bots, and backdoors in there too.

Re:Profitable

[calebt3]

they will probably server a couple years Someone needs more coffee.

Re:From TFA:

[morgan_greywolf]

I'd assume you're always authorized to use your own computer. Nope. There are times when I'm not authorized to use my own computer. Just ask my wife! ;)

Re:Really?

[Anne Thwacks]

the average computer user doesn't know the difference between U2-Somesong.mp3 and U2-SomeSong.exe.

The average user cannot tell there is a difference - because the Windows default is to hide the extension!

It may be criminally insane, but its the default.

Re:Hardly the first time Canada has caused problem

[i_ate_god]

As with a lot of our other trash, we simply shipped Celine Dion to America. Now she's your problem, enjoy.

Re:Really?

[Anonymous Coward]

There's a web of trust on the piratebay with trusted uploaders. Installing an OS or running a keygen from a newbie uploader is virtually guaranteeing you to get a trojan downloader. I've been playing around with a few of the torrents from the piratebay and installing them on a separate vlan at home. It's very enlightening watching all the network traffic when the compromised OS calls home. I am pretty sure this is one of the primary "seeding" vectors for the nu-war storm network. I weekly find new morphed storm clients using these trojan downloaders and I always submit them to virustotal.com.

Moral of the story: Only trrrrust the pirates with the green skull. Arrrr.

Re:Really?

[ultranova]

To make matters worse, some attacks may even occur if you are dealing with safe file types, like a PNG or even PDF.

There are no safe file types. All files can be viewed as programs meant to run in a specialized virtual machine (the program which is used to open them). For example, a PNG file is a program which, when run, will compute an array of bytes (the image pixels). The same goes to PDF. In this view, since all files are programs, it is in principle possible that any of them could contain code which can result in unexpected behavior of the virtual machine executing them.

Of course some file types are easier to compromize than others, either due to sheer complexity or ambiguity of the specification or because they are Turing complete. However, it is impossible to guarantee that every viewer for any file type is free of defects. Anyone still remember ANSI codes for DOS, which could be embedded to text to change color but also to set macros to keyboard keys when the file was viewed ? And of course SQL injection attacks are based on formatting a text string so it will cause unexpected results, not to mention causing a buffer overflow with an overlong string.

I repeat: there are no safe file types. They all have a potential to contain malicious code, because there is no such thing as data which is not also a program. From a certain point of view, GIMP is simply a very specialized compiler...

Not enough coffee again.

[ColdWetDog]

Murderers barely serve jail time up here. Don't hold your breath.

I read it as Moderators ...

For one brief second, I thought there was real justice Up There.

Time to crank the espresso machine up again.

Re:Really?

[ultranova]

Is a text file containing a single line of text followed by a carriage return a program?

It can be. For example:

'; ROLLBACK; UPDATE users SET admin = true WHERE username = 'ultranova'; '

If the virtual machine which handles the username field of Slashdot login form naively passed this string to the database layer without specifically quoting it, this text string would make my account an admin account; well, actually, since I haven't studied Slashdcode, it propably wouldn't, but the point still stands: even text is not an inherently safe data format in all circumstances.

How about the standard input device? When I type at the console keyboard, is that a program feeding into a "virtual machine" created by the console driver?

The virtual machine in this case would be whatever program receives the input. And yes, the text you type is indeed a program being executed by that machine; each time it receives a keypress from you, that keypress instructs it to do something, right ? Even if that something is merely to output the letter (altought a text editor would also store the input internally, of course). And that is what a program is: a list of instructions.

If not, why is a disk device different from another device?

It isn't.

The "$45 million" profit claim is highly unlikely

[Master of Transhuman]

This sounds like the usual inflation of profit that law enforcement agencies love to do.

Most of the large-scale botnet scams I've heard of don't yield anywhere near that kind of money. The botnet operators maybe pull down $3-10,000 a month renting out the botnets. Even large-scale identify theft rings are reaching for anything like $45 million.

Unless these guys were targeting rich people, I don't see it. And since most of the alleged compromised computers were in South America, I doubt they hit a lot of rich people.