Slashdot Mirror
"Crimeserver" Full of Personal/Business Data Found
Presto Vivace sends news of a server found by security firm Finjan that contained a 1.4-GB cache of stolen data, accumulated over a period of less than a month from compromised PCs around the world. The "crimeserver," as Finjan dubs it, "provided command and control functions for malware attacks in addition to being a drop site for data harvested from compromised computers. ... The stolen data consisted of 5,388 unique log files including 1,037 from Turkey, 621 from Germany, 571 from the United States, 322 from France, 308 from India and 232 from Britain." Oddly enough, the data was stored in the open, with not even basic auth to protect it. Finjan notes in their press release that this huge trove of data gathered over a short period of time indicates that the crimeware problem is far larger than most observers have been assuming. Update: 05/08 12:29 GMT by T : Note, the security firm involved is spelled "Finjan," not "Finjin" as originally shown.
Why would they need basic auth? After all, the security on the compromised computers was bad enough for them, complete random strangers to the owners of the PCs, to bypass system authentication and authorization controls to grab the data in the first place.
My blog
I know it's just a rehash of a press release, likely taken out of context from what was originally said, but - WTF?
I don't think that malware is so advanced that all you have to do is "use a toolkit" and poof - magically financial and personal data will just show up on the hard drive. Maybe the guy's server was pawned - he is at least acting like he doesn't know what he is doing, but come on.
If it's that easy, I'm gonna try it....
Faster! Faster! Faster would be better!
"The server was not secure at all. It indicates that these people that are doing the crime today, they are not security experts, they are not computer science experts." Uhhh....So someone knocks over a liquor store with a 9 mm. Does that mean that he's a gunsmith or a sharpshooter, or skilled in advanced war-fighting techniques of some kind? No...Chances are he's a just a guy with a gun. People use whatever they can to take what they want. Film at eleven.
No, it comes from people who use Microsoft products and can't be bothered to patch their systems, or in the best of cases are dumb enough to install that REALLY SUPER COOL SCREENSAVER!!!! that britaney3345@zuppahfiles.cc was kind enough to send to them.
Web2.0: I love when people Flickr my cuil and digg my boingboing until my google is reddit and I start to yahoo
5 dollars, do i hear 5 dollars
Why is Turkey at the top? I had not heard before that Turkey is a haven for unpatched machines. Maybe mainly a local or Kurdish crimeserver?
So they're not trying to help at all. What they're trying to do is sell their services and using this pseudo-news article to do it. Shame on them.
Please tag with "1downmillionstogo". A single server with 1.4GB of data is hardly newsworthy. Unless this "crimeserver" also contains the missing Whitehouse emails... in which case my only question is whether the torrent has been released yet.
Can you at least obfuscate my email address if you're going to be so rude as to post it publically? Plus the screensaver was really quite super cool.
'Thats they exact same thing a banana wrench monkey.'
Oddly enough, the data was stored in the open, with not even basic auth to protect it.
Sounds like they found a honeypot or a decoy to me. Now that the bad guys know that the good guys are on to them, they can disappear into the ether for a while until the heat dies down.
When our name is on the back of your car, we're behind you all the way!
Waiting for the headline:
"Thief robs liquor store in 255 lines of Haiku; no weapons involved. Story at 11."
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
Perhaps this data was intentionally left out in the open by whoever had it first?
If you think about it, if you just hacked into a users pc and nicked something (credit card info, passwords, whatever) and used them quietly to some degree, wouldn't you WANT someone else to use them, perhaps not so quietly? I mean, you want a fall guy right? Let the next script kiddie run through and take the fall. With a bit of luck, they will pin all the activity on the new guy rather than the guy who carefully used this once, then let the information loose on the masses.
It's not "accidentally" or "stupidly" left unprotected, it's a perfect smoke screen to cover tracks if you ask me.
Moved to http://soylentnews.org/. You are invited to join us too!
Is there any legitimate reason that screen savers in every single OS should not be 100% sandboxed? Is there even one OS that does sandbox the screen savers? Heck, there are not even that many screen savers that have a use for network access. You should have to explicitly authorize your sandboxed screen saver to have network access. As far as I know, every single OS is guilty of this security hole.
I think it's another "security" firm trying to make a name for itself..
See also: Storm "security" firms making wild exaggerations and this company selling products in the story itself..
5k "unique" logs isn't much of a "crimeserver" to me. Sounds like a script kiddie with a working toolkit, but if it contained 50k, 500k or 1 million unique hits, I would call it a crime server.
these guys are such press whores. you can google to find a ton of open drop sites like this. the fact that they bothered making ridiculous statistics and press release on something so common just shows how pathetic they are
The correct spelling is Finjan (not Finjin). The word means a small metal container in which Israelis (and Arabs) cook their coffee.
I'm too lazy to log in, but Microsoft products aren't the only thing vulnerable to such exploits. Linux "n00bs" don't know how to properly secure their boxes. Especially the "n00b" Ubuntu/Knoppix/Morphix users. They think just because it's Linux, it is secure out of the box, when in reality it just gives off a false sense of security. I'm not singling Ubuntu out, but it is the most easily recognized distro, and when most non-tech-savvy people hear "Linux", they think "Ubuntu" so that's why I used it in my analogy. If you even want to call it that.
Yeah, I know it's somewhat off-topic but just blaming Microsoft and Microsoft alone gets on my nerves.
Science advances one funeral at a time- Max Planck
Unless the criminal is a complete idiot there's more than one drop spot...
/var/log/maillog on my servers would certainly reveal "business-related email communications" in the sense of senders and recipients. Mail logs might also contain some entries for mail between providers and patients or between banks and their customers. Apache logs wouldn't be so useful, though they do contain the usernames when Basic Authentication is used. But none of those logs would reveal much about the content of those communications. I don't know anything about Outlook so I have no idea how its logs might reveal "captured Outlook accounts containing email communication."
Indeed. If I were writing botnet software I'd distribute multiple copies of the collected data across a number of the compromised computers. The press release and article abstract indicate that the botnet control programs and the data were located in the same place. That doesn't seem like a particularly good architecture for this type of system. I'd keep the command programs far away from the harvested data. My hunch is that the data aren't that valuable as I outline below.
I can accept that buying, installing and running a botnet could be as easy as installing an RPM. What appears more disturbing is the reported "timeframe of less than a month" to harvest over 5,000 records. But what kind of records are these? Finjan tells us that the data "consisted of 5,388 unique log files [my emphasis]. Both email communications and web-related data were among them."
They go on to list some specific examples:
Compromised patient data
Compromised bank customer data
Business-related email communications
Captured Outlook accounts containing email communication
I'd be curious to see how much actual "patient" or "bank customer" data is revealed in "log files."
Still if all they got after a month were logs, I'm not sure how valuable they would be unless the goal was harvesting addresses for spamming or phishing. Capturing the logs of compromised mail servers would certainly yield a pretty high proportion of legitimate addresses, especially recipient addresses. This method seems especially attractive if you're trying to identify targets for "spear-phishing." If you can compromise some corporate mail servers, you can build up a nice list to "spear."
So I'm guessing Finjan found a machine containing some 5,600 mail server "log files" totalling 1.4 GB. Since the logs are worthless once the addresses are harvested, protecting them isn't much of a priority. I suppose competitive spammers might want to keep these potentially higher-yielding names to themselves, but given the volumes at which spammers operate, they probably don't care.
I think I'll go take a look at my mail servers now just to ease my mind.
1 hard drive doesn't make for a very impressive visual aid.
this huge trove of data gathered over a short period of time indicates that the crimeware problem is far larger than most observers have been assuming.
Maybe so - but conversely they may not be able to use all of it (at least for time-limited things like credit cards) before it's expired, making me happy that they have lots of data, because when (not if) my data gets stolen from somewhere, I'm less likely to be one of those exploited. Whee.
Gee what gripping news of cutting-edge malware research; I found one of these, of similar size, two years ago. The FTP credentials were in plain text in a config file dropped by the malware. It was childs play getting in and getting enough info for authorities to do something about it. Shortly after that it disappeared. It was created by stupid people who were playing with things they didn't really understand, although I'm sure they understood the $$$. I remember thinking at the time "this would be cool if it wasn't so boringly easy". How wrong I was! Should have cranked up the PR machine and posted it to slashdot!
I never understood why they didn't put in some sort of interpreter and make SCR files some kind of bytecode that can only display graphics data. SCR files are a HUGE vector of malware infection because of the absolutely insane design they used.
Just to short cut the 'Screensavers need network access! I want my Flickr photos to display...or my Weather data to display', etc., IT IS A SCREEN SAVER. It's purpose is to secure and protect your computer and screen when you aren't using it. WTF are you doing sitting there staring at your screensaver? Good pot?
Reduce, reuse, cycle
I agree, and also believe that any true malware writer will also incorporate ...and the download time would be minimal.
p2p torrent download technology so that a file of 1.4 gb. can be shared by all
child nodes within a network if so chose to
Therefor, a botnet with 1000 pcs...could easily host a few hundred copies...
The vmslice.c exploit was the most impressive that I have seen. Instant root access from a little executable.
Vintage computer adverts: http://www.vintageadbrowser.com/computers-and-software-ads
You are assuming that the discovered log files are logs copied verbatim from the victim machines. It is more likely that these are logs of collected data (e.g., keystrokes, mouse clicks, screen snapshots, actual emails) captured using spyware or keyloggers.
If that is the case (and the story does not make it clear), then such logs certainly contain credentials and other identifying information to allow anyone to access bank accounts, private patient data, and so on.
You need to install an RTFM interface.
> a server found by security firm Finjin that contained a 1.4-GB cache of
> stolen data, accumulated over a period of less than a month from
> compromised PCs around the world. The "crimeserver," as Finjin dubs it,
> "provided command and control functions for malware attacks in addition
> to being a drop site for data harvested from compromised computers..."
Fucking Morpheus! Can't the feds ever stop this guy?!?!?
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Simply give me as many search terms as you can think of, and I'll let you know. Examples: Your name. SSN. Bank Account Routing and Transit numbers. Mother's Maiden Name. Any other search terms that you want me to search for.
Actually, the log files refer to the logs sent by infected machines. These logs contain keylogged data that correspond to forms posted through IE and Firefox, as well as "datastore" information (credentials cached by IE, Outlook, and FFox).
This means that the 1.4Gb of data, while containing some less useful information, is much more valuable than you have indicated above...
Having said that, and realizing that this data is not just a mail/http log file, one can really start to grasp the true meaning of such a criminally operated server.
how do i got crimeserver?