Slashdot Mirror
A Look At the CoreFlood Botnet
CNet is running a story about research from security expert Joe Stewart into the CoreFlood botnet, which has harvested at least "50 gigabytes of compressed data, searchable in a MySQL database," from a group of over 370,000 bot IDs. Stewart explains how the botnet operates and some of the things he's learned about the group that operates it.
"Within the 50GB file, Stewart was able to discern how the thieves culled the data. He said they run a test script against that data that will log via a proxy into the bank using the credentials captured, say by a keylogging application. The CoreFlood script will then capture the HTML data on the post long-in page. In most cases, that page also contains the account's bank balance. They do that, he said, so that after running the test they have a picture of what are the highest dollar amounts. 'I don't know whether they steal from all of them. We don't have access to the accounts; the bank is not going to tell us how much was stolen out of any given account. We're not going to get that information, but we know they're actively logging and checking accounts to collect the balance data. The only reason (the script) can see that data is to target the biggest accounts first,' he said."
My Bank (HSBC) gives me a little keychain keygenerator that spits out a 6 digit number when I press the button. All logins must also have the key number... I wonder if this simple measure would stop dead any keylogger attacks like this, OR with enough reasonable time monitoring they could reverse engineer the generator's seeds?
This just makes me even more determined to never say "yes" to online banking. No good can come of it....
No sig today...
I wish i was criminally inclined - it must be fun getting that stuff up and running!
Botnets need to start logging something useful.
Like slashdot accounts with moderator points.
First I thought "so that's what he's going to do without George Bush in the Whitehouse" but then I realized it's Joe the Security Expert, not Jon the Daily Show host.
One-time-password generators protect against replay attacks, but they do not protect against modified transactions. If an attacker has root on your system, then he can simply escalate the keylogging attack to a live modification of the transaction data.
A better approach would be to use a class 3 card terminal. That's a small computer with a strictly defined purpose and specification (and therefore tremendously easier to secure). It has a display so that you can see the transaction that you authorize, without interference from software on a compromised PC, and it has a keypad so that you can enter the PIN and confirmation, without software on a compromised PC being able to capture any of it. These devices exist. The only reason they're not being used must be that the problem is currently not big enough to justify the cost of giving every customer a card terminal.
Anytime I read "it could happen to anybody" in a security article, I am always skeptical. I think "it could happen to any *average* computer user/net surfer" is a better adage.
Most here assembled, though not 100 percent immune, are far less susceptible than an "average" user to any sort of malware infection.
Ignorance is curable, stupid is forever.
Who says they're only taking from the rich accounts ?
I probably wouldn't notice a few cents missing from my account once a month, I bet there's several thousand other people who wouldn't either.
Wanna fight ? Bend over, stick your head up your ass, and fight for air.
You would either have to be a hopeless moralist or simply dull around the edges to not fun such an idea fun/interesting. Interest in criminal ideas no more makes you a criminal than interest in horror movies makes you a masochist, or someone harboring murderous intent. What a naive comment.
My bank (SEB Sweden) use a token from vasco,
Login works like this,
username: birthdate+personalnumber (something like social security number)
passwd: code generated by 2 numbers from the webpage punched into the token
when you are done and want to make you transaction i punch in 1 number from the webpage and the amount of the transfer, and get a number back to sign the transaction.
I believe this is pretty secure since you aprove that amount to be transfered and the amount is in the code i sign the transfer with. so its pretty hard to change amount and accounts that will receive the transfer.
My bank has the random 3 questions plus password authentication scheme (Royal Bank Securities - Canada). I'm always wondering about the lax security, and when my account might be compromised. I bet if the bank calculated their total loses due to online fraud; then assumed RSA style token based authentication would reduce that by a significant amount, then wouldn't it make financial sense for them...?
"The only reason (the script) can see that data is to target the biggest accounts first,' he said."
That depends on the objective and tactics of the attacker:
Although the obvious assumption is that the attacker wishes to gain as much money as possible with a minimal chance of being caught, it may be that (s)he is less greedy and/or more cautious.
Suppose that your target is a total of, say, $200K rather than the assumed multi-millions. You are far less likely to be caught or to trigger money-laundering precautions. In a case like this your best strategy might well be to go for above-average but not top 10% balances.
Similarly, if you ARE going for the maximum while still hoping your chance of being caught is low, it may well be worth steering clear of the very highest balances as they could be more closely monitored (and some of them are probably "honeypots").
I wish my bank used a keyfob. Do any banks with a large eastern USA presence use any "advanced" form of security?
I wonder if this simple measure would stop dead any keylogger attacks like this, OR with enough reasonable time monitoring they could reverse engineer the generator's seeds?
It's not useful for banks:
http://www.schneier.com/essay-083.html
It certainly raises the bar a bit, but either a man-in-the-middle attack, or a trojaned personal computer will null any benefits.
And remember that MITM attacks can be automated, so that the "man" doesn't even have to be human.
This solution already exists in the form of one-time security codes like the RSA SecurID range of products.
Basically it's a PRNG which spits out a number every few minutes which is unique to the customer.
Not it doesn't. A man-in-the-middle attack would circumvent the security:
http://www.schneier.com/essay-083.html
You think you're entering your SecurID token into the bank's web site, but you're actually entering it into a fake page, which then passes it along to your bank. Then when you think you've logged out, the attacker keeps the connection alive and transfers the money out.
I don't know if something like this would be possible or not, tell me what you think.
A proprietary interface that would be distributed by the bank when you open your account.
Each interface would have a distinct set of code in it, this would be different in each package-say for example half of a virus.
When somebody else attempts to do a man in the middle attack, or keylogging to access your account, they would be attacked by the other half of the virus.
It could do something like just shut their system down, or go to an extreme and perform a low level format.
Some people are only alive because it's against the law for me to hunt them down and kill them.
Actually, they probably weren't looking for the bank account with the most activity, but the account whose balance varied the most in a certain time period. It's probably a lot easier to steal money from an account whose balance is rapidly and continually changing than it is to steal money from an account whose balances is pretty much always the same -- missing money would be much more readily noticed in a "stagnant" account.
Anonymous is legion. CoreFlood is legion*s*.
Like in a legion of legion, legion^2.
So strong in numbers it is a force of nature, taking into account that it is competing with the Storm, or do they coexist nicely?
Is there any way to pit both networks against each other? I just hope it doesn't degrade into a bot-on-bot sin-fest, spawning little bot-nets into each and every single Internet in the web.
Alas, with what is known, could WE build this bot-net eating bot-net? I know it sounds dangerous but think of it like a fast car driven by a bad man, now replace the bad man with a cop :) totally gonna work.
At least Britons don't have to worry about securing their PC from these threats. Criminals simply read the account info from the surveillance main frames,
But... the future refused to change.
Now Xor that with something descriptive of your mom like LARGEBOVINE.
Last time I wanted to transfer 20 Euros using my bank's online website I had to enter the bank account of the recipient into my "digipass" (looks like a calculator, generating cryptographically secure hashes).
I then feed back 6 digits to the online bank's website.
Without having both:
- the physical device (the "digipass" as the bank calls it here)
- the PIN to power it up
- my login credentials
It is very difficult to defraud a single cent (should you try random 6-digits, your account would be locked out after a few tries).
A device that answers a challenge involving the account number of the recipient is "good game thieves".
Best of all ? Once you made a transaction to some account, subsequent money transfer to the same account are allowed as long as they're approximately of the same amount (so, no, you don't have to enter your brother's account number every time you send him a few bucks).
I simply don't understand why all banks are not switching to that scheme.
Which chapter of "Halting State" is that quoted from, again???
"You must try to forget all you have learned. You must begin to dream." -- Sherwood Anderson
Asking these security questions (that almost anyone could figure out from public data) won't stop the criminals, but it has locked me out of my own account more than once.
Favorite Aunt's name? I don't have a favorite aunt, and I didn't have that question entered in my password book, so I spent an hour trying every aunt I could think of including Aunt Em, Aunt Bea, Aunt Pearl, and Aunt Jemima. I had to wait until Monday to phone and have my questions reset, but then how do they check my identity on the phone? They ask the security questions, of course.