Slashdot Mirror
A Look At the CoreFlood Botnet
CNet is running a story about research from security expert Joe Stewart into the CoreFlood botnet, which has harvested at least "50 gigabytes of compressed data, searchable in a MySQL database," from a group of over 370,000 bot IDs. Stewart explains how the botnet operates and some of the things he's learned about the group that operates it.
"Within the 50GB file, Stewart was able to discern how the thieves culled the data. He said they run a test script against that data that will log via a proxy into the bank using the credentials captured, say by a keylogging application. The CoreFlood script will then capture the HTML data on the post long-in page. In most cases, that page also contains the account's bank balance. They do that, he said, so that after running the test they have a picture of what are the highest dollar amounts. 'I don't know whether they steal from all of them. We don't have access to the accounts; the bank is not going to tell us how much was stolen out of any given account. We're not going to get that information, but we know they're actively logging and checking accounts to collect the balance data. The only reason (the script) can see that data is to target the biggest accounts first,' he said."
My Bank (HSBC) gives me a little keychain keygenerator that spits out a 6 digit number when I press the button. All logins must also have the key number... I wonder if this simple measure would stop dead any keylogger attacks like this, OR with enough reasonable time monitoring they could reverse engineer the generator's seeds?
You must be criminally inclined if you think setting up a system to steal from others would be fun.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
In Germany, any money transaction requires you to enter something called an iTAN number. These number are mailed to you, so even if some hacker was able to gain access to your account online, no transfers can be made because they won't have the iTAN numbers. Unless you're dumb enough to scan these numbers and store them in your computer. It's a little bit of a pain in the ass, but after reading this article, I'm glad that this system exists.
Maybe just technically interested. Writing and setting up a botnet like this one withing the limitations inherent to something that's illegal sounds like an interesting challenge.
"DRM is like the Ford Pinto: it's a smooth ride, right up the point at which it explodes and ruins your day."-C.Doctorow
Or, like in my bank, they send me authorization code with sms, stating which operation is it and how much is it and account number to which money goes. It's much cheaper.
Extreme Programming - Redundant Array of Inexpensive Developers
My bank (SEB Sweden) use a token from vasco,
Login works like this,
username: birthdate+personalnumber (something like social security number)
passwd: code generated by 2 numbers from the webpage punched into the token
when you are done and want to make you transaction i punch in 1 number from the webpage and the amount of the transfer, and get a number back to sign the transaction.
I believe this is pretty secure since you aprove that amount to be transfered and the amount is in the code i sign the transfer with. so its pretty hard to change amount and accounts that will receive the transfer.
"The only reason (the script) can see that data is to target the biggest accounts first,' he said."
That depends on the objective and tactics of the attacker:
Although the obvious assumption is that the attacker wishes to gain as much money as possible with a minimal chance of being caught, it may be that (s)he is less greedy and/or more cautious.
Suppose that your target is a total of, say, $200K rather than the assumed multi-millions. You are far less likely to be caught or to trigger money-laundering precautions. In a case like this your best strategy might well be to go for above-average but not top 10% balances.
Similarly, if you ARE going for the maximum while still hoping your chance of being caught is low, it may well be worth steering clear of the very highest balances as they could be more closely monitored (and some of them are probably "honeypots").