Slashdot Mirror
A Look At the CoreFlood Botnet
CNet is running a story about research from security expert Joe Stewart into the CoreFlood botnet, which has harvested at least "50 gigabytes of compressed data, searchable in a MySQL database," from a group of over 370,000 bot IDs. Stewart explains how the botnet operates and some of the things he's learned about the group that operates it.
"Within the 50GB file, Stewart was able to discern how the thieves culled the data. He said they run a test script against that data that will log via a proxy into the bank using the credentials captured, say by a keylogging application. The CoreFlood script will then capture the HTML data on the post long-in page. In most cases, that page also contains the account's bank balance. They do that, he said, so that after running the test they have a picture of what are the highest dollar amounts. 'I don't know whether they steal from all of them. We don't have access to the accounts; the bank is not going to tell us how much was stolen out of any given account. We're not going to get that information, but we know they're actively logging and checking accounts to collect the balance data. The only reason (the script) can see that data is to target the biggest accounts first,' he said."
My Bank (HSBC) gives me a little keychain keygenerator that spits out a 6 digit number when I press the button. All logins must also have the key number... I wonder if this simple measure would stop dead any keylogger attacks like this, OR with enough reasonable time monitoring they could reverse engineer the generator's seeds?
Botnets need to start logging something useful.
Like slashdot accounts with moderator points.
You must be criminally inclined if you think setting up a system to steal from others would be fun.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
First I thought "so that's what he's going to do without George Bush in the Whitehouse" but then I realized it's Joe the Security Expert, not Jon the Daily Show host.
One-time-password generators protect against replay attacks, but they do not protect against modified transactions. If an attacker has root on your system, then he can simply escalate the keylogging attack to a live modification of the transaction data.
A better approach would be to use a class 3 card terminal. That's a small computer with a strictly defined purpose and specification (and therefore tremendously easier to secure). It has a display so that you can see the transaction that you authorize, without interference from software on a compromised PC, and it has a keypad so that you can enter the PIN and confirmation, without software on a compromised PC being able to capture any of it. These devices exist. The only reason they're not being used must be that the problem is currently not big enough to justify the cost of giving every customer a card terminal.
Good god man! Presumably you get around by horse and cart? I mean, that petrol engine is very convenient and all, but think of the risk of explosion...
In Germany, any money transaction requires you to enter something called an iTAN number. These number are mailed to you, so even if some hacker was able to gain access to your account online, no transfers can be made because they won't have the iTAN numbers. Unless you're dumb enough to scan these numbers and store them in your computer. It's a little bit of a pain in the ass, but after reading this article, I'm glad that this system exists.
Umm, no. Playing Civilization on computer can be fun even if you are not inclined being a dictator or conqueror.
Maybe just technically interested. Writing and setting up a botnet like this one withing the limitations inherent to something that's illegal sounds like an interesting challenge.
"DRM is like the Ford Pinto: it's a smooth ride, right up the point at which it explodes and ruins your day."-C.Doctorow
Likewise in Finland. Single-use random 4-digit ids. We've had them for 15 years or more. (So in the early 90s, Finnish banks were more security conscious than most modern-day US or UK banks.)
Also FatPhil on SoylentNews, id 863
Anytime I read "it could happen to anybody" in a security article, I am always skeptical. I think "it could happen to any *average* computer user/net surfer" is a better adage.
Most here assembled, though not 100 percent immune, are far less susceptible than an "average" user to any sort of malware infection.
Ignorance is curable, stupid is forever.
You would either have to be a hopeless moralist or simply dull around the edges to not fun such an idea fun/interesting. Interest in criminal ideas no more makes you a criminal than interest in horror movies makes you a masochist, or someone harboring murderous intent. What a naive comment.
Yes, they are, like any other OTP system. Moreover, some banks also allow you to click in the numbers with a mouse by providing a keypad image. If you feel paranoid about key loggers, just use the mouse. But the real security is, of course, the one-time nature of those numbers.
cpghost at Cordula's Web.
"The only reason (the script) can see that data is to target the biggest accounts first,' he said."
That depends on the objective and tactics of the attacker:
Although the obvious assumption is that the attacker wishes to gain as much money as possible with a minimal chance of being caught, it may be that (s)he is less greedy and/or more cautious.
Suppose that your target is a total of, say, $200K rather than the assumed multi-millions. You are far less likely to be caught or to trigger money-laundering precautions. In a case like this your best strategy might well be to go for above-average but not top 10% balances.
Similarly, if you ARE going for the maximum while still hoping your chance of being caught is low, it may well be worth steering clear of the very highest balances as they could be more closely monitored (and some of them are probably "honeypots").