Slashdot Mirror
PC Invader Costs a Kentucky County $415,000
plover recommends a detailed account by Brian Krebs in the Washington Post's Security Fix column of a complex hack and con job resulting in the theft of $415,000 from Bullitt County, Kentucky. "The crooks were aided by more than two dozen co-conspirators in the United States, as well as a strain of malicious software capable of defeating online security measures put in place by many banks. ...the trouble began on June 22, when someone started making unauthorized wire transfers of $10,000 or less from the county's payroll to accounts belonging to at least 25 individuals around the country... [T]he criminals stole the money using a custom variant of a keystroke logging Trojan known as 'Zeus' (a.k.a. 'Zbot') that included two new features. The first is that stolen credentials are sent immediately via instant message to the attackers. But the second, more interesting feature of this malware... is that it creates a direct connection between the infected Microsoft Windows system and the attackers, allowing the bad guys to log in to the victim's bank account using the victim's own Internet connection."
Don't forget to include this in your Windows TCO calculations.
Cory Doctorow talking about cloud computing makes as much sense as George W Bush talking about electrical engineering.
They set up a system that required multiple credentials to transfer money, but one of those credentials could be used to reset the other? Give me a break! This was a system deliberately setup to look more secure than it actually was. The Controller was relying on that extra protection the bank was offering. It seems the county was scammed twice!
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
Yes, I am a pedantic Grammar Nazi, and I anticipate a great modding down of this comment, but my need to say this is worse than any addict's craving for his next fix. There are few things I hate more than redundant words. "Co-conspirator" is about as redundant as it gets. A conspiracy is a group of people. People conspire to do something like this, and you call those people conspirators. What happens in a hundred years when we forget that "co-conspirator" was being used this way? Do we start saying "co-co-conspirator"?
Admit it. You post strawman arguments as AC so you get modded Insightful for refuting them, rather than Troll
Find out if the bank manger smokes, or his/her sectary smokes. Note when they go for a smoke and where. Get a few of those USB thumb drives from trade shows and lace them with trojans and place them near the smokers outside break area and wait for them to pick it up and place them back in their machines when they get back inside. Because usually they will just to see what was on the drive.
"The problem with socialism is eventually you run out of other people's money" - Thatcher.
I find it hilarious that basic TCP/IP networking stuff gets labeled as "interesting". Any idiot can initiate a connection to a host on the internet.
What's "interesting" is that the victim's machine was not firewalled to prevent this sort of thing from happening in the first place. Properly controlling outgoing traffic is of crucial importance, particularly when dealing with such sensitive information. A locked down network should be able to contain unknown connections from within, just as well as those from the great wide internet.
In my opinion, it's not the invader that cost Kentucky $415,000. The fault rests entirely on their network administrator(s).
-Billco, Fnarg.com
If you go with the normal route, and the normal route gets hacked, you won't be blamed.
If you setup a server on a system that your boss hasn't heard of, and you get hacked, you're fired.
The chances of the former are much greater in a lot of ways. But the risk to your job is basically zero. Whereas in the second way, you're fired because you decided to use that silly deamon thing instead of proper, professional, Enterprise-Ready (tm) Windows 7.
The ______ Agenda
Everyone who is claiming that linux should be used and its those stupid MS users that cause this are missing the point and have never spent one second working in a corporate IT enviroment. The fact is that every single security measure that is put in place is met with overwhelming opposition by the user base as well as the executives. A spam filter is looked at as the unholy antichrist because it blocks .00001% of legitimate emails. I have worked corporated IT for years and have constantly had to fight for just the basic's in security. IT is not given the authority to do its job. I am sure there is some IT guy that worked for the county that is now unemployed because he didnt stop it, even though he has been banging his head againest the wall to get security measures put in place.
I for one am tired of hearing that the answer is Linux. Sh*& I cant even upgrade to Office 2007 without getting hundreds of phone calls from users that cant find the print button. You want me to switch them to linux? That is just comical. Rather than constantly blaming the victim we need to get tough on the criminals. If somone is mugged you dont tell them that they should not have walked down the street. You go after the guys that mugged them. You dont tell the convienence store owner that he was robbed because he was open and should not let people enter the store. This stops when we get tough on the criminals and the governments that allow them operate free from risk. How long do you think it would take these countries to stop this if we cut off all trade and aid to them? The fact is that cybercrime is not looked at as real crime. Until we start caring more about it and electing people who understand the risks it wont matter what system is in place, it will be exploited.
Well, almost everyone is using Apache, yet the most hacked webserver is IIS.
You are so wrong, it's not even funny
Avoid the MS tax, always buy I.B.M. PC's (I Built-it Myself)
Idiots live everywhere (and keep in mind the plural of 'anecdote' isn't 'data'.) It might be that Kentucky has less money than other states, but I wouldn't say they're correspondingly "dumber" than other states.
Also, isn't that the same state that moron senator X is from?
That pretty much describes all 50 states.
John
When will online bank understand that the only 100% foolproof method is to mandate the presence of a hardware device on the user's side and to make the bank account number of the recipient you want to transfer the money to part of a cryptographic challenge?
That is 100% foolproof. You ain't wiring money to an account whose number hasn't been entered on the hardware device (say some www.vasco.com device). Full stop.
Some lowlife hacks my Windows (I'm not using for my online bank's website works fine under Linux) and intercepts in realtime my opened connection to my bank's website? OK, it's bad, the lowlife can see how much I have on my account. But making a transfer? How's the low-life going to generate the token validating another low-life's bank account without the hardware device... Good luck with that low-life.
There are already several banks in Europe where it works like that... It only takes a few more low-lifes to succeed stealing petty amounts like in TFA and banks shall start implement this everywhere.
Then it's "GG low-lifes"
> Every year I've read about it, the order from first to last compromised has been Windows, Mac, and Linux.
Which year? And which pwn2own contest are you talking about?
In 2006, there was no pwn to own cansecwest contest. ;).
In 2007, it was mac first, but only macs were prizes
In 2008, it was mac first again (out of OSX, Ubuntu and Vista) on day 2 (nobody managed to pwn anything under the day one rules), and vista only on day 3 (due to adobe flash exploit).
http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture?info=EXLINK
Day 1 rules = remote exploit - no user interaction
Day 2 rules = default client apps
Day 3 rules = popular 3rd party apps.
In 2009, it was safari on OSX first again, on day 1, followed by IE8 on Win7, followed by safari on OSX again, followed by firefox on Win7 (however multiple platforms were actually vulnerable to nils' attack[1]). All in day 1.
http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits
http://blogs.zdnet.com/security/?p=2917
http://blogs.zdnet.com/security/?p=2934
[1] http://www.securityfocus.com/bid/34235
Rules: .net, quicktime. User goes to link. ... User goes to link
Day 1: Default install no additional plugins. User goes to link.
Day 2: flash, java,
Day 3: popular apps such as acrobat reader
And Charlie Miller one of the pwners says OSX is easier:
http://blogs.zdnet.com/security/?p=2941
"It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows."
"For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they're paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac."