Slashdot Mirror
PC Invader Costs a Kentucky County $415,000
plover recommends a detailed account by Brian Krebs in the Washington Post's Security Fix column of a complex hack and con job resulting in the theft of $415,000 from Bullitt County, Kentucky. "The crooks were aided by more than two dozen co-conspirators in the United States, as well as a strain of malicious software capable of defeating online security measures put in place by many banks. ...the trouble began on June 22, when someone started making unauthorized wire transfers of $10,000 or less from the county's payroll to accounts belonging to at least 25 individuals around the country... [T]he criminals stole the money using a custom variant of a keystroke logging Trojan known as 'Zeus' (a.k.a. 'Zbot') that included two new features. The first is that stolen credentials are sent immediately via instant message to the attackers. But the second, more interesting feature of this malware... is that it creates a direct connection between the infected Microsoft Windows system and the attackers, allowing the bad guys to log in to the victim's bank account using the victim's own Internet connection."
Don't forget to include this in your Windows TCO calculations.
Cory Doctorow talking about cloud computing makes as much sense as George W Bush talking about electrical engineering.
They set up a system that required multiple credentials to transfer money, but one of those credentials could be used to reset the other? Give me a break! This was a system deliberately setup to look more secure than it actually was. The Controller was relying on that extra protection the bank was offering. It seems the county was scammed twice!
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
Identity Theft
Sometimes, life itself is sarcasm...
All that work, and they netted less than a half million?
Oliver's law of assumed responsibility: If you're seen fixing it, you will be blamed for breaking it.
From the site:
http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html?hpid=sec-tech
one reader wrote in:
"I guess we don't know how the attackers somehow got the Zeus Trojan on the county treasurer's PC (presumably the county doesn't want to say and the FBI told them not to discuss details of the case anyway), but I'm curious whether that PC had security software installed, whether it was up to date, which security software can deal with the Zbot (ZeuS bot) Trojan, etc.
---------
Well, i have an idea, and it's TFO (Totally Frackin' Obvious)... and might be how it happened. A poor old cleanup crew member may have been elicited to put a USB device on a bank manager machine that might not have been watched by a camera. Might have trained the cleaner to surveil the PCs, determine their visibility to cameras, then trained the dupe into deftly/swiftly attaching a USB attack device while feigning scraping something sticky from the floor, or emptying waste bins that were tough to get the bag from....
Just my eye-dea... and the FBI may not want THAT to get out lest other banks suffering poor camera placement succumb to the same thing...
Or, a native of the Ukraine/U-area working at the bank might have been subjected to manipulation of some sort, but trained to be deft and not come under suspicion. Just my inflation-deprived-$0.02-cents...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
It was a test run..
Have you fscked your local propeller head today?
I have a much more likely scenario. They simply spread their malware everywhere, and waited to see what sensitive systems they'd netted! They needed to dupe people into sending money overseas to them. I doubt they have any non-electronic influence in the states. The story indicates that the fake company name has been repeatedly tarnished... meaning it's very likely that they've done this before and will do this again. It probably got on by worm or trojan. Once there, it sat dormant while the hackers figured out which computers were of value to attack.
I won't join Slashcott. OTOH, If Beta goes live, I just won't be back until it's fixed. Sorry Dice.
Governatorese.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Yes, I am a pedantic Grammar Nazi, and I anticipate a great modding down of this comment, but my need to say this is worse than any addict's craving for his next fix. There are few things I hate more than redundant words. "Co-conspirator" is about as redundant as it gets. A conspiracy is a group of people. People conspire to do something like this, and you call those people conspirators. What happens in a hundred years when we forget that "co-conspirator" was being used this way? Do we start saying "co-co-conspirator"?
Of course! It should be co-nspirator, referring to multiple nspirators working together...
Bad puns gave me bad karma. =(
No, your grammar nazi-ing is not even correct. Co-conspirator and conspirator indicate different things, like specificity. If I am involved in a computer conspiracy, and another person is involved in a highway tax conspiracy, we are both conspirators. We are not, however, co-conspirators. We are not partners, we are not involved in the same conspiracy.
Also, it is possible for a conspirator to have a partner who is not part of the conspiracy. If a conspirator goes to someone and is able to get them to do a job with them, but withhold information regarding the conspiracy or its goals, then the conspirators new partner is not a co-conspirator.
The use of co-conspirator is used to denote the relation of one conspirator to another. It would actually be improper grammar to remove the "co", as it would imply ownership of one to the other. "His conspirator" and "his co-conspirator" have obviously different meanings. The use of co-conspirator removes ownership from the previous statement, and is therefore not redundant.
The first rule of the grammar nazi is only to make corrections when they are themselves correct. You, sir, and an epic fail.
P.S. Feel free to correct the poor grammar in that last sentence as if it were English, so I can call you wrong again. It's fun.
I find it hilarious that basic TCP/IP networking stuff gets labeled as "interesting". Any idiot can initiate a connection to a host on the internet.
What's "interesting" is that the victim's machine was not firewalled to prevent this sort of thing from happening in the first place. Properly controlling outgoing traffic is of crucial importance, particularly when dealing with such sensitive information. A locked down network should be able to contain unknown connections from within, just as well as those from the great wide internet.
In my opinion, it's not the invader that cost Kentucky $415,000. The fault rests entirely on their network administrator(s).
-Billco, Fnarg.com
If you go with the normal route, and the normal route gets hacked, you won't be blamed.
If you setup a server on a system that your boss hasn't heard of, and you get hacked, you're fired.
The chances of the former are much greater in a lot of ways. But the risk to your job is basically zero. Whereas in the second way, you're fired because you decided to use that silly deamon thing instead of proper, professional, Enterprise-Ready (tm) Windows 7.
The ______ Agenda
Microsoft Cost a Kentucky County $415,000 :(
When will they learn.
This is my Unix. There are many like it, but this one is mine. My Unix is my best friend.
It is my life. I must master it as I master my life. My Unix, without me, is useless.
Without my Unix, I am useless. I must run my Unix true.
I must admin smarter than any hacker who is trying to own me. I must block them before they hack me. I will....
My Unix and myself know that what counts on this net is not the scripts we code, the size of our pipe, nor the data we send.
We know that it is the uptime that counts.
We will stay up...
My Unix is human, even as I, because it is my only life.
Thus, I will learn it as a brother.
I will report its bugs, share its strengths, upgrade parts, buy its accessories, open its ports and lobby for more bandwidth.
I will keep my Unix clean and ready, even as I am clean and ready.
We will become part of each other. We will...
Before Darl McBride I swear this creed. My Unix and myself are the defenders of the company I work for.
We are the masters of your script kids.
We are the saviors of your profit.
So be it, until victory is America's and there is no competition, but Profit.
Domestic spying is now "Benign Information Gathering"
Everyone who is claiming that linux should be used and its those stupid MS users that cause this are missing the point and have never spent one second working in a corporate IT enviroment. The fact is that every single security measure that is put in place is met with overwhelming opposition by the user base as well as the executives. A spam filter is looked at as the unholy antichrist because it blocks .00001% of legitimate emails. I have worked corporated IT for years and have constantly had to fight for just the basic's in security. IT is not given the authority to do its job. I am sure there is some IT guy that worked for the county that is now unemployed because he didnt stop it, even though he has been banging his head againest the wall to get security measures put in place.
I for one am tired of hearing that the answer is Linux. Sh*& I cant even upgrade to Office 2007 without getting hundreds of phone calls from users that cant find the print button. You want me to switch them to linux? That is just comical. Rather than constantly blaming the victim we need to get tough on the criminals. If somone is mugged you dont tell them that they should not have walked down the street. You go after the guys that mugged them. You dont tell the convienence store owner that he was robbed because he was open and should not let people enter the store. This stops when we get tough on the criminals and the governments that allow them operate free from risk. How long do you think it would take these countries to stop this if we cut off all trade and aid to them? The fact is that cybercrime is not looked at as real crime. Until we start caring more about it and electing people who understand the risks it wont matter what system is in place, it will be exploited.
Then they click on either hotsexygal.jpg.exe or hotmanlystud.jpg.exe, depending.
If I have been able to see further than others, it is because I bought a pair of binoculars.
Idiots live everywhere (and keep in mind the plural of 'anecdote' isn't 'data'.) It might be that Kentucky has less money than other states, but I wouldn't say they're correspondingly "dumber" than other states.
Also, isn't that the same state that moron senator X is from?
That pretty much describes all 50 states.
John
"Find out if the bank manger smokes .. Get a few of those USB thumb drives from trade shows"
- The attackers somehow got the Zeus Trojan on the county treasurer's PC, and used it to steal the username and password the treasurer needed to access e-mail and the county's bank account.
- The attackers then logged into the county's bank account by tunneling through the treasurer's Internet connection.
- Once logged in, the criminals changed the judge's password, as well as e-mail address tied to the judge's account, so that any future notifications about one-time passphrases would be sent to an e-mail address the attackers controlled.
- They then created several fictitious employees of the county (these were the 25 real-life, co-conspirators hired by the attackers to receive the stolen funds), and created a batch of wire transfers to those individuals to be approved.
- The crooks then logged into the county's bank account using the judge's credentials and a computer outside of the state of Kentucky. When the bank's security system failed to recognize the profile of the PC, the bank sent an e-mail with the challenge passphrase to an e-mail address the attackers controlled.
- The attackers then retrieved the passphrase from the e-mail, and logged in again with the judge's new credentials and the one-time passphrase. Once logged in, the crooks were able to approve the batch of wire transfers.
> Every year I've read about it, the order from first to last compromised has been Windows, Mac, and Linux.
Which year? And which pwn2own contest are you talking about?
In 2006, there was no pwn to own cansecwest contest. ;).
In 2007, it was mac first, but only macs were prizes
In 2008, it was mac first again (out of OSX, Ubuntu and Vista) on day 2 (nobody managed to pwn anything under the day one rules), and vista only on day 3 (due to adobe flash exploit).
http://dvlabs.tippingpoint.com/blog/2008/03/27/day-two-of-cansecwest-pwn-to-own---we-have-our-first-official-winner-with-picture?info=EXLINK
Day 1 rules = remote exploit - no user interaction
Day 2 rules = default client apps
Day 3 rules = popular 3rd party apps.
In 2009, it was safari on OSX first again, on day 1, followed by IE8 on Win7, followed by safari on OSX again, followed by firefox on Win7 (however multiple platforms were actually vulnerable to nils' attack[1]). All in day 1.
http://dvlabs.tippingpoint.com/blog/2009/03/18/pwn2own-2009-day-1---safari-internet-explorer-and-firefox-taken-down-by-four-zero-day-exploits
http://blogs.zdnet.com/security/?p=2917
http://blogs.zdnet.com/security/?p=2934
[1] http://www.securityfocus.com/bid/34235
Rules: .net, quicktime. User goes to link. ... User goes to link
Day 1: Default install no additional plugins. User goes to link.
Day 2: flash, java,
Day 3: popular apps such as acrobat reader
And Charlie Miller one of the pwners says OSX is easier:
http://blogs.zdnet.com/security/?p=2941
"It's really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don't do. Hacking into Macs is so much easier. You don't have to jump through hoops and deal with all the anti-exploit mitigations you'd find in Windows."
"For the amount of time he spent to do what he did on IE and Firefox, he could have found and exploited five or 10 Safari bugs. With the way they're paying $5,000 for every verifiable bug, he could have spent that same time and resources and make $25,000 or $30,000 easily just by going after Safari on Mac."