PC Invader Costs a Kentucky County $415,000

plover recommends a detailed account by Brian Krebs in the Washington Post's Security Fix column of a complex hack and con job resulting in the theft of $415,000 from Bullitt County, Kentucky. "The crooks were aided by more than two dozen co-conspirators in the United States, as well as a strain of malicious software capable of defeating online security measures put in place by many banks. ...the trouble began on June 22, when someone started making unauthorized wire transfers of $10,000 or less from the county's payroll to accounts belonging to at least 25 individuals around the country... [T]he criminals stole the money using a custom variant of a keystroke logging Trojan known as 'Zeus' (a.k.a. 'Zbot') that included two new features. The first is that stolen credentials are sent immediately via instant message to the attackers. But the second, more interesting feature of this malware... is that it creates a direct connection between the infected Microsoft Windows system and the attackers, allowing the bad guys to log in to the victim's bank account using the victim's own Internet connection."

Comments

Windows TCO

[harmonise]

Don't forget to include this in your Windows TCO calculations.

Re:Windows TCO

[clang_jangle]

But the second, more interesting feature of this malware, the investigator said, is that it creates a direct connection between the infected Microsoft Windows system and the attackers, allowing the bad guys to log in to the victim's bank account using the victim's own Internet connection.

Actually, if you root a *nix box, this part looks kinda trivial.

Yet we don't see much of that, do we? In spite of the massive *nix share of the server market, it's windows systems that prove easiest to compromise.

Re:Windows TCO

[Anonymous Coward]

keyloggers aren't used on servers as much...regardless of the OS.

Re:Windows TCO

[Evil Shabazz]

Your conclusion is debatable, particularly resting on the tenuous footing of your supplied argument. However, that doesn't matter at all. You see, it doesn't really matter whether Unix or Windows is easier to compromise. What matters is that the easiest people to compromise use Windows.

Re:Windows TCO

[erroneus]

I love the thought behind the comment, but I think we are arriving at a kind of plateau where it is not so much the OS as the users being stupid and uneducated while management policy is too lax when it comes to computer use.

With text-based computer usage, that was rarely if ever a problem simply because the fun things to do were rather limited and certainly didn't involve a live connection to a public internet. But the more connected we became, the more fun things there were for people to do. Suddenly with Windows + Internet access, the door flew wide open with everything from BonziBuddy to Weatherbug to all sorts of other gadgets, games and gizmos. This escalation of extra-curricular activity has never been treated as a threat or as a problem by many and has continued unabated.

What is needed, whether running Windows, Linux or MacOSX on the desktop, is a means to EFFECTIVELY prevent the installation of unauthorized software and data. That is a complicated trick for a variety of reasons not the least of which is the face that the file system doesn't care if a file is data or executable code no matter where it is located in the file system. (This is a problem that should be fixed in ALL OSes) There are effective tools to prevent a lot of such things, but all of them require what should have been done to begin with -- careful system software planning and implementation. There are limits to which the OS itself can be blamed and that's what I am really trying to get at.

On one hand, there is the threat of running as the superuser on any OS which is unquestionably a problem. On the other, there is running as the user. Running programs as a user, from a user's writeable data space is often enough to give malicious software operators what they are looking for anyway. Many of them seek personal information, so if they can get code running on a remote user's system that will give them access to that user's data, that's enough of a threat. Getting "superuser access" merely gives them a way to infiltrate the system at a much lower level and make removal much more difficult. So merely patching or preventing superuser access from being taken, assumed or otherwise utilized is only a part of the problem and one that is increasingly realized as irrelevant to malware authors.

In the end, the TCO of Windows, in this respect, is still lower if for no other reason than the likelihood that someone has a quick and easy way to reload the system clean is pretty high up there. There are fewer quick solutions to fixing or cleaning up a compromised system under Linux or MacOSX... with good reason -- they aren't your typical targets.

But I believe we are close to reaching a plateau at which there is only so much that can be done to secure an OS without proper planning and implementation taking the lead concern as it should have always been.

Re:Windows TCO

[Mista2]

I use Windows, OS X and Linux, and none of my PCs have ever been compromised, but the Windows one sure is harder to protect.

Re:Windows TCO

[andy_t_roo]

He does have a basis -- the effort (time or cost) required to get the system to a state where compromise was not likely.

simplified a bit :
Linux - don't run as root, install updates regularly, think twice before entering root password.
Windows - attempt to have the logged in user not running as admin, install updates regularly, install run update and monitor virus scanner + firewall software. think twice before entering admin password (if running as non-admin)

OSX - never had admin on OSX, from what i understand its the same as linux with respect to security.

the effort to run (pre vista) windows as non-admin is substantially harder than non-admin linux.
installing updates is approximately the same effort.
windows (currently) requires extra software installed to be secure.

Objectively windows is harder to secure (harder on 2 out of 3). (this also assumes that this is the minimum effort required to secure each system to the same level - on any system you could spend much more effort due to a lack of knowledge, or wrong pre-conceived ideas concerning security)

Re:Windows TCO

[Nutria]

are you implying that dumb users suddenly become intelligent...?

No. It's that a regular (not necessarily dumb, just... regular) non-priv users have less (not zero!) chance of having (actively thru stupid clicking, or passively thru a worm) something unwanted installed on Linux/BSD than they do on Windows or OSX. Especially if they don't have the root password.

IOW, Windows is a slippery pistol with a low trigger pull weight in a fragile holster. BSD & Linux "pistols" have no-slip grips, heavy trigger pull weights and sturdy leather holsters. You can shoot yourself in the foot with either, but Windows makes it a *lot* easier...

Re:Windows TCO

[Jedi Alec]

Wow...that's quite something.

So you're saying that until they have both been broken into and their car radio's removed, there's no way to prove that it's easier to lock up a tank than it is to lock up a convertible with a cotton roof?

Bank hold some responsibility

[gd2shoe]

They set up a system that required multiple credentials to transfer money, but one of those credentials could be used to reset the other? Give me a break! This was a system deliberately setup to look more secure than it actually was. The Controller was relying on that extra protection the bank was offering. It seems the county was scammed twice!

Re:Bank hold some responsibility

[gd2shoe]

No, I am being fair.

Direct connection or not, that login shouldn't have been able to reset the other one. There are several reasons why two people needed to approve transfers from that account. Being able to unilaterally reset the Judges credentials is a big fat security hole in its own right.

Sometimes an attack must rely on more than one vulnerability. This is one of those. Thus, I didn't say that the bank is 100% responsible, only that they hold some responsibility.

Re:Bank hold some responsibility

[plover]

My wife has long had to transfer money between various commercial accounts at her jobs. As far back as I can remember, the banks issued her RSA tokens which were required to authorize the transfers.

I can't imagine a commercial bank NOT using a secure crypto system with an air gap. If the county is concerned about two authorizations, so much the better: issue the judge his own token.

Even that could be compromised by a hacker who owned the treasurer's computer, but it would have been almost impossible to run the scam 500 times in a few days like this guy did.

Obligatory:

[Joe Snipe]

Identity Theft

enh, the criminals we get these days...

[roc97007]

All that work, and they netted less than a half million?

Re:enh, the criminals we get these days...

[CorporateSuit]

No kidding, if they were real hackers, they would have gotten away with $1.337 Million.

HOW DID THE VIRUS/TROJAN get onto the PC?

[davidsyes]

From the site:

http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html?hpid=sec-tech

one reader wrote in:

"I guess we don't know how the attackers somehow got the Zeus Trojan on the county treasurer's PC (presumably the county doesn't want to say and the FBI told them not to discuss details of the case anyway), but I'm curious whether that PC had security software installed, whether it was up to date, which security software can deal with the Zbot (ZeuS bot) Trojan, etc.

---------

Well, i have an idea, and it's TFO (Totally Frackin' Obvious)... and might be how it happened. A poor old cleanup crew member may have been elicited to put a USB device on a bank manager machine that might not have been watched by a camera. Might have trained the cleaner to surveil the PCs, determine their visibility to cameras, then trained the dupe into deftly/swiftly attaching a USB attack device while feigning scraping something sticky from the floor, or emptying waste bins that were tough to get the bag from....

Just my eye-dea... and the FBI may not want THAT to get out lest other banks suffering poor camera placement succumb to the same thing...

Or, a native of the Ukraine/U-area working at the bank might have been subjected to manipulation of some sort, but trained to be deft and not come under suspicion. Just my inflation-deprived-$0.02-cents...

Re:HOW DID THE VIRUS/TROJAN get onto the PC?

[ducomputergeek]

Find out if the bank manger smokes, or his/her sectary smokes. Note when they go for a smoke and where. Get a few of those USB thumb drives from trade shows and lace them with trojans and place them near the smokers outside break area and wait for them to pick it up and place them back in their machines when they get back inside. Because usually they will just to see what was on the drive.

How does a keylogger ever spread?

[gd2shoe]

I have a much more likely scenario. They simply spread their malware everywhere, and waited to see what sensitive systems they'd netted! They needed to dupe people into sending money overseas to them. I doubt they have any non-electronic influence in the states. The story indicates that the fake company name has been repeatedly tarnished... meaning it's very likely that they've done this before and will do this again. It probably got on by worm or trojan. Once there, it sat dormant while the hackers figured out which computers were of value to attack.

Re:your tax money at work

[John Hasler]

Governatorese.

Re:Learn English

[Anonymous Coward]

No, your grammar nazi-ing is not even correct. Co-conspirator and conspirator indicate different things, like specificity. If I am involved in a computer conspiracy, and another person is involved in a highway tax conspiracy, we are both conspirators. We are not, however, co-conspirators. We are not partners, we are not involved in the same conspiracy.

Also, it is possible for a conspirator to have a partner who is not part of the conspiracy. If a conspirator goes to someone and is able to get them to do a job with them, but withhold information regarding the conspiracy or its goals, then the conspirators new partner is not a co-conspirator.

The use of co-conspirator is used to denote the relation of one conspirator to another. It would actually be improper grammar to remove the "co", as it would imply ownership of one to the other. "His conspirator" and "his co-conspirator" have obviously different meanings. The use of co-conspirator removes ownership from the previous statement, and is therefore not redundant.

The first rule of the grammar nazi is only to make corrections when they are themselves correct. You, sir, and an epic fail.

P.S. Feel free to correct the poor grammar in that last sentence as if it were English, so I can call you wrong again. It's fun.

Re:your tax money at work

[cgenman]

If you go with the normal route, and the normal route gets hacked, you won't be blamed.

If you setup a server on a system that your boss hasn't heard of, and you get hacked, you're fired.

The chances of the former are much greater in a lot of ways. But the risk to your job is basically zero. Whereas in the second way, you're fired because you decided to use that silly deamon thing instead of proper, professional, Enterprise-Ready (tm) Windows 7.

Lets fix the story:

[AHuxley]

Microsoft Cost a Kentucky County $415,000 :(
When will they learn.
This is my Unix. There are many like it, but this one is mine. My Unix is my best friend.
It is my life. I must master it as I master my life. My Unix, without me, is useless.
Without my Unix, I am useless. I must run my Unix true.
I must admin smarter than any hacker who is trying to own me. I must block them before they hack me. I will....
My Unix and myself know that what counts on this net is not the scripts we code, the size of our pipe, nor the data we send.
We know that it is the uptime that counts.
We will stay up...
My Unix is human, even as I, because it is my only life.
Thus, I will learn it as a brother.
I will report its bugs, share its strengths, upgrade parts, buy its accessories, open its ports and lobby for more bandwidth.
I will keep my Unix clean and ready, even as I am clean and ready.
We will become part of each other. We will...
Before Darl McBride I swear this creed. My Unix and myself are the defenders of the company I work for.
We are the masters of your script kids.
We are the saviors of your profit.
So be it, until victory is America's and there is no competition, but Profit.

Linux is not the holly grail

[shemp42]

Everyone who is claiming that linux should be used and its those stupid MS users that cause this are missing the point and have never spent one second working in a corporate IT enviroment. The fact is that every single security measure that is put in place is met with overwhelming opposition by the user base as well as the executives. A spam filter is looked at as the unholy antichrist because it blocks .00001% of legitimate emails. I have worked corporated IT for years and have constantly had to fight for just the basic's in security. IT is not given the authority to do its job. I am sure there is some IT guy that worked for the county that is now unemployed because he didnt stop it, even though he has been banging his head againest the wall to get security measures put in place. I for one am tired of hearing that the answer is Linux. Sh*& I cant even upgrade to Office 2007 without getting hundreds of phone calls from users that cant find the print button. You want me to switch them to linux? That is just comical. Rather than constantly blaming the victim we need to get tough on the criminals. If somone is mugged you dont tell them that they should not have walked down the street. You go after the guys that mugged them. You dont tell the convienence store owner that he was robbed because he was open and should not let people enter the store. This stops when we get tough on the criminals and the governments that allow them operate free from risk. How long do you think it would take these countries to stop this if we cut off all trade and aid to them? The fact is that cybercrime is not looked at as real crime. Until we start caring more about it and electing people who understand the risks it wont matter what system is in place, it will be exploited.