Slashdot Mirror
Seeking Competitive Advantage, For Malware
jc_chgo writes "Brian Krebs over at the must-read KrebsOnSecurity.com writes about the rivalry between two competing authors of nasty credential-stealing malware. The newer (SpyEye) can remove the older (Zeus) on any system it infects. Meanwhile, Zeus is so successful prices have gone way up for the new version. These 'crimeware kits' are freely available for purchase, and have enabled millions of dollars in thefts. The buyers of the kits prey primarily on small businesses by using wire transfers out of bank accounts. This is a problem that is only going to get bigger over time."
There are positives to this. If one type of malware can handily defeat another type of malware I'm sure the A/V companies will be able to learn something from it (and up-charge their victims, er, customers accordingly).
There's also the new 'botwars' games that we'll be able to watch from the safety of our non-Windows computers.
I am on my Windows machine you insensitive clod.
Various criminals:Yeah, we too!
Windows, where do you want banking credentials to be sent to today?
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
SecureWorks has noted that the latest versions of Zeus include anti-piracy technology that uses a hardware-based licensing system that can only be run on one computer. “Once you run it, you get a code from the specific computer, and then the author gives you a key just for that computer,” SecureWorks wrote. “This is the first time we have seen this level of control for malware.”
I guess it was bound to happen ... you just can't trust anyone these days. I wonder if either of these 'kits' infects the computer that runs it? Would the authors ever infect their customers?
He's reproducing the Flash ads from a malware seller.
Wow, I've never been more glad to be using AdBlock and NoScript in my life!
How do these guys not get caught? I mean, can't federal agents just set up fake transactions if hes publicly selling it? I know im simplifying it, so I ask anyone here to explain maybe how complicated it may be.
...is still much better than the idea of government-owned, tax-paid malware.
Colorless green Cthulhu waits dreaming furiously.
"What we need are a few good old fashioned hangings." -- FTC commissioner Orson Swindell at the first FTC spam conference. I'm looking forward to hearing about one of the organized crime associated bots getting whacked by one of the competition, and so the owners of the former return the favor to the author of the (temporary) victor. I suspect it's happened already, but not publicized. Sooner or later one will. Then we'll see some real cyberwarefare. You think the US government has got some cyberwarriors lined up? Fugidaboudit.
"I may be synthetic, but I'm not stupid." -- Bishop 341-B
If there is *one* thing you can be sure about consumer banks is that they hate losing money *and* time. They *cannot* pass all the burden to the consumers and they *cannot* make up for the lost time in employees dealing with this. Hence once the problem shall be big enough, 100% foolproof solution will come.
Some europeans banks have a physical device into which you need to enter a cryptographic challenge (in which the recipient's bank account number IS part of the challenge). You cannot make a wire transfer without that device / PIN. There's no known MITM attack that works against this. Good game low-lifes.
I hope they fill their pockets while it's not put in place by every single consumer bank around the world, because these devices already started appearing in several banks (repeat after me: the bank account number of the recipient is part of the cryptographic challenge, there's no MITM that can work against that).
there's no MITM that can work against that
Of course, there is.
Malware will just replace the account number used in a legitimate transaction with one of the scammer.
Contrary to the popular belief, there indeed is no God.
Agreed. right now, banks do what they can they can to take the easy road to money. For the most part that means accepting any transaction from anyone with no proof of identity or verification of authenticity on transactions. In specific, the credit card companies are the major source of easy money, and they are supplemented with the greed to make an additional transaction fee. In the US, go to your bank and ask 'who took my money?' At best you will get an 800 number to some robo-answering machine. There is no law or agreement that a bank has to tell you who they gave your money to.
And as long as credit cards can absorb the stolen amounts, they are not going to require authentication, as it will inconvenience the consumer and hurt volume.
It took many years for the recent credit rules to get through in the US that had some small dent on the corruptness of banks and credit cards in the US. But they did not go far enough. What used to be called loan sharking in the US is still legal for 'financial institutions'. We are supposed to elect politicians to represent us, what segment of the population was represented by making it 'illegal to charge huge interests rates for the loaning of money, except for financial institutions' ? That is a blatant and obvious sign of how corrupt our political system has become.
Just wait until the malware authors learn about lobbying.
slashdot troll = you make a compelling argument I do not like the implications of.