Slashdot Mirror
SpyEye Trojan Source Code Leaked
wiredmikey writes "The SpyEye malware kit has long been both the bane of unsuspecting victims and a boon for cyber-criminals. Now, according to security researchers, the situation may have taken a turn for the worse. The SpyEye Builder patch source code for release 1.3.45 was leaked by the Reverse Engineers Dream Crew (RED Crew) recently after a crew member was able to locate a copy of SpyEye Builder 1.3.45 and create a tutorial that enables a reader with SpyEye Builder to crack the hardware identification."
...does any of this mean? Can we get summaries that aren't the first paragraph of TFA? Can we get an explanation of what the hell TFA is talking about and why we should care?
Sheesh.
from the without-the-consent-of-major-league-baseball dept.
really? that's the best phrase you came up with?
It's quite blockable in HOSTS files &/or Firewalls (software OR hardware router types) -> https://spyeyetracker.abuse.ch/monitor.php
APK
P.S.=> They create variants? Those will be tracked as well as to their botnet C&C servers... simple!
... apk
The author of the original blog post that laid out the hardware ID crack completely refuted Damballa's post. If you read his original post, it's very clear that he didn't post the source code or anything close to it. He just showed how to crack the HWID. Not the same thing by a long shot.
From ComputerWorld: "SpyEye is a particularly nasty piece of malicious software: it can harvest credentials for online accounts and also initiate transactions as a person is logged into their account, literally making it possible to watch their bank balance drop by the second."
The malware kit is normally sold to criminals, with each sold copy protected by an encryption scheme of some kind. This encryption scheme was cracked and the source code also released, so anyone can now freely compile the software. The malware also uses a botnet to perform transactions using compromised banking credentials. It's not clear if the hack also enables one to setup or control the botnet aspect. However, one could presumably make use of the capability to directly initiate transactions on the victim's computer.
And to think I just got all my online accounts linked together to make my life easier!
Download is here
http://forum.potsec.net/showthread.php?3-SpyEye-Source-Code-is-Leaked
Because we don't have enough script kiddies in anonymous and lulz-sec running around breaking stuff as fast as they can already. Just awesome.
It was meant for the "general good". I'd like a technical justification offered @ least on WHY it was 'downward modded' (thanks).
* The "general good" being information on stopping this SpyEye botnet from infesting you in the 1st place, by blocking it @ the HOSTS file OR firewall level (prefereably both local to your own system, & hopefully @ DNS server layers/levels too @ ISP/BSP's also via DNSBL's on THEIR parts, like Norton DNS does for example - which IS what makes IT, outstanding!)
APK
P.S.=> Of course, there are those who don't WANT others to KNOW about that site (the makers of this botnet mainly), & I've also made my share of enemies out there online as well (dolts I've floored on technical issues & they're obviously still "stinging" from the "bitter taste of defeat" @ having to eat their own erroneous words flavored with it, lol, @ MY hands)!
However? Well, so far here?? That's just speculation (but, IF I don't get a SOLID explain on the downmod? Then, I can only assume I am 100% correct on my "speculations" above))...
... apk
with the source code out, it should be easy to plug the security holes that the spyware uses, and it should be easy to generate hashes and heuristics for virus scanners to detect spyware on infected computers. In theory anyway.
assignment != equality != identity
In my init. post then here -> http://it.slashdot.org/comments.pl?sid=2380830&cid=37100334 because there is NOTHING "weird" about that, only facts & useful ones @ that!
(And, the fact is, IS that it lists the botnet C&C servers that SpyEye uses, which CAN BE BLOCKED @ the HOSTS file OR Firewall level (in software &/or hardware router firewall levels)).
* That's USEFUL INFORMATION others here can gain by... period!
"You are 100% correct on your speculations, you don't need to wait for anyone to confirm that." - by Anonymous Coward OBVIOUSLY A BOTNET MASTER HIMSELF on Tuesday August 16, @01:23AM (#37103512)
Thank you then for confirming my speculations then for me... now, go away you TROLLING botnet master... ok? Try to do something useful to the general human condition instead of being a scumbag...
APK
P.S.=> An application of... "ReVeRsE-PsYcHoLoGy" - 4 off-topic trolls like you (who clearly demonstrate ALL THEY HAVE, is effete down-moderations in retaliation vs. myself):
".emit eht lla driew os eb ton yrT" - by Anonymous Coward ANOTHER "ne'er-do-well" /. OFF-TOPIC TROLL on Sunday July 10, @06:32AM (#36710070)
"???"
Uhm... Could we get a translation of that off-topic "troll-speak/trolllanguage" of yours, please?
---
* And, you're an off-topic troll - no questions asked...SEE MY SUBJECT LINE ABOVE!
("ReVeRsE-PsYcHoLoGy", for trolls - Courtesy of this code by "yours truly" in less than 1 second flat):
---
#TrollTalkComReversePsychologyKiller.py (Ver #2 by APK)
def reverse(s):
try:
trollstring = ""
for apksays in s:
trollstring = apksays + trollstring
except:
print("error/abend in reverse function")
return trollstring
s = ""
print reverse(s)
try:
s = "Insert whatever 'trollspeak/trolllanguage' gibberish occurs here..."
s = reverse(s)
print(s)
except Exception as e:
print(e)
---
... apk
*picard-facepalm.jpg*
Holy fuck, I do not believe how many people have commented on and reblogged this story while failing basic Reading Comprehension 101.
The source code for the SpyEye trojan has NOT been leaked.
The source code for a >>a tool that patches the binary executable of the SpyEye trojan has been leaked.
“Over the last 18 months, SpyEye has made a lot of headlines, especially when it was revealed that the development team behind the malware was effectively merging it with that of the older Zeus code,”
It's not even that... the source code for a tool that patches the tool that BUILDS SpyEye trojans has been *released*.
It's amazing how the internet resembles that children's whispering game, considering we're dealing with text that supposedly doesn't change. I feel like I could write "I bought ice cream on Craigslist" on my blog and eventually see it posted to Slashdot as "Foreign terrorist creams Craig Ferguson." -- and yes, neither of these are news for nerds (well, maybe the first one).
They should do this more often. ...
It is not that they will get sued for copyright infringement or revealing trade secrets
If all malware were put freely on the internet, wouldn't that dry up some of the revenue streams for the authors? Sure, you will briefly see a spike in derivatives, but I believe the way to combat covert actions is not by covert counter-actions, but by bringing it all in the open.
When you consider this to be a battle, there are a number of things which would make sense:
1) Choose your battleground where you have a tactical advantage. Draw them in the open as "we" are more numerous and have more firepower.
2) Disrupt their supply lines by removing incentives to start writing malware. When they are selling their malware, buy one copy and provide it for free. This will remove a lot of their demand as they will have to start charging more and increase their exposure (larger money transactions will stand out more) or drive them deeper underground which makes them harder to find and buy from.
3) Increase your defences by making genuine software more secure and harder to exploit. "We" are making progress in this area.
4) Decrease their firepower by implementing more control on the ISP level. This may be dangerous as there might be "civilian casualties" but spam zombies are easily identified. Remove zombie hosts from the network. Remove ISPs who do not take action on the zombies from the network. Reduce bandwidth from countries who do not take action on the ISPs. This will have an added bonus that it will also disrupt some of their revenue streams. What is the point of raising a botnet army when you cannot do anything with it?
5) Demoralise their troops by taking legal action. Seize their spoils of war (assets) and their freedom (PoW).
6) Moralise your own troops by increasing incentives to write good code and identify problems. Have them rated like their financial health and increase/decrease tax rates accordingly as would interest rates. This will give incentives to write secure code rather than rush something out the door. When problems arise, security holes are patched as quickly as they are discovered and it allows companies to pay security researchers for their effort. It may even convince some of the black hatters (mercenaries) to switch sides as it becomes more profitable.