Slashdot Mirror
Massive New Spambot Ensnares 711,000,000 Email Addresses (zdnet.com)
An anonymous reader quotes ZDNet:
A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.
The spambot, dubbed "Onliner," is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet. Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data." Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
The spambot, dubbed "Onliner," is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet. Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data." Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
Likely, all of which, requires some complicit user imbecility to embed.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
email malware for windows? WTF?
Just go to my handy website to enter your email to see if you've been affected, link will be up shortly. :^)
Aaah! They all voted for Trump anyway. They deserve what they get.
Few people trust email anymore. Scammers aren't going to get much out of this. And their garbage mostly ends up in spam folders now. Big fail.
Is the operator of that server dead yet ?
And if not, why ?
The only good psychopath is a dead psychopath.
So now there's a single good source for just how many ways can you spell password.
Can it be added as a package for Linux's cracklib?
I know I'd love to know that while my password might seem really secure to me that it's also not the same as the combination on my bosses luggage.
I just had a look on 'Have I Been Pwned' for one of my domains and of the 140 or so 'Onliner' addresses, 99% of them are invalid addresses that would go straight into the trash (I don't bounce emails to invalid addresses). I wonder how many of those 711 million addresses are sent straight to /dev/null
I wonder how many of these e-mail 'addresses' read something like jhjhdsjifhdsjisfh@jdsjfhj.kjj vs ones that are legitimate (this reminds me of when spammers were selling CD-ROMs with "millions of email addresses" on them)
I wonder how many of these e-mail 'addresses' read something like jhjhdsjifhdsjisfh@jdsjfhj.kjj vs ones that are legitimate (this reminds me of when spammers were selling CD-ROMs with "millions of email addresses" on them)
This list contains more than just breaches. It also contains email addresses scraped from mailing lists, as I have found a few I used. I wish spammers would start weeding out the crap in their lists...
I've been seeing a few cases where some miscreant obviously has access to real email conversations, and inserts something evil into it. In one case, in an ongoing conversation, an email "from" one of the participants with all the "On <date>, <foo> said:" reply chain for the legitimate conversation intact said "Check out this and let me know what you think", where "it" was the ever-popular Microsoft Word document that just said "Enable Content to view this". Of course, if the recipient does "Enable Content", the evil macros in the document will pwn him completely.
One even more evil, a legitimate conversation about a financial transaction. The thief inserted an email (once again, the reply chain of the legitimate conversation intact) saying "Oh, by the way, my bank account has changed, please wire it to...." some random money mule account. That one didn't get caught until the proper recipient started complaining about where his money was.
This list.... email addresses with passwords... that is very likely how some of these scams are carried out.