Slashdot Mirror
Massive New Spambot Ensnares 711,000,000 Email Addresses (zdnet.com)
An anonymous reader quotes ZDNet:
A huge spambot ensnaring 711 million email accounts has been uncovered. A Paris-based security researcher, who goes by the pseudonymous handle Benkow, discovered an open and accessible web server hosted in the Netherlands, which stores dozens of text files containing a huge batch of email addresses, passwords, and email servers used to send spam. Those credentials are crucial for the spammer's large-scale malware operation to bypass spam filters by sending email through legitimate email servers.
The spambot, dubbed "Onliner," is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet. Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data." Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
The spambot, dubbed "Onliner," is used to deliver the Ursnif banking malware into inboxes all over the world. To date, it's resulted in more than 100,000 unique infections across the world, Benkow told ZDNet. Troy Hunt, who runs breach notification site Have I Been Pwned, said it was a "mind-boggling amount of data." Hunt, who analyzed the data and details his findings in a blog post, called it the "largest" batch of data to enter the breach notification site in its history... Those credentials, he explained, have been scraped and collated from other data breaches, such as the LinkedIn hack and the Badoo hack, as well also other unknown sources.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
The data includes information on 80 million email servers, and it's all used to identify which recipients have Windows computers, so they can be targeted in follow-up emails delivering Windows-specific malware.
Likely, all of which, requires some complicit user imbecility to embed.
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
email malware for windows? WTF?
It's known as Exchange...
Just go to my handy website to enter your email to see if you've been affected, link will be up shortly. :^)
Too late - the "security researcher" here already has put up https://haveibeenpwned.com/
Only a gullible fool would enter his own e-mail address in a site like that, but then again, there's no shortage of those...
It's appears good, it's cloudflare.com not 127.0.0.1 cloudfront.net
https://www.robtex.com/dns-loo...
But does go through a lot of edge servers (can throttle network traffic to adjust loads).
It's appears good, it's cloudflare.com not 127.0.0.1 cloudfront.net
https://www.robtex.com/dns-loo...
But does go through a lot of edge servers (can throttle network traffic to adjust loads).
Bail that answer that site is bad news, I posted too early search further I found this dire warning from Domain Registration
http://www.webhostingtalk.com/... and https://www.complaintsboard.co... first two searching eNom Inc.
Really sorry about that.
I wonder how many of these e-mail 'addresses' read something like jhjhdsjifhdsjisfh@jdsjfhj.kjj vs ones that are legitimate (this reminds me of when spammers were selling CD-ROMs with "millions of email addresses" on them)
You and Dan Kaminsky should get naked and be cool together.
I LOL'd https://en.wikipedia.org/wiki/...
I've been seeing a few cases where some miscreant obviously has access to real email conversations, and inserts something evil into it. In one case, in an ongoing conversation, an email "from" one of the participants with all the "On <date>, <foo> said:" reply chain for the legitimate conversation intact said "Check out this and let me know what you think", where "it" was the ever-popular Microsoft Word document that just said "Enable Content to view this". Of course, if the recipient does "Enable Content", the evil macros in the document will pwn him completely.
One even more evil, a legitimate conversation about a financial transaction. The thief inserted an email (once again, the reply chain of the legitimate conversation intact) saying "Oh, by the way, my bank account has changed, please wire it to...." some random money mule account. That one didn't get caught until the proper recipient started complaining about where his money was.
This list.... email addresses with passwords... that is very likely how some of these scams are carried out.