Among the findings:
- Passwords tend to be weak (not new).
- Passwords tend to get reused across multiple web sites (not new).
- Botnet sizes may be overestimated (interesting).
The whole ‘make money working from home’ thing has a new twist:
Of particular interest is the case of a single victim from whom 30 credit card numbers were extracted.
Upon manual examination, we discovered that the victim was an agent for an at-home, distributed call center. It seems that the card numbers were those of customers of the company that the agent was working for, and they were being entered into the call center’s central database for order processing.I’m pretty sure that some of the $270/hr Tier 3 vendor support engineers that we’ve had on support calls were at home when they got paged. I could hear kids and dogs in the background.
I was very interested when bad guys started targeting phishing attempts for a local credit union to employees of the organizations that were affiliated with the credit union. But this opens up a new form of precision targeting:
For instance, armed with information provided by social networking sites, an attacker may find pictures, personal interests, and other contact information that could be used to construct personalized phishing and spam campaigns or to blackmail victims.
And for those who wish to keep personal and professional identities separated:
For example, Torpig records a user logging into his LinkedIn account. His profile presents him as the CEO of a tech company with a large number of professional contacts. Torpig also records the same user logging into three sexually explicit web sites.
So much for that plan.
Public machines? Don’t even try:
This analysis turned up some interesting results, including a machine responsible for over 80 university webmail logins, another that sent close to 60 distinct credentials to a university health care web site, and one providing at least 25 agent logins at what seems to be a travel agency.
The MBR is hooked, so the odds of you knowing that the public machine is infected are pretty slim.
The botnet authors apparently didn’t want to get left out of the whole Twitter revolution fad:
…the new algorithm also relies on search trends from Twitter to generate one additional seed byte. […] This letter is then used to calculate a "magic number", which is used to compute the domain name…
Yep – grab a page from Twitter and use it to seed the next domain name in C&C algorithm. Amusing.
We have created a monster, and it is us.
