Fraud Intelligence Newsletter
January-March 2009
Table of Contents
APWG Releases Advisory on Abuse of Subdomains
SRI undresses Conficker
"The Analyzer" hacks banks for $10 million
Malware-based spying network discovered
U.S. convicts first foreigner of phishing
60 Minutes: The Internet is infected
Upcoming Event Schedule
April 20 – 24, RSA Conference, San Francisco, CA.
May 4 – 6, FS-ISAC Member Meeting and Conference, St. Pete Beach, FL. Lars Harvey will be speaking about the implications of the CheckFree domain takeover attack.
May 12 – 14, Anti-Phishing Working Group (APWG) Counter e-Crime Operations Summit 2009, Barcelona, Spain.
June 9 - 11, Messaging Anti-Abuse Working Group (MAAWG) 16th General Meeting, Amsterdam, The Netherlands.
June 21 – 26, ICANN General Meeting No. 35, Sydney, Australia. Rod Rasmussen will be attending as liaison for the APWG.
June 28 – July 3, Forum of Incident Response and Security Teams (FIRST) Annual Conference, Kyoto, Japan.
July 25 – 30, BlackHat USA 2009 Briefings and Training , Las Vegas, NV
October 19 – 21, Anti-Phishing Working Group (APWG) General Members Meeting and eCrime Researchers Summit , Tacoma, WA. This meeting is in our home city. Internet Identity will be coordinating many activities.
October 25 - 30, ICANN General Meeting No. 36 , Seoul, South Korea. Rod Rasmussen will be attending as liaison for the APWG.
October 27 - 29, Messaging Anti-Abuse Working Group (MAAWG) 17th General Meeting , Philadelphia, PA.
APWG Releases Advisory on Troubling Abuse of Subdomains for Phishing Attacks
The APWG released a new industry advisory that
examines the abuse of subdomain registries by criminals engaged in
phishing attacks. Over 10% of all phishing sites, representing
tens of thousands of scams worldwide, originate on subdomains available
for registration at subdomain registry services, the advisory reports.
Subdomains are easily exploited due to their low- or no-cost pricing
model, anonymity, easy setup, and lack of internal organization, dispute
rules, or policing. Misappropriation of dynamic IP addressing, proxies,
bots, and scam sites that disguise themselves with bank or credit card
logos then play havoc from a wide variety of services and platforms
which "host" these accounts unawares.
"Making Waves in the Phishers' Safest Harbors: Exposing the Dark Side of
Subdomain Registries," investigated and authored by Dave Piscitello
(ICANN) and Rod Rasmussen (Internet Identity), is available now at no
cost from the APWG at:
http://www.antiphishing.org/reports/APWG_Advisory_on_Subdomain_Registries.pdf
SRI undresses Conficker
Researchers at SRI International have
published a complete breakdown of the inner workings of the Conficker
malware. What their analysis reveals is that Conficker is a
best-of-breed piece of malware that uses cutting edge cryptography,
pushes the envelope on abusing the DNS system for "meeting point" style
communications, implements a sophisticated peer-to-peer command and
control structure, and works very hard to escape detection and prevent
its removal. You can find the SRI analysis at http://mtc.sri.com/Conficker/addendumC/
"The Analyzer" hacks banks for $10 million
A recently released
affadavit by a Canadian policeman details how Ehud Tenenbaum, an
Israeli hacker arrested in Canada last year for allegedly stealing
about $1.5 million from Canadian banks, also allegedly hacked two U.S.
banks, a credit and debit card distribution company and a payment
processor, resulting in at least $10 million in losses. Tenenbaum
became famous as "The Analyzer" 10 years ago when he was arrested for
breaching more than 400 Pentagon computers. Tennebaum was caught this
time because he carelessly did not hide his IP address when conducting
chat sessions with his fellow criminals. Police were monitoring those
sessions and were able to locate Tennebaum based on the registered
information for the IP address he was using.
The current scam is being referred to by law enforcement as the "PIN
Cashout Conspiracy". Tenenbaum first used SQL injection to break into
a financial institution's network. Once in the network, he found the
database containing debit card information and collected information
for the debit cards he planned to have cashed out. If necessary he
would alter the PINs for those cards. Tenenbaum outsourced the actual
cashing out by selling the card data to associates in Russia, Bulgaria,
Sweden, Germany, Turkey, Canada, and the U.S. Tenenbaum was paid about
10 to 20 percent of the total take.
For a more in-depth look at this story, including the names of the involved institutions, please see this Wired.com article (http://blog.wired.com/27bstroke6/2009/03/the-analyzer-ha.html) and Gary Warner's analysis. (http://garwarner.blogspot.com/2009/03/bank-hacking-exposed-analyzer-affadavit.html)
Malware-based spying network discovered
Canadian researchers
have uncovered a widespread spying operation that has stolen sensitive
information from hundreds of mostly governmental offices in 103
countries. The University of Toronto researchers had been asked by the
office of the Dalai Lama, the exiled Tibetan leader, to examine its
computers for signs of malware. What they found was a network of
infected computers, which they dubbed GhostNet, that was apparently
focused on spying on the governments of South Asian and Southeast Asian
countries.
The researchers were able to gain access to the command and control
structure for GhostNet via a web page that had surprisingly not been
password protected by GhostNet's operators. With that access, the
researchers were able to monitor the names of files being stolen by the
spies. Working with the Tibetans, the researchers also determined that
GhostNet's operators had gained control of the Dalai Lama’s
organization's mail servers.
The researchers also determined that three of the four control servers
for GhostNet were hosted China, while the fourth was in in Southern
California. GhostNet's command and control software had a
Chinese-language user interface, but there has been no direct evidence
released concerning the identities of GhostNet's operators.
For more information, please see this N.Y. Times news story (http://www.nytimes.com/2009/03/29/technology/29spy.html) and Gary Warner's in-depth analysis (http://garwarner.blogspot.com/2009/03/ghostnet-or-gh0st-rat-cyber-persecution.html).
U.S. convicts first foreigner of phishing
Ovidiu-Ionut
Nicola-Roman, of Craiova, Romania, was sentenced on March 30 to four
years and two months in prison for his role in an international
phishing operation. The 23-year old Nicola-Roman was charged as part
of a larger phishing indictment that also named six other Romanians,
none of whom have been arrested.
Prosecutors said they found 2,600 credit and debit card numbers in
e-mail accounts linked to Nicola-Roman, and that he had probably
harvested more information. He set up a phishing site to snare
customers of People's Bank in October 2005, and also had tools that
would have allowed him to phish customers of Wells Fargo, Suntrust,
Amazon.com, PayPal and eBay, according to court documents.
According to data supplied to prosecutors by People's Bank, 78 of the
88 People's Bank card numbers that investigators found in
Nicola-Roman's possession had been used for fraud. Nicola-Roman was
able to take an average of $960 per card number collected, prosecutors
said.
60 Minutes: The Internet is infected
The CBS program 60
Minutes aired a segment on March 29, called "The Internet is Infected",
about the rise of malware on the Internet. The piece focused mainly on
the current Conficker outbreak as its centerpiece. It also presented
the anti-virus industry, and Symantec most especially, in a strongly
positive light. Anyone in the security arena will find nothing new,
and plenty missing, from the piece; however, ordinary computer users
may have learned from it. You may view the piece on the CBS News site. (http://www.cbsnews.com/video/watch/?id=4901282n)
|
|
|