Web Scam Nets Criminals $10,800 a Day

John E. Dunn, Techworld.com
Web crime has long been known to be worth good money, but now security company Finjan has been able to show just how profitable using a real-world example of such a scam - $10,800 (7,900) per day.
The figures were calculated after the company gained entry to servers controlled by a criminal group carrying out a simple but multi-faceted con based on a mixture of search engine manipulation and bogus anti-virus software, designed to mine cash from web traffic.
According to Finjan, the crime network concerned had been able to hack legitimate websites, injecting PHP scripts capable of generating Google keywords based on popular search terms of the moment, bulked by mis-spellings of other common search terms. Once these bogus key words were indexed by search engines, anyone looking for the same terms or mis-spelled terms would have found the results at the top of search results pages.
Following any one of these links would take users to websites serving rogue anti-virus products that attempt to trick users into paying for a license to remove non-existent malware.
Researchers were able to see that during 16 consecutive days, a total of 1.8 million users were redirected to rogueware sites, 1.79 percent of whom fell for the scam and paid up $50 a time for useless software.
Since the criminals were being paid 9.6 cents for each redirection as part of a larger network of criminals affiliates, they would have netted $172,000 in total, or nearly $10,800 per day for the period of the scam monitored. The risk of discovery? Given that the web is now infested with many similar scams, virtually zero, making it a low-risk way to make money over and over again.
Assuming the criminals could replicate this success over a longer period, they might be able to earn up to 2 million per annum, the company had calculated.
"We already know that cybercrime makes money. But the question is how much money," said Finjan's CTO, Yuval Ben-Itzhak. The attraction of hacking legitimate sites to plant keywords was also clever, he reckoned, because it transferred to come-back for Google keyword manipulation to the real owner, and not the criminal.
"They are breaking SEO [search engine optimisation] rules. But they do not care if they will be punished."
A video used by Finjan to demonstrate the search engine optimisation (SEO) manipulation showed the search engine results to be innocuous looking. This helped lull users into the false sense of security needed to make the rogue anti-virus software look more plausible.
Fake anti-virus software has grown into one of the commonest scams in the web, even affecting Mac users. Despite many warnings, a small minority of Internet users continue to fall for the con. The technique of carrying out immediate online scans for malware was started by revenue-hungry anti-virus companies looking for subscriptions from worried users. Although legitimate, the idea was quickly picked up on by criminals, who grasped its simple psychology of fear.

Macs: Not as Secure as We Thought?

When it comes to technology, security is a relative term.
Douglas Schweitzer, Computerworld


Well, I don't know about other security professionals, but I'm not at all shocked that this year's PWN2OWN contest showed that both Windows PCs and Macs could be cracked. I do have to admit that 10 seconds was a bit of a shocker for the Mac Platform.
Look, I have put my faith in OS X since 2003, but I'm not one of those Mac zealots who think that Macs are infallible. There sure are less of us than our Windows using brethren. So, we're a smaller target simply because the user base is smaller. That's one of the reasons there haven't been as many Mac viruses. But the contest also showed that the recently launched IE8 could be hacked too (although I'm sure it took longer than 10 seconds). Those mere 10 seconds keep echoing in my head.
The moral of this story is that no OS is perfect or fully secure. Neither are the Web browsers we use every day which are so tightly integrated and intertwined into the OS. Should we panic and become paranoid? Not a chance...driving, flying and many sports have inherent risks...it's just a part of playing the game.

Conficker to Phone Home on April Fools' Day

Security researchers are in the dark about what will happen next week when the newest variant of Conficker, 2009's biggest worm by a mile, begins trying to contact its controllers.
"It's impossible to know until we see something that has a clear profit motive," said Joe Stewart, director of malware research at SecureWorks Inc. and a noted botnet researcher.
PCs infected with Conficker.c, the third version of the worm that first appeared late last year, will use a new communication scheme on April 1 to establish a link to the command-and-control servers operated by the hackers who seeded the malware. The date is hard-coded into the worm, which in turn polls any of a number of major Web sites, including Yahoo, for the date, said Stewart.
That tactic is just one of several designed to make it tough for security researchers to figure out what Conficker's all about, and more importantly, what it might do. "We had to trick it into thinking it's not only getting back the right page, but that it's getting the April 1 date," said Stewart, talking about the machines SecureWorks purposefully infected with Conficker.c.
"So far, we haven't seen any evidence [on those machines] of what it will do April 1," added Stewart, although that's to be expected. "It's not April 1 yet, so they're not going to put something online, where it might be found. In fact, it's almost a little risky for us to try to look for those sites, since it might give away that we have some bots in their network."
Symantec Corp.'s Vincent Weafer, vice president of the company's security response group, agreed with Stewart that it's impossible to know ahead of time what stunt Conficker's controllers will pull next week. "Nobody has any real idea," said Weafer. "There's no indication of what it will do April 1."
Weafer characterized the Conficker.c update as one to "armor and harden the existing infections," and noted that the variant, unlike its predecessors, cannot spread to other PCs. "This variant is very defensive-oriented," said Weafer, "to make it less visible and more resilient."
Like Weafer, Stewart sees Conficker.c as a move to by the worm's maker or makers to consolidate what's already infected. "The big question is what's the end game?" he said. "Is it just as big as they want it to get?"
He also noted Conficker.c's tilt toward the sophisticated, seconding Weafer's opinion that the worm's makers are trying to stump both researchers and anti-virus software.
"This a very curious thing," Stewart said. "[The hackers] are more patient and more methodical than most. They're raising the bar, by a lot, in terms of what we have to do to figure out what it does, to block it, to clean it.
"It's not your typical type of e-crime," he said.
Conficker, which is also called Downadup by some security companies, first appeared late last year, and originally exploited a Windows vulnerability that Microsoft Corp. patched in an October 2008 emergency update. In early 2009, the next version -- Conficker.b -- infected millions of PCs in just a few days.

Gregg Keizer, Computerworld

Site Hacks, Fake Security Rakes in Serious Cash

Site Hacks, Fake Security Rakes in Serious Cash
Erik Larkin

Here's a recipe for illicit online riches:
1. Hack a Web site to insert pages full of keywords to popular terms.
2. Redirect the millions of people who click on the search result links to the fake pages to a site selling rogue antivirus software.
3. Sit back and collect affiliate fees from the rogue software seller, to the tune of up to $10,000 a day.

Web security company Finjan gathered details on this kind of operation after gaining access to a traffic management server used by the bad guys. The redirection that started with a poisoned search link went through the traffic servers on the way to rogue AV sites, allowing Finjan to observe the process.

The company found that crooks were hacking legitimate Web sites to insert parasite pages stuffed full of search terms pulled from the Google Trends system, along with others with minor typos from real terms like Gogle or Obbama.

These fake pages, designed to get search engines to find and display the pages in online searches, would redirect anyone who clicked on them to a site selling rogue AV software. Pushing the fake apps has become a popular profit-making technique among online crooks, and for good reason.
Finjan found that affiliate programs from the crap software pushers pay hackers 9.6 cents per redirection to the software-selling sites. That adds up to serious cash when you're talking about 1.8 million unique user redirections in 16 consecutive days, as Finjan observed.

Of those 1.8 million users, 1.79 percent of them paid $50 for the fake AV software. The software sellers used those profits to pay a total of $172,000 - or $10,800 per day - to affiliates.

With numbers like these, it's no surprise that rogue antivirus is becoming more common. And its spread doesn't just hurt those who get conned out of $50 or more for the software. Search engines will typically penalize sites that they believe are trying to game the system by stuffing pages full of random search terms, Finjan says. So the legitimate sites that get hacked may be penalized and see their real pages drop in search engine rankings.

Yahoo Patches Messenger

Yahoo Inc. has updated its Messenger instant messaging software to flush a bug that hackers could exploit by sending video chat invitations to unwary users.

The vulnerability, which surfaced last week in a posting to a Chinese security forum, could be exploited by duping a user into accepting a malicious webcam invitation, McAfee Inc. confirmed Aug. 15.

In its advisory, Yahoo said that it had actually patched two bugs, the heap overflow disclosed last week and a previously unknown denial-of-service (DoS) issue that also involves Messenger's video chat feature. Speaking of the latter, Yahoo's alert said: "For this specific security issue, Messenger exits unexpectedly after accepting a webcam invitation from a malicious attacker."

Unlike the buffer overflow flaw, the DoS vulnerability would not give an attacker the chance to sneak his own malicious code onto the PC.

Messenger 8.1.0.416 is the summer's second patched-up IM client for Yahoo. In June, eEye Digital Security fingered Messenger for two other critical flaws in the webcam feature. Then, Yahoo patched the bugs considerably faster: It released a fix just a day after the flaws went public. According to McAfee researcher Wei Wang, August's video vulnerability wasn't connected to the older June bugs.

Messenger users can download the patched version immediately, or wait for the software's auto-update to kick in. Yahoo acknowledged that it may take weeks for the update to be fully deployed. "Over the next several weeks, users worldwide will be prompted to update to a new version of Messenger upon signing into the service," Yahoo's advisory read.

source : www.computerworld.com

The Monster.com Mess

The last thing you need when you're unemployed is a bank account that's suddenly emptied. But that's exactly what some unwary users of employment search site Monster.com faced after identity thieves made off with the personal information of more than a million people looking for jobs.

How It Started

This still-developing story has enough nooks and crannies to confuse a gumshoe, but some facts are clear: Monster's resume database was looted, and the personal information taken was used to forge convincing messages that deposited password-stealing Trojans and ransomware on users' PCs.

Calculated and ambitious, the attack is striking for how it blended several elements--stolen credentials of legitimate users, phishing e-mails, Trojan horses, money mules and more--into a slick assault.

What We Know So Far

Was Monster.com hacked? No, as Symantec said immediately. Instead, the attackers accessed the resume database with legitimate usernames and passwords, probably stolen from professional recruiters and human resource personnel who use the "Monster for employers" section of the site to look for job candidates. But it wasn't until Thursday that Monster.com admitted as much. "By gaining unauthorized access to employer accounts, the software was obtaining job seeker contact information," a new alert said.

What was snatched from the database? Names, e-mail addresses, mailing addresses, phone numbers and resume IDs, said Symantec. Yesterday, Monster.com added that only about 5,000 of the people whose data was filched live outside the U.S. That squares with what Symantec's Amado Hidalgo said in an e-mail: The information-stealing Trojan was hard-coded to dig through only the "hiring.monster.com" and "recruiter.monster.com" domains, limiting their theft to the Monster USA site's database. "They only targeted the U.S. Monster site and not any other international Monster [Worldwide] Inc. sites, such as those in the U.K., Spain, etc.," said Hidalgo.

source : www.pcworld.com

Site Auctions Software Vulnerabilities to top Bidder

There are many ways vulnerability information can get out to the industry but a controversial new site, auctioning such information to the highest bidder, may be the wave of the future.

The auction service, called WabiSabiLabi, lets potential sellers and buyers connect e-Bay-style, with timed bidding periods and minimum starting prices. Founders of the wslabi.com site say their auction house serves the researchers who discover vulnerabilities and often don't reap monetary rewards for their time and talent.

The business model is based on a practice that e-Bay shut down 16 months ago saying it promoted illegal activity. At the recent Black Hat show, published reports stated that 88 percent of respondents to an online poll said using such sites is dangerous. While it is accepted that researchers deserve to be paid for their work, selling to the highest bidder is frowned upon.

WabiSabiLabi disagrees, saying its e-marketplace, where any qualified buyer can bid, will actually discourage those who discover vulnerabilities from selling them on black markets to criminals who try to turn them into money.

The company says it checks out buyers and sellers before they can trade. "We are very aware about the risks of selling vulnerabilities, and this is why we subject buyers to deeper scrutiny, to minimize the risk of selling the wrong information to the wrong people," WabiSabiLabi says in its ethics statement. "We require non-anonymity from buyers and sellers alike. The stakes are just too high at this point in history."

Even so, the marketplace, which started business six weeks ago, is being eyed cautiously by entities dedicated to eliminating vulnerabilities quickly to avoid criminal exploitation.

"I don't think it's necessarily good for the community," says Jason Greenwood, the general manager of VeriSign's iDefense team, which pays bounties -- sometimes tens of thousands of dollars -- to researchers who discover vulnerabilities. "It will increase the perceived value of vulnerabilities, and the good guys already have trouble competing with the money you can get on the black market."

"There's a real danger that a number of these vulnerabilities will be purchased by buyers who do not turn them over to the vendors," says Terri Forslof, manager of security response for Tipping Point. "Once a vulnerability is turned over to a vendor its value starts to depreciate immediately. If someone paid lots of money for a vulnerability -- say US$75,000 to $100,000 -- I guarantee they're not giving it to the vendor. Otherwise they've wasted their money."

VeriSign and its competitor Tipping Point, for example, both pay cash for significant vulnerability discoveries in an effort to plug software holes before they can be exploited. The companies then work with the vendors whose software is compromised to find fixes and publish the vulnerabilities.

VeriSign runs quarterly challenges paying as much as $15,000 for researchers to find particular types of vulnerabilities in particular platforms, Greenwood says. Tipping Point ranks contributing vulnerability researchers as bronze, silver, gold and platinum depending on the quantity and quality of their discoveries, according to its description of Tipping Point's Zero Day Initiative. It rewards them with cash bonuses up to $25,000 and pays their way to the Defcon and Black Hat security conferences.

Underground markets pay as much or more, experts say. Charlie Miller of Independent Security Evaluators, says he sold a Linux Daemon vulnerability for $50,000 to an organization he approached directly. But he had no idea whether somebody else would have paid much more, he says in a talk delivered at Carnegie Mellon University's Workshop on the Economics of Information Security earlier this year.

"I had no way to know the fair market value of this exploit," he says in his paper, "The Legitimate Vulnerability Market; Inside the Secretive World of 0-Day Exploit Sales," which he delivered at the conference. "I may have been off by a factor of 10 or more."

Money isn't the motivation behind most of the vulnerabilities reported to entities that will try to fix them, says Art Manion, team leader for vulnerabilities at Carnegie Mellon's Software Institute CERT program, a nonprofit that acts as a go-between for researchers and software vendors.

"They desire to get the vulnerability out in the open and get the credit for it," he says. "We don't pay for vulnerabilities," but the software vendors may.

Researchers go through CERT, he says, because dealing with the software vendors themselves can be tedious, time consuming and aggravating. "They may not want to deal with the vendors. If it's a protocol problem, they might have to tell 60 or 70 vendors. "It's lots of work, and CERT will do it," Manion says.

CERT's goal is to get the vulnerabilities published as soon as possible, he says, making the flaws next to worthless to criminals. Their goal ideally is to run exploits before vulnerabilities have been identified when they can do maximum damage, he says.

About 16 months ago, a Microsoft vulnerability was posted on e-Bay and was taken down by the site after Microsoft complained. E-Bay says the sale violated its policy against enabling criminal activity.

WabiSabiLabi this week listed four vulnerabilities for sale, two against Windows Server 2003, one against Windows XP and one against WordPress 2.2.2. None had bids, but that doesn't tell much by itself, says Greenwood.

source : NetworkWorld