Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

"Crimeserver" Full of Personal/Business Data Found

kdawson posted more than 6 years ago | from the gotta-store-it-somewhere dept.

Security 114

Presto Vivace sends news of a server found by security firm Finjan that contained a 1.4-GB cache of stolen data, accumulated over a period of less than a month from compromised PCs around the world. The "crimeserver," as Finjan dubs it, "provided command and control functions for malware attacks in addition to being a drop site for data harvested from compromised computers. ... The stolen data consisted of 5,388 unique log files including 1,037 from Turkey, 621 from Germany, 571 from the United States, 322 from France, 308 from India and 232 from Britain." Oddly enough, the data was stored in the open, with not even basic auth to protect it. Finjan notes in their press release that this huge trove of data gathered over a short period of time indicates that the crimeware problem is far larger than most observers have been assuming. Update: 05/08 12:29 GMT by T : Note, the security firm involved is spelled "Finjan," not "Finjin" as originally shown.

cancel ×

114 comments

Sorry! There are no comments related to the filter you selected.

Why would they need basic auth? (5, Insightful)

morgan_greywolf (835522) | more than 6 years ago | (#23318676)

Why would they need basic auth? After all, the security on the compromised computers was bad enough for them, complete random strangers to the owners of the PCs, to bypass system authentication and authorization controls to grab the data in the first place.

Re:Why would they need basic auth? (5, Insightful)

kcbanner (929309) | more than 6 years ago | (#23318708)

Because all scammers aren't friends with each other.

Re:Why would they need basic auth? (2, Interesting)

Kingrames (858416) | more than 6 years ago | (#23319216)

I don't think that's it.

I think they recognize that getting the information was as easy as walking through a door, and so they don't trust any security measures other than physical security.

Re:Why would they need basic auth? (1)

encoderer (1060616) | more than 6 years ago | (#23322650)

So what?

When you can collect that much data that quickly it has very little value.

Even if all the data were compromised and all the CC/Acct numbers changed before the harvester could use it, the only thing truly lost is the opportunity costs involved in gathering the data itself.

It just makes no sense to spend time securing the data and coming up with an authentication mechanism (After all, this server needs to accept uploaded data from their botnet.)

That time would be better spent just creating more systems to harvest more data.

Re:Why would they need basic auth? (1)

phoenixwade (997892) | more than 6 years ago | (#23326872)

So what?

When you can collect that much data that quickly it has very little value.
What do you base that assertion on? I can't, in my experience, correlate the value of data to the time it takes to acquire it.

What's more, I suspect that the fact that all that data was harvested implies value.

Re:Why would they need basic auth? (3, Insightful)

CodeBuster (516420) | more than 6 years ago | (#23318712)

Well, if they were planning to sell the pilfered information then it helps if their...ahem...customers cannot simply help themselves.

Re:Why would they need basic auth? (3, Insightful)

Anonymous Coward | more than 6 years ago | (#23319156)

Maybe its a free sample?

Re:Why would they need basic auth? (5, Interesting)

NoobixCube (1133473) | more than 6 years ago | (#23318714)

My first thought was, surely someone who accumulates this kind of data would go to some lengths to secure it. That leads me to believe that this "crime server" is owned by an amateur. The computer crime equivalent of a petty thief. Imagine how many properly run and hidden crime servers must exist. And think how many more petty thieves must own similar ones.

Re:Why would they need basic auth? (1)

Oriumpor (446718) | more than 6 years ago | (#23319330)

Unless the criminal is a complete idiot there's more than one drop spot... I mean, obviously you wouldn't want to design this sort of single point of failure into any C&C system.

Maybe our "crimeserver" is really a "harvester?" (4, Insightful)

yuna49 (905461) | more than 6 years ago | (#23320558)

Unless the criminal is a complete idiot there's more than one drop spot...

Indeed. If I were writing botnet software I'd distribute multiple copies of the collected data across a number of the compromised computers. The press release and article abstract indicate that the botnet control programs and the data were located in the same place. That doesn't seem like a particularly good architecture for this type of system. I'd keep the command programs far away from the harvested data. My hunch is that the data aren't that valuable as I outline below.

I can accept that buying, installing and running a botnet could be as easy as installing an RPM. What appears more disturbing is the reported "timeframe of less than a month" to harvest over 5,000 records. But what kind of records are these? Finjan tells us [finjan.com] that the data "consisted of 5,388 unique log files [my emphasis]. Both email communications and web-related data were among them."

They go on to list some specific examples:

Compromised patient data
Compromised bank customer data
Business-related email communications
Captured Outlook accounts containing email communication

I'd be curious to see how much actual "patient" or "bank customer" data is revealed in "log files." /var/log/maillog on my servers would certainly reveal "business-related email communications" in the sense of senders and recipients. Mail logs might also contain some entries for mail between providers and patients or between banks and their customers. Apache logs wouldn't be so useful, though they do contain the usernames when Basic Authentication is used. But none of those logs would reveal much about the content of those communications. I don't know anything about Outlook so I have no idea how its logs might reveal "captured Outlook accounts containing email communication."

Still if all they got after a month were logs, I'm not sure how valuable they would be unless the goal was harvesting addresses for spamming or phishing. Capturing the logs of compromised mail servers would certainly yield a pretty high proportion of legitimate addresses, especially recipient addresses. This method seems especially attractive if you're trying to identify targets for "spear-phishing." If you can compromise some corporate mail servers, you can build up a nice list to "spear."

So I'm guessing Finjan found a machine containing some 5,600 mail server "log files" totalling 1.4 GB. Since the logs are worthless once the addresses are harvested, protecting them isn't much of a priority. I suppose competitive spammers might want to keep these potentially higher-yielding names to themselves, but given the volumes at which spammers operate, they probably don't care.

I think I'll go take a look at my mail servers now just to ease my mind.

Re:Maybe our "crimeserver" is really a "harvester? (1)

hesaigo999ca (786966) | more than 6 years ago | (#23322646)

I agree, and also believe that any true malware writer will also incorporate
p2p torrent download technology so that a file of 1.4 gb. can be shared by all
child nodes within a network if so chose to ...and the download time would be minimal.

Therefor, a botnet with 1000 pcs...could easily host a few hundred copies...

Re:Maybe our "crimeserver" is really a "harvester? (1)

warkda rrior (23694) | more than 6 years ago | (#23324332)

I'd be curious to see how much actual "patient" or "bank customer" data is revealed in "log files." /var/log/maillog on my servers would certainly reveal "business-related email communications" in the sense of senders and recipients. Mail logs might also contain some entries for mail between providers and patients or between banks and their customers. Apache logs wouldn't be so useful, though they do contain the usernames when Basic Authentication is used. But none of those logs would reveal much about the content of those communications. I don't know anything about Outlook so I have no idea how its logs might reveal "captured Outlook accounts containing email communication."

You are assuming that the discovered log files are logs copied verbatim from the victim machines. It is more likely that these are logs of collected data (e.g., keystrokes, mouse clicks, screen snapshots, actual emails) captured using spyware or keyloggers.

If that is the case (and the story does not make it clear), then such logs certainly contain credentials and other identifying information to allow anyone to access bank accounts, private patient data, and so on.

Re:Why would they need basic auth? (1, Insightful)

Anonymous Coward | more than 6 years ago | (#23319366)

What amazes me is how quickly people adopt meaningless buzzwords like "crimeserver".

Re:Why would they need basic auth? (1)

NoobixCube (1133473) | more than 6 years ago | (#23320188)

I only used it because it was used in the article. Little things like making sense just seem to matter to me, so I wasn't going to reinvent the wheel by using my own word for something already named in the story. It may have a particular name already ('server' on it's own seems good enough), but since I'm talking about this story, I'll talk within it's terminology. Hence the quotation marks on "crime server", when I used it.

Re:Why would they need basic auth? (1)

bhhenry (83946) | more than 6 years ago | (#23320298)

What amazes me is how quickly people adopt meaningless buzzwords like "crimeserver".
Hey! It's a unique skill to be able to come up with virulent memes.

Re:Why would they need basic auth? (1)

darkfire5252 (760516) | more than 6 years ago | (#23319444)

Well, my thought was this: If they leave the info unguarded, they run the risk of someone stumbling on to the data and sharing their work. If they put effective authentication methods in place on the data, then they have established a definitive link between themselves and the data. They can claim innocence if by some stroke of bad luck they are being monitored and are caught logging in, but not if they use their personal GPG key to authenticate.

Re:Why would they need basic auth? (1)

bluefoxlucid (723572) | more than 6 years ago | (#23319686)

They were credit card numbers, not MP3s. Only pirates go to great lengths to secure their stolen goods.

Re:Why would they need basic auth? (1)

NoobixCube (1133473) | more than 6 years ago | (#23320170)

If I were to steal a credit card number, I'd want to be the only person with access to it, so I could max it out. Otherwise it's the same as robbing a bank and storing all of the cash safely in the town square.

Re:Why would they need basic auth? (0)

Anonymous Coward | more than 6 years ago | (#23320630)

Actually the town square wouldn't be a bad idea... most people ignore money lying on the street unless they can pick it up without being seen (you rarely hear of someone finding money in a crowd for example)...

Re:Why would they need basic auth? (1)

dintech (998802) | more than 6 years ago | (#23322352)

Depends which country you live in. I'm sure it's quite common in, you know, that really dodgy one.

Re:Why would they need basic auth? (1)

encoderer (1060616) | more than 6 years ago | (#23322706)

Sure. But that's not a likely scenario.

What's likely is that if you were to steal a credit card number, you'd also steal 20 others that day, and 20 more the next, and so on.

And all of a sudden the value of a given CC is almost zero.

A more apt analogy would be like a bank robber stealing $100,000 and fretting over each $100 bill. If YOU dropped $500 finding it would be your #1 priority. The same could not be said of that bank robber.

Re:Why would they need basic auth? (3, Insightful)

dbIII (701233) | more than 6 years ago | (#23321146)

The slang is "script kiddie".

Re:Why would they need basic auth? (1)

encoderer (1060616) | more than 6 years ago | (#23322668)

But that's honestly a little naive.

It's like the guy that steals your mail to get your account numbers. Do you think he shreds those when he's done with it?

The cost of data-loss to these criminals is so low to nearly be non-existent.

It's simple threat assessment / risk analysis.

Re:Why would they need basic auth? (0)

Anonymous Coward | more than 6 years ago | (#23324812)

Well, look at it this way. They found this server. Thats proof positive the guy is a script kiddy, not a true net rogue.

I've been involved in a couple efforts to track down attack vectors that my network was experiencing. We even had the FBI and some other group of suites (no names, no badges, you tell me) working with us, and we got NOWHERE.

Sure, we back traced the DDOS to a couple thousand machines. But we never found the command server, or any links to the organizing group behind it.

The FBI told us "don't worry, it was probably just some kids goofing off, it's not like they targeted you personally".

Right, so the 4 days where our net connection was flooded and our server left on a semi-permanent smoke break, that was just kids messing around?

WTF?

Re:Why would they need basic auth? (-1, Troll)

NeverVotedBush (1041088) | more than 6 years ago | (#23319144)

I was hoping the article would say what kind of OS this crime server was running. It doesn't.

But they do speculate that the people/person running it were/is amateurs.

Hmmmmm. I wonder what OS they were running... Hmmmm... ;-)

Re:Why would they need basic auth? (-1, Troll)

twatt3r (1284850) | more than 6 years ago | (#23319308)

Of course they were running M$ Windoze.

Bill Gates is the devil. He murders orphans.

The 2.6 kernel runs on kitten smiles. The NT kernel runs on the red, slick blood of decapitated newborns.

Lol M$

Re:Why would they need basic auth? (1)

jeiler (1106393) | more than 6 years ago | (#23319648)

I was hoping the article would say what kind of OS this crime server was running. It doesn't.

Forget the OS--I want to know what the IP address is. [evil grin]

Re:Why would they need basic auth? (5, Interesting)

Opportunist (166417) | more than 6 years ago | (#23319616)

This might come as a surprise, but scammers are not necessarily more tech savvy than their victims.

This isn't the first completely unprotected (or default password protected) scammer server. Actually, a certain security company which I won't name (but you can guess it...) will have a hard time working with certain other security companies from now on since there are things you don't yap about. Those hardly-if-ever protected ID-theft servers is one of those things.

The reason is twofold. First of all, those criminals with a minimal technical knowledge (most of the times, those drop servers are part of the package you buy from someone who does actually know how to use a computer and write the necessary client/server package to steal information) might start wisening up and protect their servers better, making our work harder. It's the whole "the less your enemy knows about you and the more you know about your enemy, the better" thing.

The second reason, though, is even more important. When it becomes "mostly common" knowledge that there are servers stuffed with stolen information, a second part of the criminal chain opens. Well, opens isn't the right word, it already opened, but it will have a wider, let's say, audience. People who want that information for their own goals won't infect your machine but rather try to steal from the thieves, multiplying the problem in proportions that cannot even be measured anymore. So far, we have a pretty good picture of the threat and problem, knowing (or at least being able to estimate) how many people are infected by a certain trojan, what information is siphoned and by the actions taken thereafter, we can draw a picture of the threat, the goals of the group that siphoned the information and so on.

If now many criminals start working with the same data base, it becomes a damn lot harder to even try working out a threat scenario.

That's why this is being kept on a low profile, and why nobody so far went out into the broad public about it. It's one of those "don't give them ideas" doctrines. I was certainly not in favor of the idea when it was presented, because withholding information does rarely lead to more security. I just couldn't offer a better solution. Or at least a better broom to keep the ocean at bay.

Re:Why would they need basic auth? (1)

WaltBusterkeys (1156557) | more than 6 years ago | (#23319666)

When it becomes "mostly common" knowledge that there are servers stuffed with stolen information, a second part of the criminal chain opens.
Just what we need -- thieves stealing from thieves. Except here the problem is that the information (your name, address, social security number, bank account numbers) is all digital and can be copied an infinite number of times. If a thief steals from a drug dealer ("rip and run") then the drug dealer knows he's been hit and is likely to take security measures. If thief steals from an identity thief, it might not even be obvious that anything was taken until it's already too late.

This is why it's VERY important to lock down your info in the first place. There are too many leaks [reputation...erblog.com] in the identity chain already. There's no need to give thieves information, especially if it can be stolen from one thief by another and copied yet further.

On the other hand, maybe there will be online gang wars one day between competing criminal identity theft enterprises?

Re:Why would they need basic auth? (2, Interesting)

Lobster Quadrille (965591) | more than 6 years ago | (#23320344)

...As if there aren't already?

I mean, it's not like we have regular drivebys, but Russian spammers keep getting found dead... You do the math.

Re:Why would they need basic auth? (1)

Missing_dc (1074809) | more than 6 years ago | (#23323318)

I seem to recall different rootkits disabling each other, around the time that mytob was released (may have been related to mytob)

Re:Why would they need basic auth? (1)

MoonlightSeraphim (1253752) | more than 6 years ago | (#23320326)

kick ass. and u just posted one of those "don't give them ideas" idea on a slashdot ...

Re:Why would they need basic auth? (0)

Anonymous Coward | more than 6 years ago | (#23322576)

I call bullshit.

There are multiple documented cases where caches of data have been found, and widely documented. These have been done by security researchers, and reported on widely in the media and security related web sites.

I wrote a (internal) document on such a cache in 2006 using a template that was based on... you guessed it, a previously reported case by a well known security researcher. The .PDF document from Finjan is very similar to this same template.

This is already widely known and reported on in security circles. Your argument that it's "secret" doesn't hold merit.

Re:Why would they need basic auth? (1)

Opportunist (166417) | more than 6 years ago | (#23323238)

It's been widely known in security circles. It's even been a panel on last years VB conference, and the discussion and exchange of data within security circles had a peak time a few months ago. But there has been little communication to the outside, simply because of the reasons I outlined before.

It's not secrecy. This isn't some top secrety conspiracy bullshit. It's simply a matter of making your work no harder than entirely necessary.

Where do you think the data came from (1)

bobwrit (1232148) | more than 6 years ago | (#23318680)

MS of course. Security is so bad with Windows that this doesn't even suprise me.

Re:Where do you think the data came from (0, Offtopic)

dedazo (737510) | more than 6 years ago | (#23318806)

No, it comes from people who use Microsoft products and can't be bothered to patch their systems, or in the best of cases are dumb enough to install that REALLY SUPER COOL SCREENSAVER!!!! that britaney3345@zuppahfiles.cc was kind enough to send to them.

Re:Where do you think the data came from (4, Funny)

antic (29198) | more than 6 years ago | (#23319002)

Can you at least obfuscate my email address if you're going to be so rude as to post it publically? Plus the screensaver was really quite super cool.

Screen Saver... (3, Interesting)

Belial6 (794905) | more than 6 years ago | (#23319260)

Is there any legitimate reason that screen savers in every single OS should not be 100% sandboxed? Is there even one OS that does sandbox the screen savers? Heck, there are not even that many screen savers that have a use for network access. You should have to explicitly authorize your sandboxed screen saver to have network access. As far as I know, every single OS is guilty of this security hole.

Re:Screen Saver... (1)

WaltBusterkeys (1156557) | more than 6 years ago | (#23319580)

I can think of plenty of reasons why a legitimate screensaver would want Internet access. There are plenty of screensavers that use Flickr or other photo sites as source images. Others put up ambient environmental data, such as cloud maps or weather. And others put up sports info. People use their screensavers for entertainment, not just prevention of burn-in.

The screensaver should be subject to the same HIGH security standards as everything else. There's no reason to give it more or less permission.

Re:Screen Saver... (0)

Anonymous Coward | more than 6 years ago | (#23319732)

That would be fine if the file was actually a screen saver. However, it's more likely the file just says it's a screen saver and is really the malware executable that then installs a random screen saver to try and avoid suspicion.

Most users won't know or care enough to check if a file they download is actually what it says.

Re:Screen Saver... (1)

freyyr890 (1019088) | more than 6 years ago | (#23320586)

In Windows, a screensaver is just an executable with its extension changed to .scr

Yes and that is just insane (2, Interesting)

dreamchaser (49529) | more than 6 years ago | (#23322414)

I never understood why they didn't put in some sort of interpreter and make SCR files some kind of bytecode that can only display graphics data. SCR files are a HUGE vector of malware infection because of the absolutely insane design they used.

Just to short cut the 'Screensavers need network access! I want my Flickr photos to display...or my Weather data to display', etc., IT IS A SCREEN SAVER. It's purpose is to secure and protect your computer and screen when you aren't using it. WTF are you doing sitting there staring at your screensaver? Good pot?

Re:Screen Saver... (1)

The MAZZTer (911996) | more than 6 years ago | (#23320674)

Your solution wouldn't fix the problem. The "screen saver"'s "installer" can easily be the source of the virus or trojan or whatever instead of the actual "screen saver". And installers are expected to have to run with elevated privileges (especially in Vista since Program Files can't be written to without them).

Re:Screen Saver... (1)

Belial6 (794905) | more than 6 years ago | (#23325458)

What are you talking about? There is no excuse for a screen saver to have an installer. It makes no more sense than having an installer for the text document that you just downloaded, or for a jpg picture that you just downloaded. So, there are no excuses for running anything to do with a screen saver outside of a sandbox.

Re:Where do you think the data came from (0)

Anonymous Coward | more than 6 years ago | (#23319872)

I'm too lazy to log in, but Microsoft products aren't the only thing vulnerable to such exploits. Linux "n00bs" don't know how to properly secure their boxes. Especially the "n00b" Ubuntu/Knoppix/Morphix users. They think just because it's Linux, it is secure out of the box, when in reality it just gives off a false sense of security. I'm not singling Ubuntu out, but it is the most easily recognized distro, and when most non-tech-savvy people hear "Linux", they think "Ubuntu" so that's why I used it in my analogy. If you even want to call it that.

Yeah, I know it's somewhat off-topic but just blaming Microsoft and Microsoft alone gets on my nerves.

Re:Where do you think the data came from (1)

mikael (484) | more than 6 years ago | (#23323716)

The vmslice.c exploit was the most impressive that I have seen. Instant root access from a little executable.

oh yea (-1, Offtopic)

Anonymous Coward | more than 6 years ago | (#23318684)

whats the difference between a pile of bricks and a pile of dead babies?

you can move one with a pitchfork!

WTF (3, Interesting)

ColdWetDog (752185) | more than 6 years ago | (#23318692)

The person that operated this server had no clue on security, he had no clue about how to configure a Web server. He just took a ... toolkit and started to use it and in three weeks he managed to have this fortune, this treasure on his server."

I know it's just a rehash of a press release, likely taken out of context from what was originally said, but - WTF?

I don't think that malware is so advanced that all you have to do is "use a toolkit" and poof - magically financial and personal data will just show up on the hard drive. Maybe the guy's server was pawned - he is at least acting like he doesn't know what he is doing, but come on.

If it's that easy, I'm gonna try it....

Re:WTF (4, Funny)

Bryansix (761547) | more than 6 years ago | (#23318716)

If it's that easy, I'm gonna try it....
I'll make sure to alert the authorities.

Re:WTF (1)

infonography (566403) | more than 6 years ago | (#23318894)

If it's that easy, I'm gonna try it....


I'll make sure to alert the authorities.
They will be expecting the usual payment.

I kind of was kidding when I started this joke, but I think it isn't really that much of a joke considering status they found that server in. It may well have been a gift of junk data, stuff they couldn't use anyway. If you can write malware and don't lock the server it goes to you are doing that for a reason not in error.

I not only look gift horses in the mouth I do DNA testing.

Re:WTF (1)

WK2 (1072560) | more than 6 years ago | (#23319350)

If it's that easy, I'm gonna try it....
I'll make sure to alert the authorities.

Bryansix, what part of this sounds like we should involve the authorities?

Re:WTF (1)

Bryansix (761547) | more than 6 years ago | (#23324534)

Wooosh!

Re:WTF (3, Insightful)

epiphyte42 (1236934) | more than 6 years ago | (#23318850)

I know it's just a rehash of a press release, likely taken out of context from what was originally said, but - WTF?

If it's that easy, I'm gonna try it....

Did you consider the fact that the stuff that does all the hard work is actually .... software?! In other words, if some black hat makes a nice package with a decent installer and good documentation it could well be that it is less complicated to setup such a server then, say, setting up a decent webserver. The app in question would then do something like: 1: look for vulnerable pc's 2: infiltrate weak ones with preprogrammed stuff 3: send data back to simple integrated webserver 4: goto 1 The components at 2 could even fit into a nice plugin architecture to enable other black hats to extend the functionality. Yes, this stuff exists and yes, this stuff is easy to use.

Re:WTF (1)

darkfire5252 (760516) | more than 6 years ago | (#23319486)

Oblig. mention of the Metasploit project [metasploit.com] .

Re:WTF (4, Funny)

commodoresloat (172735) | more than 6 years ago | (#23319196)

Maybe the guy's server was pawned
Why would you take a server with all that valuable data to a pawn shop?

Re:WTF (0, Redundant)

New_Age_Reform_Act (1256010) | more than 6 years ago | (#23320376)

probably he want to say "pwned" instead of "pawned". Big difference here.

Re:WTF (0)

Anonymous Coward | more than 6 years ago | (#23320456)

Whooooooosh.

Re:WTF (1)

penguinbrat (711309) | more than 6 years ago | (#23319248)

In my day to day administration duties of your average admin maintaining your average server, the exploit scripts that attack Linux boxen are either on autopilot or obtaining the search parameters remotely - if searching for exploits from a static/dynamic list is successful, it's not that far of a leap to imagine a list of parameters to search for valuable data.

The stuff I see sometimes in /tmp, will never cease to amaze me.

Re:WTF (2, Interesting)

DogDude (805747) | more than 6 years ago | (#23319268)

I don't think that malware is so advanced that all you have to do is "use a toolkit" and poof - magically financial and personal data will just show up on the hard drive.

Actually, it IS that easy. Tools like that have existed for years. Anybody with malicious intent and even a basic understanding of computers can easily run their own bot-net. Really. Literally a few button clicks, and the data is yours.

Re:WTF (0)

Anonymous Coward | more than 6 years ago | (#23319792)

If it's that easy, I'm gonna try it....

The closer we get to 2010, the more it looks like the Uplink Corporation [goeszen.com] was for real.

So you have to a CISSP to run a script now? (5, Insightful)

mungmaster2000 (1180731) | more than 6 years ago | (#23318774)

"The server was not secure at all. It indicates that these people that are doing the crime today, they are not security experts, they are not computer science experts." Uhhh....So someone knocks over a liquor store with a 9 mm. Does that mean that he's a gunsmith or a sharpshooter, or skilled in advanced war-fighting techniques of some kind? No...Chances are he's a just a guy with a gun. People use whatever they can to take what they want. Film at eleven.

Re:So you have to a CISSP to run a script now? (4, Informative)

moderatorrater (1095745) | more than 6 years ago | (#23318782)

People use whatever they can to take what they want. Film at eleven.
The news is that this stuff is now as easy to use as a 9mm.

Re:So you have to a CISSP to run a script now? (1)

ShawnDoc (572959) | more than 6 years ago | (#23318910)

But its honestly not that much harder. Plenty of trojan programs out there that are pretty much ready to go.

Re:So you have to a CISSP to run a script now? (0, Troll)

Kamokazi (1080091) | more than 6 years ago | (#23319570)

A 9mm is easy???

You realize that those things have SAFETY SWITCHES?!?!

What are you supposed to do with that thing? I'm no gun expert....does the orange dot mean it's on or off?!?! And does on mean the gun is on or the safetey is on? Ahhh!!! I really don't want that kind of confusion in a deadly weapon! I'll stick with a sword. No buttons, switches, or triggers. Pointy end goes into human. Done.

Re:So you have to a CISSP to run a script now? (1)

moderatorrater (1095745) | more than 6 years ago | (#23319752)

I really don't want that kind of confusion in a deadly weapon! I'll stick with a sword. No buttons, switches, or triggers. Pointy end goes into human. Done.
So, how's your program written in BASIC coming?

Re:So you have to a CISSP to run a script now? (1)

Lobster Quadrille (965591) | more than 6 years ago | (#23320374)

a 9 is point and click, but it doesn't have a nice gui like metasploit does.

Yep (2, Funny)

Cryacin (657549) | more than 6 years ago | (#23320522)

The news is that this stuff is now as easy to use as a 9mm.
Yep - Standard point and click interface.

Re:Yep (1)

NeoSkandranon (515696) | more than 6 years ago | (#23326158)

If it just goes click you may be in trouble...

Re:So you have to a CISSP to run a script now? I'm (1, Troll)

davidsyes (765062) | more than 6 years ago | (#23319152)

Waiting for the headline:

"Thief robs liquor store in 255 lines of Haiku; no weapons involved. Story at 11."

Bid #4325 (1)

d3l33t (1106803) | more than 6 years ago | (#23318810)

5 dollars, do i hear 5 dollars

Turkey? (1)

solweil (1168955) | more than 6 years ago | (#23318854)

Why is Turkey at the top? I had not heard before that Turkey is a haven for unpatched machines. Maybe mainly a local or Kurdish crimeserver?

Re:Turkey? (1)

djdavetrouble (442175) | more than 6 years ago | (#23319972)

Maybe that was one of the first IP blocks scanned and rewted..

Security company finds unsecure server (5, Insightful)

Whuffo (1043790) | more than 6 years ago | (#23318860)

Must be a slow news day for this kind of astroturf to bubble to the top. Notice how carefully they count how many people in each country had their data stolen and stored on this server. Also notice how many of those people these security folks notified of the data breach. Yup, exactly zero.

So they're not trying to help at all. What they're trying to do is sell their services and using this pseudo-news article to do it. Shame on them.

Re:Security company finds unsecure server (1)

Frosty Piss (770223) | more than 6 years ago | (#23319118)

Must be a slow news day for this kind of astroturf to bubble to the top.
If you pay attention, you'll see that about 60% of "stories" on Slashdot fit the Astro Turf profile.

News flash, oh SlashDrones, Slashdot is like Google, a commercial money-making business . WORD...

Re:Security company finds unsecure server (2, Insightful)

TubeSteak (669689) | more than 6 years ago | (#23319168)

Also notice how many of those people these security folks notified of the data breach. Yup, exactly zero.
What are the odds that one of "those people" would sue the security firm?
Even white hats have to deal with the PHB who wants to blame you for their problem.

Re:Security company finds unsecure server (4, Informative)

camperslo (704715) | more than 6 years ago | (#23319428)

Notice how carefully they count how many people in each country had their data stolen and stored on this server. Also notice how many of those people these security folks notified of the data breach. Yup, exactly zero.

People may not have been contacted directly, but those in a good position to quickly mitigate damage were notified:

"Finjan Inc said it had notified the U.S. Federal Bureau of Investigation, police in various countries and more than 40 financial institutions in the United States, Europe and India about the discovery of the so-called "crimeserver".

So they're not trying to help at all. What they're trying to do is sell their services and using this pseudo-news article to do it.

Do you actually have any evidence of this? What were they trying to sell to who?
I would expect a press-release type of promotional piece to have more information about the services the company offers.

Re:Security company finds unsecure server (1)

Antique Geekmeister (740220) | more than 6 years ago | (#23321198)

It should really be handled by the Secret Service: they're responsible for wire fraud, as the law enforcement arm of the Department of the Treasury. They've shown little signn over the years of being competent at managing computer crime, but it is their job.

1downmillionstogo (0)

Anonymous Coward | more than 6 years ago | (#23318864)

Please tag with "1downmillionstogo". A single server with 1.4GB of data is hardly newsworthy. Unless this "crimeserver" also contains the missing Whitehouse emails... in which case my only question is whether the torrent has been released yet.

HoneyPot (2, Insightful)

camperdave (969942) | more than 6 years ago | (#23319082)

Oddly enough, the data was stored in the open, with not even basic auth to protect it.

Sounds like they found a honeypot [wikipedia.org] or a decoy to me. Now that the bad guys know that the good guys are on to them, they can disappear into the ether for a while until the heat dies down.

Re:HoneyPot (4, Interesting)

Lumpy (12016) | more than 6 years ago | (#23319178)

Actually that's called a tripwire. Back in the 80's when I knew some hackers really well I helped set up several tripwires. They went hand in hand with modem hop points. You Social engineer into an office building, best is a multi business place. get to the phone room and fine a couple of demarc boxes that are old and gut them. Install a pair of modems back to back and you can hop from one phone line to another to mask your call if it's traced.

to make a tripwire you add in a second box like that, have your outgoing line go into and out of the box, install a isolation relay or switch that when the box is opened it dumps 120VAC into the phone lines This typically smokes a modem hard making it impossible for them to recover any info inside it. (mostly designed to piss off the feds/cops) but it disables the modem and the line tipping you off that that relay has been compromised.

worked well, One "friend" had 5 of his relays compromised in one night, tipping him off that something big was happening and he laid low for a while.

Re:HoneyPot (1)

elmuhfuh (942644) | more than 6 years ago | (#23319926)

Actually that's called a tripwire. Back in the 80's when I knew some hackers really well I helped set up several tripwires. They went hand in hand with modem hop points. You Social engineer into an office building, best is a multi business place. get to the phone room and fine a couple of demarc boxes that are old and gut them. Install a pair of modems back to back and you can hop from one phone line to another to mask your call if it's traced. to make a tripwire you add in a second box like that, have your outgoing line go into and out of the box, install a isolation relay or switch that when the box is opened it dumps 120VAC into the phone lines This typically smokes a modem hard making it impossible for them to recover any info inside it. (mostly designed to piss off the feds/cops) but it disables the modem and the line tipping you off that that relay has been compromised. worked well, One "friend" had 5 of his relays compromised in one night, tipping him off that something big was happening and he laid low for a while.
no im pretty sure he meant honeypot. this story reads like a hacker 2600 quarterly monthly stage production.

Re:HoneyPot (0)

Anonymous Coward | more than 6 years ago | (#23322592)

Oh so you are one of those 2600 reading ankle biters that makes people think you are a Uber Hax0r?

how cute. Do you wear all black and bondage pants as well. OHH are skateboards still in for you posers or did you switch to pipmped out mopeds?

You little wanna-be's always made me laugh. Trying to act all cool and leet. you always screw up your bragging and mess up a term or two... I always giggle at you wankers.

Cute how you wannabe's dont know what a honeypot is.

Re:HoneyPot (1)

Antique Geekmeister (740220) | more than 6 years ago | (#23321200)

What relay did you use? The ones that handle 120V reliably tend to be rather expensive.

Re:HoneyPot (1)

Dr_Barnowl (709838) | more than 6 years ago | (#23321838)

They don't need to handle it reliably ; just long enough to fritz the delicate sensitive electronics in a modem.

Re:HoneyPot (1)

camperdave (969942) | more than 6 years ago | (#23322996)

What relay did you use? The ones that handle 120V reliably tend to be rather expensive.

You can get such relays [active123.com] for about six bucks, and if you shop around, I'm sure you could get them cheaper.

Re:HoneyPot (1)

ei4anb (625481) | more than 6 years ago | (#23321514)

120V into a modem would just make the opto-isolator pop like pop-corn but it probably would not damage the rest of the electronics (I have worked on modem design).

The most likely result would be to add "intent to do bodily harm" to the charge sheet, or worse if the telephone company technician was following the wires when someone opened the box :-(

Re:HoneyPot (3, Insightful)

Anonymous Coward | more than 6 years ago | (#23322562)

First telephone wires carry over 90VAC on them all the time.

Second 24Ga wire cant carry any current it smokes out right away.

Thirdly it does in FACT smoke the modems that were made back in the 80's and early 90's Hayes and USR modems back then could be eaten alive easily by 120VAC at any strength inot the phone port, better would be to also run a pair of wires to the modem's power supply side as well.

Fourthly it also pop's the Telco gear at the Switching station dropping the line off so when you call it it does not ring. A very clever way of setting a tripwire.

Remember back in the 80's the police and judges were not a corrupt as now. They did not throw in extra added bullshit for fun. Now the scumbag fuckers will add all kind of charges just to show you who owns the populace.

Unprotected maybe for a reason: (4, Insightful)

Fluffeh (1273756) | more than 6 years ago | (#23319166)

Perhaps this data was intentionally left out in the open by whoever had it first?

If you think about it, if you just hacked into a users pc and nicked something (credit card info, passwords, whatever) and used them quietly to some degree, wouldn't you WANT someone else to use them, perhaps not so quietly? I mean, you want a fall guy right? Let the next script kiddie run through and take the fall. With a bit of luck, they will pin all the activity on the new guy rather than the guy who carefully used this once, then let the information loose on the masses.

It's not "accidentally" or "stupidly" left unprotected, it's a perfect smoke screen to cover tracks if you ask me.

Bullshit (0)

Anonymous Coward | more than 6 years ago | (#23319322)

I think it's another "security" firm trying to make a name for itself..

See also: Storm "security" firms making wild exaggerations and this company selling products in the story itself..

5k "unique" logs isn't much of a "crimeserver" to me. Sounds like a script kiddie with a working toolkit, but if it contained 50k, 500k or 1 million unique hits, I would call it a crime server.

PRESS WHORES (1)

mambosauce (1236224) | more than 6 years ago | (#23319346)

these guys are such press whores. you can google to find a ton of open drop sites like this. the fact that they bothered making ridiculous statistics and press release on something so common just shows how pathetic they are

Spelled: Finjan (1)

thebigo195 (949864) | more than 6 years ago | (#23319352)

The correct spelling is Finjan (not Finjin). The word means a small metal container in which Israelis (and Arabs) cook their coffee.

Re:Spelled: Finjan (1)

the brown guy (1235418) | more than 6 years ago | (#23319536)

since we're getting technical, I am assuming you mean, in which they brew their coffee.

Re:Spelled: Finjan (1)

ColdWetDog (752185) | more than 6 years ago | (#23320512)

since we're getting technical, I am assuming you mean, in which they brew their coffee.

Ever had Arabic coffee? "Cook" is a more appropriate term.

drugs on the table (1)

sixpenny_83 (1248146) | more than 6 years ago | (#23320566)

1 hard drive doesn't make for a very impressive visual aid.

safety in numbers (1)

Bronster (13157) | more than 6 years ago | (#23321340)

this huge trove of data gathered over a short period of time indicates that the crimeware problem is far larger than most observers have been assuming.

Maybe so - but conversely they may not be able to use all of it (at least for time-limited things like credit cards) before it's expired, making me happy that they have lots of data, because when (not if) my data gets stolen from somewhere, I'm less likely to be one of those exploited. Whee.

Old news (1)

simplypeachy (706253) | more than 6 years ago | (#23321594)

Gee what gripping news of cutting-edge malware research; I found one of these, of similar size, two years ago. The FTP credentials were in plain text in a config file dropped by the malware. It was childs play getting in and getting enough info for authorities to do something about it. Shortly after that it disappeared. It was created by stupid people who were playing with things they didn't really understand, although I'm sure they understood the $$$. I remember thinking at the time "this would be cool if it wasn't so boringly easy". How wrong I was! Should have cranked up the PR machine and posted it to slashdot!

Unprotected Data == Deniable Data (1)

giafly (926567) | more than 6 years ago | (#23322502)

Oddly enough, the data was stored in the open, with not even basic auth to protect it
I'd do this if I wanted to frame the server owner, or if I were the server owner and planned to deny everything and claim it was a plot to frame me.

Cool! A Minnie Driver / Anne Hathaway love scene! (1)

Impy the Impiuos Imp (442658) | more than 6 years ago | (#23326240)

> a server found by security firm Finjin that contained a 1.4-GB cache of
> stolen data, accumulated over a period of less than a month from
> compromised PCs around the world. The "crimeserver," as Finjin dubs it,
> "provided command and control functions for malware attacks in addition
> to being a drop site for data harvested from compromised computers..."

Fucking Morpheus! Can't the feds ever stop this guy?!?!?
Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>