Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Seeking Competitive Advantage, For Malware

timothy posted more than 4 years ago | from the when-jerkfaces-compete-you-lose dept.

Botnet 39

jc_chgo writes "Brian Krebs over at the must-read KrebsOnSecurity.com writes about the rivalry between two competing authors of nasty credential-stealing malware. The newer (SpyEye) can remove the older (Zeus) on any system it infects. Meanwhile, Zeus is so successful prices have gone way up for the new version. These 'crimeware kits' are freely available for purchase, and have enabled millions of dollars in thefts. The buyers of the kits prey primarily on small businesses by using wire transfers out of bank accounts. This is a problem that is only going to get bigger over time."

cancel ×

39 comments

Sorry! There are no comments related to the filter you selected.

Makes perfect sense. (-1, Offtopic)

Anonymous Coward | more than 4 years ago | (#31711078)

It makes perfect sense for the

I wonder if I can even post this...

Let's Look At The Positives (3, Funny)

WrongSizeGlass (838941) | more than 4 years ago | (#31711108)

There are positives to this. If one type of malware can handily defeat another type of malware I'm sure the A/V companies will be able to learn something from it (and up-charge their victims, er, customers accordingly).

There's also the new 'botwars' games that we'll be able to watch from the safety of our non-Windows computers.

Re:Let's Look At The Positives (2, Insightful)

Z34107 (925136) | more than 4 years ago | (#31711124)

You'll be able to watch from the safety of your Windows computers, too. Most of these take advantage of exploits that were patched ages ago - SpyEye is simply cannibalizing Zeus' market.

There's a finite number of negligently unpatched computers out there - and Zeus exists because small businesses do banking on them.

I am on my Windows machine you insensitive clod (1)

SmallFurryCreature (593017) | more than 4 years ago | (#31711142)

I am on my Windows machine you insensitive clod.

Various criminals:Yeah, we too!

Windows, where do you want banking credentials to be sent to today?

Re:I am on my Windows machine you insensitive clod (2, Funny)

jon3k (691256) | more than 4 years ago | (#31711256)

nice sig -- save for the fact that the "group" is composed of 90% men.

Re:I am on my Windows machine you insensitive clod (2, Funny)

Bodhammer (559311) | more than 4 years ago | (#31711466)

nice sig -- save for the fact that the "group" is composed of 90% men.

You mean two of his fingers are female?

Re:I am on my Windows machine you insensitive clod (0)

Anonymous Coward | more than 4 years ago | (#31711518)

Uh, my head hurts trying to imagine female fingers. mm so they would have a slot to take in a male finger?

Re:I am on my Windows machine you insensitive clod (0, Offtopic)

ProfessorKaos64 (1772382) | more than 4 years ago | (#31712240)

Please seek help lolz

Re:I am on my Windows machine you insensitive clod (0, Offtopic)

gzipped_tar (1151931) | more than 4 years ago | (#31712208)

You mean he has 19 fingers?

Re:I am on my Windows machine you insensitive clod (0)

Anonymous Coward | more than 4 years ago | (#31713066)

since when was 2 fingers 10% of 19

Re:I am on my Windows machine you insensitive clod (1)

gzipped_tar (1151931) | more than 4 years ago | (#31713174)

Well, I seemed to have forgotten that toes can also enjoy the right to involve in this activity. But 10% of a 21-member group is not quite an integer. But that's assuming there *are* ten fingers and ten toes.

BTW: Am I being politically incorrect against community members who have an alternative amount of digits?

Re:I am on my Windows machine you insensitive clod (0, Offtopic)

ProfessorKaos64 (1772382) | more than 4 years ago | (#31711772)

It's also nice you can't read, He's making a comparison. He is saying orgasms are better in a groups, just like MMO Quests are better in a group, NOT that he is doing both, I know you are making fun, but your just dumbing down America

Re:I am on my Windows machine you insensitive clod (1)

maxume (22995) | more than 4 years ago | (#31711966)

but your just dumbing down America

Gold.

Re:I am on my Windows machine you insensitive clod (0)

Anonymous Coward | more than 4 years ago | (#31713476)

wow. I don't know what to say other than *woosh*. but judging by your -1 offtopic I think the problem's already been taken care of.

I do like the part where you accuse him of not being able to read followed by "better in a groups" (plural) and then "your just dumbing" (s/your/you\'re).

nice try though.

Re:Let's Look At The Positives (1)

jon3k (691256) | more than 4 years ago | (#31711248)

Except for the fact that 10 million zeus infected windows machines will be spewing spam and scanning all your publicly accessible hosts. Not to mention infecting your friends, family and coworkers and possibly even stealing thousands of dollars from your place of employment.

Re:Let's Look At The Positives (1)

toleraen (831634) | more than 4 years ago | (#31711374)

If my friends, family and coworkers ignored the first 15 emails I sent them telling them to run Windows Update and do a weekly virus scan...that's their fault.

Re:Let's Look At The Positives (1, Insightful)

Anonymous Coward | more than 4 years ago | (#31711602)

Your email was nestled among 20 other emails asking them to install a "software update" because "their computer was vulnerable" Either they installed everything, or they sent your email to the spam folder.

Re:Let's Look At The Positives (1)

jon3k (691256) | more than 4 years ago | (#31713438)

You're missing the point. Fault is irrelevant. We're beyond fault or assigning blame. We have millions of infected computers on the Internet today.

Re:Let's Look At The Positives (1)

toleraen (831634) | more than 4 years ago | (#31713638)

Completely agree as I have to deal with this at work on a daily basis, sometimes it's just more pleasant to trivialize it.

Re:Let's Look At The Positives (0)

Anonymous Coward | more than 4 years ago | (#31713786)

Fault is irrelevant. We're beyond fault or assigning blame.

Fault is the solution. You have to remember that there are still a great many people who, instead of choosing to install malware, choose to not do so. They have competitive advantage.

You can never make blame 100% irrelevant. Even when there are many stupid people who don't blunder into trouble, and non-stupid people who get compromised by stupid people they mistakenly trusted, overall on average, stupidity still punishes itself more than it punishes others. Businesses that still run Windows make slightly lower profits than ones which have modernized. Governments that still run Windows have a few more scandals, a little more election turnover, and emigration due to higher tax rates. Families that listen to family members who know about IT and say "don't install malware," are slightly more harmonious. To say that fault is irrelevant, is to ignore these realities.

Re:Let's Look At The Positives (1)

CrossChris (806549) | more than 4 years ago | (#31717440)

...then it's time to ban Windows machines from the internet.

It IS time to appotion blame - the blame lies squarely with the stupid marketing-based decisions made by the clueless in Redmond, and their fundamental lack of understanding of the basic concept of a security model.

Simple solution: Put those Redmond morons out of business once and for all by disconnecting every Windows machine and then suing them for each machine disconnection from the web - say $50000 per machine, just for the inconvenience....

Re:Let's Look At The Positives (1)

mrmeval (662166) | more than 4 years ago | (#31711606)

No transaction can occur in at our bank without our signature. That means someone has to get off their dead ass and go to the bank and authorize it with proper credentials. It sucks. Someone has a job just to do this. All of the crap is generated on a computer but until that person toddles over there and signs off on it. Nothing happens.

Re:Let's Look At The Positives (2, Informative)

Mattpw (1777544) | more than 4 years ago | (#31712162)

No transaction can occur in at our bank without our signature. That means someone has to get off their dead ass and go to the bank and authorize it with proper credentials. It sucks. Someone has a job just to do this. All of the crap is generated on a computer but until that person toddles over there and signs off on it. Nothing happens.

The problem with alot of these more manual authentication systems is that while it sounds good from a security point of view it is quite possibly easier to circumvent the authentication procedure than the complexity with which the trojans are going through. Alot of people think manual phone based authentication like the SMS authentication option is a good idea however the real authentication strength is only as strong as convincing the targets telephone company to forward all their calls to their "new" number. The real authentication is usually only as strong as knowing the targets birthday or similarly googleable information.

Re:Let's Look At The Positives (1)

mrmeval (662166) | more than 4 years ago | (#31713034)

Gun to the head of the relatives can work. It's a small enough commercial bank that they know our people and we know theirs. We do use technology but not for that last bit.

Queue The DRM Critics (3, Interesting)

WrongSizeGlass (838941) | more than 4 years ago | (#31711162)

FTFA

SecureWorks has noted that the latest versions of Zeus include anti-piracy technology that uses a hardware-based licensing system that can only be run on one computer. “Once you run it, you get a code from the specific computer, and then the author gives you a key just for that computer,” SecureWorks wrote. “This is the first time we have seen this level of control for malware.”

I guess it was bound to happen ... you just can't trust anyone these days. I wonder if either of these 'kits' infects the computer that runs it? Would the authors ever infect their customers?

Re:Queue The DRM Critics (0)

Anonymous Coward | more than 4 years ago | (#31712858)

Would the authors ever infect their customers?

Unlikely. That's the kind of move that can be pulled only once, and it would be too soon for them do close down.

Re:Queue The DRM Critics (2, Funny)

scolbe (236243) | more than 4 years ago | (#31713190)

I wonder if either of these 'kits' infects the computer that runs it? Would the authors ever infect their customers?

oh, don't worry about that... that's just their handy, no fuss zero-click payment system.

Re:Queue The DRM Critics (1)

RobertLTux (260313) | more than 4 years ago | (#31715020)

Due to the more "Traditional Family Values" that can be found in those circles that kind of thing would be "unhealthy".

"It's clear from the Flash ads reproduced here..." (0)

Anonymous Coward | more than 4 years ago | (#31711386)

He's reproducing the Flash ads from a malware seller.

Wow, I've never been more glad to be using AdBlock and NoScript in my life!

What...? (1)

ProfessorKaos64 (1772382) | more than 4 years ago | (#31711730)

How do these guys not get caught? I mean, can't federal agents just set up fake transactions if hes publicly selling it? I know im simplifying it, so I ask anyone here to explain maybe how complicated it may be.

Re:What...? (4, Informative)

Restil (31903) | more than 4 years ago | (#31711972)

Here's the problem:

Assuming the people who wrote and sell this software reside in the US or some country which will happily extradite them for us, it's possible that what they're doing isn't technically illegal. They're not actually USING the software, just selling it. This is somewhat equivalent to someone selling lockpicks. Granted, this software probably has no legitimate purpose, except perhaps to be used for security audits or something. However, even if it IS illegal, to get the Feds involved will require an almost certain guarantee of conviction. They want a jury to be debating the length of the sentence, not whether or not the suspects are actually guilty or not. If there is enough legal doubt as to whether or not a crime was even committed, the Feds will be leery of even getting involved.

So fine, lets pass a law making the creation and/or publication of software that has mostly malicious intent. That'll be good... right? The only problem is, Congress gets to write that law. This means three things. First off, the law will likely be written in a way that is so vague that it ends up not only applying to the software in question, but half of the legitimate software ever written. Before you know it, all advertising, security software, operating systems other than windows, and of course, the ping program, will now be considered illegal.. technically. This means that the law will end up not being enforced. Next, they will be sure to word it in such a way as to render it unconstitutional, so next thing you know, the Supreme Court will tie it up for 10 years, and finally kill it. And finally, you can't pass a law without attaching a large number of completely unrelated riders, which will end up causing parties opposed to the riders to vote against and/or filibuster the bill, which causes the other side to insist that the opposing party WANTS people to have their banking credentials stolen... and so on.

Anyways, to answer your question, Yes. You were simplifying it. It would be MUCH easier to just find a way to sneak a few images of child porn on one of their computers, and shut them down that way. THAT avenue at least seems to have no roadblocks.

-Restil

Re:What...? (1)

ProfessorKaos64 (1772382) | more than 4 years ago | (#31711986)

Perfectly answered everything. Thanks a million man, see people? There are people on slashdot that arn't constant trolls :)

Re:What...? (3, Insightful)

Anonymous Coward | more than 4 years ago | (#31712406)

Look, I know the grandparent was just trying to help, but in real-life people don't do things because of silly slippery-slope arguments.

The reason that this is very hard for law-enforcement to stop is because it is not being done by lone guys in their parent's basements, but because it is business. As a start, read "An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants", http://cseweb.ucsd.edu/~savage/papers/CCS07.pdf

You can buy lists of valid credit card numbers, botnets, root-kitted machines, almost anything. The people who sell this sort of stuff often don't even think of themselves as criminals, just businessmen. When selling rooted machines, they often are careful not to touch machines in their own country, so local law enforcement is unlikely to care, and to avoid things like child porn which the police will really come after them for.

Now, say you are a typical American law enforcement guy and you find out that someone might be involved in this sort of stuff. What do you do? Well, citizens have been complaining about paying taxes so your budget is going to be pretty much nothing. You are also going to be evaluated on how many "bad guys" you catch. And you know that almost as soon as you start investigating that the trail is going to lead to some overseas servers, which means that you are going to have to get the cooperation of law enforcement in other countries. And, you know that even if you get international cooperation then eventually the investigation is going to involve someplace where the local authorities don't care, and all your time will have been wasted. So, knowing this, are you going spend your time starting the investigation? Or are you going to catch a bunch of petty thieves instead and get a nice bonus for stopping crime?

Re:What...? (1)

anarche (1525323) | more than 4 years ago | (#31712418)

Well said, sir! Mod parent up!

A law banning this would probably pass in Australia (don't start on the filter!). We ban sales of spray paint to minors (in case they graffiti), guns to non-farmers (in case they kill someone) etc.

Just get your guys to sell a kit to an Aussie scriptkiddie, track em down (filter anyone?) then organise extradition to Down Under.

Malware competing with each other in the market... (2, Funny)

gzipped_tar (1151931) | more than 4 years ago | (#31711934)

...is still much better than the idea of government-owned, tax-paid malware.

Paraphrasing (1)

DynaSoar (714234) | more than 4 years ago | (#31712710)

"What we need are a few good old fashioned hangings." -- FTC commissioner Orson Swindell at the first FTC spam conference. I'm looking forward to hearing about one of the organized crime associated bots getting whacked by one of the competition, and so the owners of the former return the favor to the author of the (temporary) victor. I suspect it's happened already, but not publicized. Sooner or later one will. Then we'll see some real cyberwarefare. You think the US government has got some cyberwarriors lined up? Fugidaboudit.

It's going to be fixed once it gets big enough... (0)

Anonymous Coward | more than 4 years ago | (#31712742)

If there is *one* thing you can be sure about consumer banks is that they hate losing money *and* time. They *cannot* pass all the burden to the consumers and they *cannot* make up for the lost time in employees dealing with this. Hence once the problem shall be big enough, 100% foolproof solution will come.

Some europeans banks have a physical device into which you need to enter a cryptographic challenge (in which the recipient's bank account number IS part of the challenge). You cannot make a wire transfer without that device / PIN. There's no known MITM attack that works against this. Good game low-lifes.

I hope they fill their pockets while it's not put in place by every single consumer bank around the world, because these devices already started appearing in several banks (repeat after me: the bank account number of the recipient is part of the cryptographic challenge, there's no MITM that can work against that).

Re:It's going to be fixed once it gets big enough. (1)

Alex Belits (437) | more than 4 years ago | (#31714380)

there's no MITM that can work against that

Of course, there is.

Malware will just replace the account number used in a legitimate transaction with one of the scammer.

Re:It's going to be fixed once it gets big enough. (1)

Spiked_Three (626260) | more than 4 years ago | (#31714620)

Agreed. right now, banks do what they can they can to take the easy road to money. For the most part that means accepting any transaction from anyone with no proof of identity or verification of authenticity on transactions. In specific, the credit card companies are the major source of easy money, and they are supplemented with the greed to make an additional transaction fee. In the US, go to your bank and ask 'who took my money?' At best you will get an 800 number to some robo-answering machine. There is no law or agreement that a bank has to tell you who they gave your money to.
And as long as credit cards can absorb the stolen amounts, they are not going to require authentication, as it will inconvenience the consumer and hurt volume.
It took many years for the recent credit rules to get through in the US that had some small dent on the corruptness of banks and credit cards in the US. But they did not go far enough. What used to be called loan sharking in the US is still legal for 'financial institutions'. We are supposed to elect politicians to represent us, what segment of the population was represented by making it 'illegal to charge huge interests rates for the loaning of money, except for financial institutions' ? That is a blatant and obvious sign of how corrupt our political system has become.
Just wait until the malware authors learn about lobbying.
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>