Researcher finds evidence of massive site compromise
Digs up cache of 200,000 site credentials for Fortune 500 firms, weapons makers, governments
Computerworld - Several criminal gangs have acquired administrative log-in credentials for more than 200,000 Web sites -- including the one used by the U.S. Postal Service -- and have used the compromised domains to attack unsuspecting users' PCs with a notorious hacker exploit kit, a researcher said today.
More than a month ago, Ian Amit, director of security research at Aladdin Knowledge Systems Inc., found and infiltrated a server belonging to a longtime customer of Neosploit, a hacker tool kit used by cybercriminals to launch exploits against browsers and popular Web software such as Apple Inc.'s QuickTime or Adobe Systems Inc.'s Adobe Reader.
On that server, Amit uncovered logs showing that two or three hacker gangs had contributed to a massive pool of Web site usernames and passwords. "We have counted more than 208,000 unique site credentials on the server," said Amit, "and over 80,000 had been modified with malicious content."
The site credentials were only the means to an end: The 80,000 modified sites were used as attack launchpads. Each served up exploit code provided by the Neosploit kit to any visitor running a Windows system that had not been fully patched.
By examining the server logs, Amit was able to identify the sites whose log-ins had been compromised; he is now working with law enforcement agencies in both the U.S. and overseas, as well as with organizations like the CERT Coordination Center, to tell site operators they need to change their administrative passwords, purge the malicious code and secure their sites.
The only compromised site he would name was the U.S. Postal Service's at www.usps.gov. That site and others have been cleaned of the code that calls Neosploit down on unsuspecting visitors. Also on the list were sites for governments and Fortune 500 companies, universities and other businesses, including several unnamed weapons manufacturers. More than half of the affected sites belong to European companies and organizations.
Other evidence that Amit gathered ranged from the way the criminals processed the site log-ins to the number of IP addresses authorized to access the credentials.
"The server-based application that validated the credentials and then modified the sites was completely automated," said Amit. "Access to that application was restricted to about six or seven IP addresses, [so] it's clear that that access was intended only for the use of the criminals using the server." Based on the number of IP addresses and their distribution, he estimated that two or three separate groups were involved.
More than half of the site credentials -- approximately 107,000 -- had been validated by the cybercrooks' custom application as providing administrative access to the sites.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Taking Windows Mobile on Any Device Taking Windows applications mobile has many advantages, but the process of identifying a solution is complex. Learn how to solve this complex problem...
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Windows White Papers | Webcasts