Forgot your password?
typodupeerror
Botnet Crime Security United Kingdom IT

Large Zeus Botnet Used For Financial Fraud 68

Posted by CmdrTaco
from the zeus-shorts-out-his-enemies dept.
An anonymous reader writes "A large Zeus version 2 botnet is being used to conduct financial fraud in the UK and is operated from Eastern Europe. The botnet appears to be controlling more than 100,000 infected computers. The criminals have been harvesting all manner of potentially lucrative and revenue-producing credentials — including online account IDs plus login information to banks, credit and debit card numbers, account types plus balances, bank statements, browser cookies, client side certificates, login information for email accounts and social networks, and even FTP passwords."
This discussion has been archived. No new comments can be posted.

Large Zeus Botnet Used For Financial Fraud

Comments Filter:
  • Oh no (Score:5, Funny)

    by Anonymous Coward on Wednesday August 04, 2010 @08:39AM (#33137006)

    login information to banks, credit and debit card numbers, account types plus balances, bank statements, browser cookies, client side certificates, login information for email accounts and social networks and even FTP passwords

    I was not mad right up until that last one and even FTP passwords. They can have all that other crap but when they take my precious FTP password, and I use FTP for all my most critical-to-security interent functions, well...war on buddy.

    • Re: (Score:3, Interesting)

      by gad_zuki! (70830)

      How dare they capture my unencrypted logins?!?! Seriously, its a shame SFTP or FTPS isn't more supported, and by 'more supported' I mean supported by IE and Firefox. I hate how adding encryption to FTP is suddenly "Whoa, whoa, whoa, we only provide basic support on browsers." Funny how they don't say the same thing about HTTPS.

      • Re:Oh no (Score:4, Informative)

        by AndrewNeo (979708) on Wednesday August 04, 2010 @09:19AM (#33137484) Homepage

        I don't know if you honestly expect Microsoft to add useful features to IE, but at least with Firefox that's what addons are for [mozilla.org].

        • by gad_zuki! (70830)

          Add-ons arent a solution. Unless a huge install base has it then its not worth using for a general audience. That like saying "Here's an add-on for HTTPS, toodles!" At that might you might as well spend those 30 seconds just installing a stand-alone FTP client that supports FTPS/SFTP instead of trying to shoehorn it into the bloat that is your browser.

          • Re:Oh no (Score:4, Insightful)

            by datapharmer (1099455) on Wednesday August 04, 2010 @10:05AM (#33138094) Homepage
            the browser support for ftp is typically intended for anonymous browsing. If you want full fledged support for ftp and its secured variants get an ftp client. I don't complain that filezilla doesn't browse the web well...
            • by gad_zuki! (70830)

              This is the same mentality that keeps millions of smtp servers using unencrypted plain-text. I really don't think adding basic encryption should be seen as such an extravagant request. Unfortunately, a lot of people don't take security seriously and they are in charge of some pretty major corporations and popular products.

              >the browser support for ftp is typically intended for anonymous browsing.

              Except its not. Even Firefox allows non-anonymous browsing (uses username/passwords) and IE can do uploads. For

              • by cnastase (1504381)

                This is the same mentality that keeps millions of smtp servers using unencrypted plain-text. I really don't think adding basic encryption should be seen as such an extravagant request. Unfortunately, a lot of people don't take security seriously and they are in charge of some pretty major corporations and popular products.

                That's why you have PGP/Gnupg and the like. Besides, who has time to read someone else's mails? I barely have time to read my own!

                Except its not. Even Firefox allows non-anonymous browsing (uses username/passwords) and IE can do uploads. For 99.9% of FTP users, the FTP client is the browser.

                Blasphemy to be honest. Browsers are for por^H^H^Hbrowsing, get an FTP client for massive downloads. Soon you'll be asking for mail servers to allow you to send more than 5M attachments. Who do you think you are? Mooo

            • by orange47 (1519059)
              no, because when I see a ftp link to file I want to click on it and it downloads, that simple. I dont want to start a ftp client, then decrypt javascript html to enter pass, change dir... for a single file. damn firefox still doesnt support ACTIVE FTP grrrr
          • by nstlgc (945418)
            At that might you might as well spend those 30 seconds just installing a stand-alone FTP client that supports FTPS/SFTP instead of trying to shoehorn it into the bloat that is your browser.
            I think you just answered your own question.
        • I tend to agree with the post post to your post....I think FF should come standard with that, the same as it does for https....you do not need to download extra add on for https, so why sftp

    • by davidwr (791652)

      I keep my Financial Password Protocol password written down on a piece of paper, locked securely in a safe-deposit box in one of Warsaw's larger banks.

  • Again ... (Score:4, Funny)

    by krzysz00 (1842280) <krzysdrewniakNO@SPAMgmail.com> on Wednesday August 04, 2010 @08:40AM (#33137012)
    Breaking News: Another XXl botnet steals bank account numbers. However, the acquisition of emails and Facebook accounts is worrying.
    • by 1s44c (552956)

      Breaking News: Another XXl botnet steals bank account numbers.

      However, the acquisition of emails and Facebook accounts is worrying.

      It's the bank login details that are worth money, not the facebook logins.

      • by krzysz00 (1842280)

        Breaking News: Another XXl botnet steals bank account numbers.

        However, the acquisition of emails and Facebook accounts is worrying.

        It's the bank login details that are worth money, not the facebook logins.

        Yeah, but Facebook and emails can be used for social engineering to gain more bank account numbers.

      • by oldspewey (1303305) on Wednesday August 04, 2010 @09:40AM (#33137760)
        Are you insane? With a facebook login, these people could mess with my FarmVille and CafeWorld apps.
    • by daem0n1x (748565)
      Massive Financial Fraud? Wait until Wall Street gets their hands on this. It will be a boom!
  • by Anonymous Coward on Wednesday August 04, 2010 @08:43AM (#33137054)

    Zeus version 2

    So, like a good little early adopter, I upgraded and installed version 2 on my machine only to find that it was a huge bloated piece of crap. The original Zeus was so much more simple and elegant and now this thing is just chewing up cycles. Yeah, like the customer won't notice that. Seriously, all I wanted it to do was safely back up my bank statements to a remote server in case I lose them. And after the "Zeus Certified" debacle, I don't know who to believe when I ask "Will this computer run the simplest of viruses like Adobe PDF Reader?" Clearly Zeus is just a resource hog ... and looking forward at Version 3 (if it's even released on time) one wonder if they're even trying to build a quality botnet anymore. It's times like these that make you wonder if it's time to switch over to Mariposa ...

    • by Anonymous Coward on Wednesday August 04, 2010 @09:06AM (#33137312)

      Mariposa is just as bloated - if not more so.

      not only that, its less secure because it doesnt have a "benevolent dictator" calling the shots design-wise.

      im running Conficker and its been working like a charm. granted, its market share is not that great, and as long as you hold the mouse the right way, it "just works".

      honestly, i think this will be the year of the Conficker. Mariposa and Zeus are just too behind the curve.

      • I'm sick and tired of all these Conficker fanboys. You sit and talk about your botnet being so great because its open source, and you can expose your information to any malicious actions you choose, big deal! I'll take my Mariposa walled garden any day, at least I know that I can give up my SSN, mother's maiden name, and current home address and I know it will "Just Work" when it comes to stealing my data.
        • Re: (Score:3, Funny)

          by oldspewey (1303305)

          If anybody needs proof that Mariposa is the superior botnet just ask yourself this question: is anybody lining up for 12 hours in the rain to get trojaned by anything else?

          Exactly

    • Re: (Score:2, Funny)

      by Necroloth (1512791)
      You're right, it's gone downhill since v1. Seems they're running out of good programmers and are being led by business-types who are demanding quantity over quality.
  • I predicted this (Score:5, Insightful)

    by 1s44c (552956) on Wednesday August 04, 2010 @08:50AM (#33137108)

    Botnet herders have access to a very large number of computers, it was only a matter of time until they realized that the data on these computers is worth far more than the few pence they are making from Viagra spam and blackmailing gambling sites with DDOS attacks.

    • by JohannesJ (952576)

      I'd like to know the 'Security savvy' level of the infected users . Did they surf with administrator credentials ? Follow email links and foolishly install? Had no anti-virus? and What OS version and patch level? Did they all use one particular program which lead to their being compromised ?

      • Re: (Score:3, Insightful)

        by Delarth799 (1839672)
        Usually people who end up infected with this sort of stuff are the same people who ignore the patches and updates for the operating system, which usually happens to be windows. They almost never download and install the updates because it slows down their web browsing or whatever and to them they just see it as an annoyance. They likely have only the most basic of anti-virus software installed and never actually bother to run it, or they just don't have anything at all. They click on ads left and right beca
      • Re: (Score:3, Insightful)

        by Anonymous Coward

        They simply did like my wife and my mother-in-law, they pressed "okay" when the pop-up came asking them to install this weird executable that they didn't ask for. They just wanted the pop-up to go away, you see.

        Firewall, anti-virus, tea-timer, a host of other security measures... but you can't fix the user.

      • Re: (Score:1, Interesting)

        by Anonymous Coward

        Should it matter? Dell and Best Buy didn't educate them about the security hazards of using Microsoft Windows(R).

        Is it BMW's (and their dealers) responsibility to tell the buyer of any operability issues inherent in the car before purchase?

        Yes.

    • Re: (Score:3, Informative)

      by moreati (119629)

      You do realise this isn't the first incidence? Botnets have been installing key loggers and stealing sensitive data for years now. Credit card numbers harvested thus sell for a few dollars/thousand.

    • by orange47 (1519059)
      gee, no shit, sherlock.. except when they get caught for this (and some surely will) it won't be the same situation as with viagra spam.
    • Botnet herders have access to a very large number of computers, it was only a matter of time until they realized that the data on these computers is worth far more than the few pence they are making from Viagra spam and blackmailing gambling sites with DDOS attacks.

      I happened to be working on my site at 4am (EDT) this morning and got hit simultaneously by several bots that turned out to be from major US universities. Not only do they own university networks, but use them to recruit oth

  • One detail in the report struck me: the claim that they capture all web traffic and store it in an SQL server w/ a search frontend at CNC. This is evidently unfeasible, they would have to filter out only data posted into forms and the like. It would have been helpful had the report told about what "shape" this data took, what kind of auth mechanisms was leeched from. They had no whitepaper/analysis on their website, but there was this OS distribution pie chart: http://www.trusteer.com/sites/default/files/Ze [trusteer.com]
  • Always wondering... (Score:3, Interesting)

    by euyis (1521257) <euyis@infinity - g ame.com> on Wednesday August 04, 2010 @08:51AM (#33137126)
    How do the criminals process all the information and filter out the valid ones?
    Considering all these weird captchas on the login pages, I don't think it's possible to check every collected bank account automatically, and doing that manually would be too tiring.
    • Re: (Score:3, Insightful)

      by Securityemo (1407943)
      Too tiring - compared to what?
    • by Sockatume (732728)

      Not all services use captchas. I'd guess that most assume that if you're a bot trying to log in, you will make multiple attempts and can be locked out of making futher attempts. How many architects would think to protect against automated entry of the correct credentials?

    • by mcgrew (92797) *

      Do you have any idea how big a computer a large botnet makes?

  • by davidwr (791652) on Wednesday August 04, 2010 @09:04AM (#33137280) Homepage Journal

    Hmm maybe we should go back to phone banking. It's not like phones can be easily hacked to sniff passwords.

    Oh wait, I forgot, we aren't in the 1980s [cunatechno...ouncil.org] any more. Nevermind.

    I think I'll do my business in person now. I'll just have to make sure the Russian Mafia doesn't set up a look-alike storefront [collisiondetection.net] down the street that looks like my bank's latest branch office.

    Sigh.

    Well, at least I know my currency is real [slate.com].

  • Really? Botnet used for financial gain, just like every other botnet in the past decade?

    I'm flabbergasted!

  • by countertrolling (1585477) on Wednesday August 04, 2010 @09:42AM (#33137790) Journal

    I do all my banking at an internet cafe

  • Large Zeus Botnet Used For Financial Fraud

    The botnet appears to be controlling more than 100,000 infected computers

    Is that really large nowadays?

  • by ThatsNotPudding (1045640) on Wednesday August 04, 2010 @12:23PM (#33139894)
    Given that virtually every botnet seems to originate in Eastern Europe, I can only assume that neck of the woods is now an endless tableau of McMansions, world-class prostitues, and Mercedes dealerships.

Things equal to nothing else are equal to each other.

Working...