This summary is not available. Please
click here to view the post.
Saturday, 10 August 2013
Wednesday, 24 July 2013
As many sources reported earlier today, an email claiming to be from CNN's "Scribbler" provided a link to "Watch Live Hospital Updates" of the Royal Baby:
But what do Harrison Ford, President Obama, and Snowden have in common with The Royal Baby?
They were all subjects of fake "CNN Breaking News" stories delivered by spam email today that contained links to a dangerous collection of malware! In the Malcovery Spam Data Mine we had hundreds of copies of emails with subjects including:
"Snowden able to leave Moscow airport" - BreakingNews CNN
"Harrison Ford on 'Ender's Game' controversy: 'Not an issue for me'"
"Obama speech to urge refocus "
"Perfect gift for royal baby ... a tree?" - BreakingNews CNN
(click each image for full-size email)
To demonstrate the relatedness of the spam, a list of the URLs that were used by each of the four campaigns is listed at the end of this article, labeled either "snowden", "ender", "obama", or "tree" for which campaign advertised that URL. We threw all of the advertised URLs into a fetcher and found that there were two files found in the destinations. The first (from earlier in the day) pointed to two Javascript files that were used to redirect the visitor to an Exploit Kit that would cause malware dropped to their computer. The second (later in the day, and still live as of this writing) pointed to three Javascript files that redirected to a different Exploit Kit site.
I've added spaces to the URLs for your protection, but DO NOT VISIT ANY OF THESE URLS!!!
(early morning version <== redirects to nphscards.com / topic / accidentally-results-stay.php )
(afternoon version <== redirects to deltaboatraces.net / topic / accidentally-results-stay.php )
index.html with MD5 = 958a887fcfcad89b3fdeea4b58e55905
- which loads two Javascript files:
ftp.thermovite.de / kurile / teeniest.js
traditionalagoonresort.com / prodded / televised.js
Since it was late in the day by the time I was able to review these myself, I infected myself with the afternoon version.
index.html with MD5 = bc73afe28fc6b536e675cea4ac468b7d
- which loads three Javascript files:
thealphatechnologies.com / advantageously / autopilots.js
atlas247.com / mussiest /syndicating.js
www.mshc.in /drubbing / mouthful.js
deltaboatraces.net == 173.246.104.136 and is still an active infector as of this timestamp.
I got a randomly named 297,472 byte file, detected by 11 of 46 Anti-Virus vendors at VirusTotal.com, which was Zeus.
Adobe Flash Player Update?
After infecting, the website tries to trick the user into "upgrading his Adobe Flash Player", but please notice in the graphic below, I'm not on the Adobe website!
After "installing" my Adobe update, my sandbox went crazy and also fetched malware from each of these locations:
After infection with the second my sandbox went to "deltarivehouse.net / forum / viewtopic.php" (173.246.104.136) which caused a string of additional infections to occur. While the initial infection was Zeus, the well-known Financial Crime malware that steals banking information, but also provides criminals full remote-control capabilities to your computer, the purpose of the additional malware was for another form of money making.
"sainitravels.in" (204.11.58.185) to fetch "f7Qsfao.exe"
(VirusTotal: 8 of 46)) - "Tepfor" or "Medfos" malware
"server1.extra-web.cz" (212.80.69.55) to fetch "dbm.exe"
(VirusTotal: 8 of 46)
"www.MATTEPLANET.com" (208.86.184.10) to fetch "q7ojEH7.exe"
(VirusTotal: 4 of 46)
"ictsolutions.net.au" (27.124.120.1) to fetch "SAQjaWu.exe"
(VirusTotal: 8 of 46)
Medfos, one of the malware names given to several of the above, is an "Advertisement redirection" malware campaign. Microsoft did a great job explaining how Medfos works in their blog post, Medfos - Hijacking Your Daily Search on the Microsoft Malware Protection Center blog back in September. Some of the sites that seem to be related to this Medfos install include "bidpenniesforgold.net" (IP: 50.63.25.37) and "webpayppcclick.com" (IP: 85.17.147.34).
According to our friends at Domain Tools, that last IP address is associated with a whole world of "Pay Per Click" fraud domains, including:
Hopefully tying these malware samples to that activity can help someone clean up that mess! (Attention: Leaseweb!)
advertisingclickfeed.com
allfeedppcadvertising.com
clickppcadvertisingone.com
clickwebppcpay.com
csuperclick.com
feedppcadvertisingdirect.com
feedppcadvertisinginfo.com
feedyourppcdirect.com
firstfeedppcadvertising.com
newpaywebclick.com
onlineppcclick.com
paymittelsclick.com
payonlineppc.com
payppcclickonline.com
paywebclick.com
paywebclicksite.com
perclickguide.com
perclicksite.com
perclickworld.com
ppcadvertisingfeed.com
ppcadvertisingworld.com
ppcclickonlineppc.com
ppcnewfeed.com
ppcperclickadvertising.com
ppcperpayadvertising.com
ppcwebclickpay.com
streamppcadvertising.com
webpayppcclick.com
Spammed URLs for the Snowden, Ender, Obama, and Tree Campaigns
| obama | 198.251.67.11 | /incumbency/index.html |
| obama | 198.251.67.11 | /philippine/index.html |
| obama | 198.251.67.11 | /stifles/index.html |
| snowden | 198.251.67.11 | /campaigners/index.html |
| snowden | 198.251.67.11 | /foxhole/index.html |
| snowden | 198.251.67.11 | /fracturing/index.html |
| snowden | 198.251.67.11 | /incumbency/index.html |
| tree | 198.251.67.11 | /nomadic/index.html |
| tree | 198.251.67.11 | /philippine/index.html |
| tree | 198.251.67.11 | /reprehended/index.html |
| tree | 198.251.67.11 | /sauciness/index.html |
| tree | 198.251.67.11 | /sonya/index.html |
| snowden | 198.251.67.11 | /voodooing/index.html |
| ender | 198.61.134.93 | /decompressed/index.html |
| ender | 198.61.134.93 | /dinosaur/index.html |
| ender | 198.61.134.93 | /microeconomics/index.html |
| ender | 198.61.134.93 | /packard/index.html |
| ender | 198.61.134.93 | /reprimanding/index.html |
| ender | 198.61.134.93 | /sash/index.html |
| ender | 51956147.de.strato-hosting.eu | /radicalism/index.html |
| ender | 51956147.de.strato-hosting.eu | /remote/index.html |
| ender | 51956147.de.strato-hosting.eu | /soyinka/index.html |
| obama | 96.9.7.80 | /draftier/index.html |
| tree | 96.9.7.80 | /coif/index.html |
| tree | 96.9.7.80 | /contentious/index.html |
| snowden | 96.9.7.80 | /imperiling/index.html |
| snowden | 96.9.7.80 | /implausibilities/index.html |
| tree | 96.9.7.80 | /slaloming/index.html |
| snowden | 96.9.780 | /imperiling/index.html |
| ender | adeseye.me.pn | /clunkier/index.html |
| ender | adeseye.me.pn | /incest/index.html |
| ender | adeseye.me.pn | /mischancing/index.html |
| ender | adeseye.me.pn | /rarest/index.html |
| ender | adeseye.me.pn | /uglies/index.html |
| ender | andywinnie.com | /albert/index.html |
| ender | andywinnie.com | /anywheres/index.html |
| ender | andywinnie.com | /chairing/index.html |
| ender | andywinnie.com | /fits/index.html |
| ender | andywinnie.com | /network/index.html |
| ender | andywinnie.com | /preservation/index.html |
| ender | aptword.com.my | /dromedaries/index.html |
| ender | aptword.com.my | /incurred/index.html |
| ender | aptword.com.my | /interpol/index.html |
| ender | aptword.com.my | /translations/index.html |
| ender | aptword.com.my | /vietminh/index.html |
| obama | assuredpropertycare.net | /overlying/index.html |
| obama | assuredpropertycare.net | /sneezes/index.html |
| tree | assuredpropertycare.net | /arrhenius/index.html |
| snowden | assuredpropertycare.net | /changed/index.html |
| snowden | assuredpropertycare.net | /debaucheries/index.html |
| snowden | assuredpropertycare.net | /dulls/index.html |
| tree | assuredpropertycare.net | /dulls/index.html |
| snowden | assuredpropertycare.net | /overlying/index.html |
| tree | assuredpropertycare.net | /premeditation/index.html |
| tree | assuredpropertycare.net | /shekels/index.html |
| snowden | assuredpropertycare.net | /sneezes/index.html |
| obama | bbsmfg.biz | /belaying/index.html |
| obama | bbsmfg.biz | /lather/index.html |
| tree | bbsmfg.biz | /activists/index.html |
| snowden | bbsmfg.biz | /intellectualize/index.html |
| snowden | bbsmfg.biz | /lather/index.html |
| tree | bbsmfg.biz | /servo/index.html |
| tree | bbsmfg.biz | /skiing/index.html |
| tree | bbsmfg.biz | /tourist/index.html |
| snowden | bbsmfgbiz | /intellectualize/index.html |
| snowden | bbsmfgbiz | /lather/index.html |
| ender | bestpaintinginc.org | /candidacy/index.html |
| ender | bestpaintinginc.org | /enmeshes/index.html |
| ender | bestpaintinginc.org | /genitives/index.html |
| ender | bestpaintinginc.org | /hardly/index.html |
| ender | bestpaintinginc.org | /parser/index.html |
| obama | bordihn.net | /rubik/index.html |
| snowden | bordihn.net | /gnarl/index.html |
| tree | bordihn.net | /gnarl/index.html |
| tree | bordihn.net | /gushing/index.html |
| tree | bordihn.net | /reformulates/index.html |
| snowden | bordihn.net | /squirreling/index.html |
| tree | bordihn.net | /squirreling/index.html |
| ender | chad.westhostsite.com | /addle/index.html |
| ender | chad.westhostsite.com | /augmenting/index.html |
| ender | chad.westhostsite.com | /buttonholes/index.html |
| ender | chad.westhostsite.com | /expend/index.html |
| ender | chad.westhostsite.com | /shillings/index.html |
| ender | chad.westhostsite.com | /unfailing/index.html |
| ender | CHALONE.COM.SG | /ebbed/index.html |
| ender | CHALONE.COM.SG | /homy/index.html |
| ender | CHALONE.COM.SG | /saddling/index.html |
| obama | deerstalkersbop.org.nz | /evelyn/index.html |
| snowden | deerstalkersbop.org.nz | /absconding/index.html |
| tree | deerstalkersbop.org.nz | /actioning/index.html |
| tree | deerstalkersbop.org.nz | /bathroom/index.html |
| snowden | deerstalkersbop.org.nz | /dissatisfied/index.html |
| tree | deerstalkersbop.org.nz | /dissatisfied/index.html |
| snowden | deerstalkersbop.org.nz | /tran/index.html |
| obama | dtgcommunity.com | /imprimatur/index.html |
| snowden | dtgcommunity.com | /electroencephalographs/index.html |
| tree | dtgcommunity.com | /electroencephalographs/index.html |
| snowden | dtgcommunity.com | /gentlefolk/index.html |
| tree | dtgcommunity.com | /gunpoint/index.html |
| tree | dtgcommunity.com | /ingresses/index.html |
| snowden | dtgcommunity.com | /parachutists/index.html |
| tree | dtgcommunity.com | /seesawing/index.html |
| snowden | dtgcommunity.com | /thwacked/index.html |
| snowden | dtgcommunity.com | /tzar/index.html |
| tree | edition.cnn.com | / |
| obama | ekaterini.mainsys.gr | /bloodier/index.html |
| obama | ekaterini.mainsys.gr | /habitual/index.html |
| tree | ekaterini.mainsys.gr | /habitual/index.html |
| snowden | ekaterini.mainsys.gr | /livelongs/index.html |
| tree | ekaterini.mainsys.gr | /oxymora/index.html |
| snowden | ekaterini.mainsys.gr | /peddle/index.html |
| snowden | ekaterini.mainsys.gr | /prithee/index.html |
| tree | ekaterini.mainsys.gr | /suggested/index.html |
| snowden | ekaterini.mainsys.gr | /voled/index.html |
| tree | ekaterini.mainsys.gr | /voled/index.html |
| ender | fermatabow.com | /clinicians/index.html |
| ender | fermatabow.com | /depicting/index.html |
| ender | fermatabow.com | /fairyland/index.html |
| obama | ftp.suavva.com | /initiators/index.html |
| obama | ftp.suavva.com | /riverbed/index.html |
| obama | ftp.suavva.com | /sousa/index.html |
| snowden | ftp.suavva.com | /overstatements/index.html |
| tree | ftp.suavva.com | /sousa/index.html |
| tree | ftp.suavva.com | /surges/index.html |
| obama | fuhr-haustechnik.de | /resubmit/index.html |
| tree | fuhr-haustechnik.de | /attempted/index.html |
| tree | fuhr-haustechnik.de | /continua/index.html |
| tree | fuhr-haustechnik.de | /impartially/index.html |
| snowden | fuhr-haustechnik.de | /recollecting/index.html |
| tree | fuhr-haustechnik.de | /recollecting/index.html |
| tree | fuhr-haustechnik.de | /taboo/index.html |
| snowden | fuhr-haustechnik.de | /unswerving/index.html |
| ender | gbihongkong.org | /boer/index.html |
| ender | gbihongkong.org | /economist/index.html |
| ender | gbihongkong.org | /inconsiderately/index.html |
| ender | gbihongkong.org | /unenlightened/index.html |
| ender | grape.wurster.ws | /filtration/index.html |
| ender | grape.wurster.ws | /geisha/index.html |
| ender | grape.wurster.ws | /pagans/index.html |
| ender | grape.wurster.ws | /rationalized/index.html |
| ender | grape.wurster.ws | /spica/index.html |
| ender | grape.wurster.ws | /suntans/index.html |
| snowden | hackspitz.com | /adidas/index.html |
| snowden | hackspitz.com | /candied/index.html |
| snowden | hackspitz.com | /impropriety/index.html |
| tree | hackspitz.com | /kook/index.html |
| tree | hackspitz.com | /penetrable/index.html |
| obama | hotelnewyorkbd.com | /twill/index.html |
| tree | hotelnewyorkbd.com | /bayou/index.html |
| snowden | hotelnewyorkbd.com | /doyens/index.html |
| tree | hotelnewyorkbd.com | /doyens/index.html |
| snowden | hotelnewyorkbd.com | /fiftieths/index.html |
| snowden | hotelnewyorkbd.com | /hill/index.html |
| snowden | hotelnewyorkbd.com | /preyer/index.html |
| tree | hotelnewyorkbdcom | /bayou/index.html |
| ender | ic44.com | /bulgarian/index.html |
| ender | ic44.com | /byword/index.html |
| ender | ic44.com | /flourishes/index.html |
| ender | ic44.com | /ganglier/index.html |
| ender | ic44.com | /sundry/index.html |
| ender | isgett.org | /ambling/index.html |
| ender | isgett.org | /besmirched/index.html |
| ender | isgett.org | /daybed/index.html |
| ender | isgett.org | /discriminatory/index.html |
| ender | isgett.org | /flux/index.html |
| ender | isgett.org | /tanzania/index.html |
| obama | jobarium.com | /sham/index.html |
| snowden | jobarium.com | /benefactresses/index.html |
| snowden | jobarium.com | /hobos/index.html |
| tree | jobarium.com | /melissa/index.html |
| obama | joerg.gmxhome.de | /ease/index.html |
| obama | joerg.gmxhome.de | /freezes/index.html |
| snowden | joerg.gmxhome.de | /ease/index.html |
| snowden | joerg.gmxhome.de | /enumerated/index.html |
| tree | joerg.gmxhome.de | /enumerated/index.html |
| snowden | joerg.gmxhome.de | /harvester/index.html |
| tree | joerg.gmxhome.de | /skeptically/index.html |
| tree | kassos.gr | /bode/index.html |
| tree | kassos.gr | /chosen/index.html |
| snowden | kassos.gr | /dragooning/index.html |
| snowden | kassos.gr | /futility/index.html |
| snowden | kassos.gr | /golf/index.html |
| snowden | kassos.gr | /walkways/index.html |
| tree | kassos.gr | /walkways/index.html |
| snowden | kassosgr | /futility/index.html |
| snowden | kassosgr | /golf/index.html |
| obama | kryokontur.fr | /biopsy/index.html |
| obama | kryokontur.fr | /brows/index.html |
| obama | kryokontur.fr | /kern/index.html |
| obama | kryokontur.fr | /nosh/index.html |
| tree | kryokontur.fr | /alternator/index.html |
| snowden | kryokontur.fr | /brows/index.html |
| tree | kryokontur.fr | /brows/index.html |
| tree | kryokontur.fr | /curs/index.html |
| tree | kryokontur.fr | /heating/index.html |
| snowden | kryokontur.fr | /housebreaking/index.html |
| snowden | kryokontur.fr | /preheats/index.html |
| snowden | kryokontur.fr | /tint/index.html |
| snowden | kryokontur.fr | /windmills/index.html |
| ender | lees-landscaping.com | /angiosperm/index.html |
| ender | lees-landscaping.com | /barrettes/index.html |
| ender | lees-landscaping.com | /illegitimacy/index.html |
| snowden | limelight.arinet.com | /cloy/index.html |
| snowden | limelight.arinet.com | /hamlet/index.html |
| tree | limelight.arinet.com | /hamlet/index.html |
| snowden | limelight.arinet.com | /universities/index.html |
| obama | lostfounddevices.com | /mama/index.html |
| obama | lostfounddevices.com | /mullet/index.html |
| obama | lostfounddevices.com | /unavoidable/index.html |
| obama | lostfounddevices.com | /unavoidable/indexhtml |
| snowden | lostfounddevices.com | /blaspheme/index.html |
| snowden | lostfounddevices.com | /espinoza/index.html |
| tree | lostfounddevices.com | /espinoza/index.html |
| snowden | lostfounddevices.com | /friskily/index.html |
| snowden | lostfounddevices.com | /hunchbacked/index.html |
| snowden | lostfounddevices.com | /mama/index.html |
| tree | lostfounddevices.com | /mama/index.html |
| snowden | lostfounddevices.com | /manageable/index.html |
| snowden | lostfounddevices.com | /undresses/index.html |
| tree | lostfounddevices.com | /undresses/index.html |
| snowden | mydataplus.com | /parenthesized/index.html |
| snowden | mydataplus.com | /powhatan/index.html |
| tree | mydataplus.com | /spotlessness/index.html |
| obama | nendt.com | /degree/index.html |
| tree | nendt.com | /famous/index.html |
| snowden | nendt.com | /horded/index.html |
| snowden | nendt.com | /phoneyed/index.html |
| snowden | nendt.com | /psalmists/index.html |
| tree | nendt.com | /shown/index.html |
| snowden | nendt.com | /spreaders/index.html |
| ender | photos4earth.com | /strobe/index.html |
| ender | s273524369.onlinehome.us | /disarray/index.html |
| ender | s273524369.onlinehome.us | /opposite/index.html |
| ender | s273524369.onlinehome.us | /sheepishly/index.html |
| ender | s273524369.onlinehome.us | /wakes/index.html |
| ender | s273524369.onlinehome.us | /yeasty/index.html |
| tree | s3.hostingkartinok.com | /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebd.jpg |
| tree | s3.hostingkartinok.com | /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebdjpg |
| tree | s3hostingkartinok.com | /uploads/images/2013/07/98de33a494997c23b11e1c1259955ebd.jpg |
| obama | s5.hostingkartinok.com | /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9a.jpg |
| obama | s5.hostingkartinok.com | /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9ajpg |
| obama | s5hostingkartinok.com | /uploads/images/2013/07/4a36da5ef96e4d41aa3a6ba91f1c7a9a.jpg |
| ender | stolichband.com | /betook/index.html |
| ender | stolichband.com | /daddy/index.html |
| ender | stolichband.com | /laudatory/index.html |
| ender | stolichband.com | /mediated/index.html |
| ender | stolichband.com | /modulation/index.html |
| ender | stolichband.com | /slander/index.html |
| ender | stolichband.com | /slovakian/index.html |
| obama | t.co | /068wfdEwvI |
| obama | t.co | /0B3uJXHZHq |
| obama | t.co | /2RKkCjMhDY |
| obama | t.co | /3Bi5WUDuzQ |
| obama | t.co | /6oxioBYqIN |
| obama | t.co | /7qev03NGnJ |
| obama | t.co | /a4ERRbQQl4 |
| obama | t.co | /acBBL0xTCV |
| obama | t.co | /bkkUHH67hJ |
| obama | t.co | /bXH47NZNqO |
| obama | t.co | /C6DXVWqaBc |
| obama | t.co | /c6pMmdDPpO |
| obama | t.co | /dcLDDl0aty |
| obama | t.co | /DKgUzhWMr9 |
| obama | t.co | /dpM6GQ5NZ5 |
| obama | t.co | /dW8S1lHWkf |
| obama | t.co | /e9AsQbSPBW |
| obama | t.co | /eGRRrXsqQP |
| obama | t.co | /EUKNmKfV7q |
| obama | t.co | /f3bUOwEME8 |
| obama | t.co | /fOPdMNQOsM |
| obama | t.co | /g29I6C8vZy |
| obama | t.co | /GfduFeg1yd |
| obama | t.co | /gGGSrs26ZU |
| obama | t.co | /gKwkpduJ5v |
| obama | t.co | /Gs7xupxY4e |
| obama | t.co | /hP66qiEvov |
| obama | t.co | /htgnJQgBls |
| obama | t.co | /ims3mUbQAJ |
| obama | t.co | /j7WCQHF8ZR |
| obama | t.co | /JNaITTgZF4 |
| obama | t.co | /JyXdiTk9zz |
| obama | t.co | /k99DjSMgDX |
| obama | t.co | /KroVjGhTzS |
| obama | t.co | /lwcWsTSwc9 |
| obama | t.co | /m69otwSQB6 |
| obama | t.co | /M8wADK71ii |
| obama | t.co | /MMJJZm6BgK |
| obama | t.co | /MrjneT1p2F |
| obama | t.co | /nD7PWsTS2Z |
| obama | t.co | /nGGBXHTZiR |
| obama | t.co | /NT9VneQG7G |
| obama | t.co | /o5dSTNSEWg |
| obama | t.co | /OR7w6EeD2s |
| obama | t.co | /PMuNvHMrPz |
| obama | t.co | /Q4diDo0JMR |
| obama | t.co | /QEdUNFwVSe |
| obama | t.co | /qEQMOBXrQu |
| obama | t.co | /rfiCBnJbng |
| obama | t.co | /RGFxIi96oy |
| obama | t.co | /Rlu9pAZfbd |
| obama | t.co | /SbzAPP8Vdh |
| obama | t.co | /TtGPbv2jkt |
| obama | t.co | /twZBBrhZF6 |
| obama | t.co | /utoI54aE3a |
| obama | t.co | /vj38vKkeNZ |
| obama | t.co | /vp6XZXxaev |
| obama | t.co | /VPxdX8abZV |
| obama | t.co | /xDlelOjWBn |
| obama | t.co | /XFiGKFtVKp |
| obama | t.co | /XOWz23aYDY |
| obama | t.co | /y5jSjRvpnk |
| obama | t.co | /yCZT3kJ259 |
| obama | t.co | /yfpfhlOVyB |
| obama | t.co | /yJqGYQPmwe |
| obama | t.co | /ytpUhryXaB |
| obama | t.co | /YVTow2XnJ8 |
| ender | tpafbicaaorg.web.siteprotect.net | /expansionist/index.html |
| ender | tpafbicaaorg.web.siteprotect.net | /tocqueville/index.html |
| ender | transstorlogistics.eu | /cowered/index.html |
| ender | transstorlogistics.eu | /dapples/index.html |
| ender | transstorlogistics.eu | /dentist/index.html |
| ender | transstorlogistics.eu | /footpaths/index.html |
| ender | transstorlogistics.eu | /have/index.html |
| ender | transstorlogistics.eu | /miraculous/index.html |
| obama | villaflorida.biz | /backslappers/index.html |
| obama | villaflorida.biz | /chin/index.html |
| obama | villaflorida.biz | /encapsulates/index.html |
| tree | villaflorida.biz | /caste/index.html |
| tree | villaflorida.biz | /chin/index.html |
| snowden | villaflorida.biz | /cliquish/index.html |
| tree | villaflorida.biz | /cliquish/index.html |
| snowden | villaflorida.biz | /huitzilopitchli/index.html |
| snowden | villaflorida.biz | /rotogravure/index.html |
| tree | villaflorida.biz | /unloosing/index.html |
| obama | whittakerwatertech.com | /beveling/index.html |
| obama | whittakerwatertech.com | /butlers/index.html |
| snowden | whittakerwatertech.com | /careering/index.html |
| snowden | whittakerwatertech.com | /guardroom/index.html |
| tree | whittakerwatertech.com | /guardroom/index.html |
| snowden | whittakerwatertech.com | /hundredweights/index.html |
| tree | whittakerwatertech.com | /plover/index.html |
| snowden | whittakerwatertech.com | /snorts/index.html |
| ender | www.arrow2000.ca | /gradient/index.html |
| ender | www.arrow2000.ca | /homemaker/index.html |
| ender | www.arrow2000.ca | /mulling/index.html |
| ender | www.arrow2000.ca | /nettie/index.html |
| ender | www.arrow2000.ca | /offed/index.html |
| obama | www.bernderl.de | /paradigmatic/index.html |
| snowden | www.bernderl.de | /coward/index.html |
| snowden | www.bernderl.de | /munoz/index.html |
| tree | www.bernderl.de | /oleaginous/index.html |
| snowden | www.bernderl.de | /polygon/index.html |
| snowden | www.bernderl.de | /selvedge/index.html |
| tree | www.bernderl.de | /undue/index.html |
| ender | www.bst-kanzlei.de | /attenuation/index.html |
| ender | www.bst-kanzlei.de | /cutback/index.html |
| ender | www.bst-kanzlei.de | /divorce/index.html |
| tree | www.compare-treadmills.co.uk | /bassinet/index.html |
| snowden | www.compare-treadmills.co.uk | /deciding/index.html |
| tree | www.compare-treadmills.co.uk | /faster/index.html |
| snowden | www.compare-treadmills.co.uk | /implosion/index.html |
| tree | www.compare-treadmills.co.uk | /implosion/index.html |
| snowden | www.compare-treadmills.co.uk | /leon/index.html |
| snowden | www.compare-treadmills.co.uk | /leonor/index.html |
| tree | www.compare-treadmills.co.uk | /march/index.html |
| tree | www.compare-treadmills.co.uk | /tamarinds/index.html |
| ender | www.ishootyou.gr | /auguring/index.html |
| ender | www.ishootyou.gr | /insinuating/index.html |
| ender | www.ishootyou.gr | /sultanates/index.html |
| ender | www.ishootyou.gr | /towelling/index.html |
| obama | www.kauai2u.com | /connect/index.html |
| tree | www.kauai2u.com | /connect/index.html |
| snowden | www.kauai2u.com | /cynically/index.html |
| tree | www.kauai2u.com | /department/index.html |
| snowden | www.kauai2u.com | /descent/index.html |
| snowden | www.kauai2u.com | /finked/index.html |
| snowden | www.kauai2u.com | /strapping/index.html |
| tree | www.kauai2u.com | /strapping/index.html |
| tree | www.masago-bkt.co.jp | /axes/index.html |
| snowden | www.masago-bkt.co.jp | /beirut/index.html |
| obama | www.Miami-Beach-Reisen.de | /eminently/index.html |
| obama | www.Miami-Beach-Reisen.de | /tangoing/index.html |
| snowden | www.Miami-Beach-Reisen.de | /eduardo/index.html |
| tree | www.Miami-Beach-Reisen.de | /exceeding/index.html |
| snowden | www.Miami-Beach-Reisen.de | /frail/index.html |
| snowden | www.Miami-Beach-Reisen.de | /incrusts/index.html |
| tree | www.Miami-Beach-Reisen.de | /invalided/index.html |
| tree | www.Miami-Beach-Reisen.de | /requirements/index.html |
| snowden | www.Miami-Beach-Reisen.de | /tangoing/index.html |
| obama | www.readingfluency.net | /juvenile/index.html |
| snowden | www.readingfluency.net | /imperishables/index.html |
| tree | www.readingfluency.net | /imperishables/index.html |
| snowden | www.readingfluency.net | /poachers/index.html |
| snowden | www.readingfluency.net | /tarantula/index.html |
| tree | www.saito-office.biz | /hooker/index.html |
| snowden | www.saito-office.biz | /rechargeable/index.html |
| snowden | www.saito-office.biz | /suggestively/index.html |
| tree | www.saito-office.biz | /suggestively/index.html |
| snowden | www.saito-office.biz | /vandyke/index.html |
| snowden | www.schmaeing-reken.de | /banjos/index.html |
| tree | www.schmaeing-reken.de | /baxter/index.html |
| snowden | www.schmaeing-reken.de | /blocking/index.html |
| tree | www.schmaeing-reken.de | /blocking/index.html |
| tree | www.schmaeing-reken.de | /droller/index.html |
| tree | www.schmaeing-reken.de | /iambs/index.html |
| tree | www.schmaeing-reken.de | /metamorphosing/index.html |
| snowden | www.schmaeing-reken.de | /mucks/index.html |
| tree | www.schmaeing-reken.de | /regurgitating/index.html |
| obama | www.socivi.com | /estonians/index.html |
| tree | www.socivi.com | /flippancy/index.html |
| snowden | www.socivi.com | /incapable/index.html |
| snowden | www.socivi.com | /infuses/index.html |
| tree | www.socivi.com | /lepke/index.html |
| snowden | www.socivi.com | /moonlights/index.html |
| tree | www.socivi.com | /tugs/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /chirruping/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /dumped/index.html |
| snowden | www.spurtwinslotshelvingsystems.co.uk | /helot/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /reprinted/index.html |
| snowden | www.spurtwinslotshelvingsystems.co.uk | /terminological/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /terminological/index.html |
| tree | www.spurtwinslotshelvingsystems.co.uk | /tushes/index.html |
| tree | www.tennisclub-iburg.de | /barking/index.html |
| snowden | www.tennisclub-iburg.de | /bruckner/index.html |
| snowden | www.tennisclub-iburg.de | /distemper/index.html |
| tree | www.tennisclub-iburg.de | /excreta/index.html |
| snowden | www.tennisclub-iburg.de | /geneses/index.html |
| snowden | www.tennisclub-iburg.de | /hepper/index.html |
| tree | www.tennisclub-iburg.de | /retributions/index.html |
| obama | www.wurster.ws | /dope/index.html |
| tree | www.wurster.ws | /cheaply/index.html |
| snowden | www.wurster.ws | /dearness/index.html |
| snowden | www.wurster.ws | /fixity/index.html |
| tree | www.wurster.ws | /loathing/index.html |
| tree | www.wurster.ws | /rump/index.html |
Wednesday, 5 June 2013
Eleven Cyber criminals Arrested
I'm always pleased to see international cooperation in cybercrime investigations! This afternoon we received the news from the UK's SOCA, (the Serious Organised Crime Agency) that there were eleven arrests globally in a case involving cooperation from the Vietnamese High-Tech Crime Unit (HTCU), the Criminal Investigative Division of the the Ministry of Public Security of Vietnam (MPSVN CID), SOCA, the Metropolitan Police Central e-Crime Unit (PCeU), and the FBI. Eight criminals were arrested in Vietnam and three additional arrests were made in the UK.All of these criminals were associated with the "mattfeuter" family of websites (mattfeuter.ru, mattfeuter.cc, mattfeuter.su, mattfeuter.com, etc.) where approximately 16,000 members bought and sold stolen credit card data in bulk. It is believed that purchases from the website had facilitated more than $200M worth of credit card fraud worldwide through the sale of more than 1.1 million credit cards.
SOCA and the PCeU are joining forces to create the new National Crime Agency later this year, but are already performing joint operations such as this investigation in anticipation of the UK's new National Cyber Crime Unit. Andy Archibald, who is the interim Deputy Director of the National Cyber Crime Unit, where the "Dedicated Cheque and Plastic Crime Unit" is housed, had this to say:
“One of the world’s major facilitation networks for online card fraud has been dismantled by this operation, and those engaged in this type of crime should know that that they are neither anonymous, nor beyond the reach of law enforcement agencies. We and our partners, in the UK and abroad, continue to protect the public and legitimate businesses by targeting websites trading in stolen card data, and relentlessly pursuing those who operate and frequent them."
Operations of this nature would not be possible without the support of private sector partners, in this case primarily Visa and MasterCard.
In keeping with UK law, the names of the three arrested there are not given, only their names and locations:
- 37 year old man from West Ham
- 34 year old man from Thornton Heath
- 44 year old man from Manor Park
Vietnamese media has identified those arrested in Vietnam, and have named as their ringleader Van Tien Tu. The full list of those arrested include:
- Ngo Thi Quynh Anh
- Tran Thi Dieu Hien
- Van Tien Tu
- Truong Hai Duy
- Le Van Kieu, those five all from Ho Chi Min City
- Trinh Khac Duong
- Dao Ba Bang
- Doan Van Chuc, those three from Hanoi
The Hanoi three are charged with using the credit card data for online gambling.
The ringleader, Van Tien Tu, is charged with having created the Mattfeuter websites, where credit cards are sold for between $2 and $20 per card. As the operator of the site, Van Tien Tu and his group earned approximately $1.5 million in commissions on their sales.
Although we haven't yet heard of many cases with Vietnamese cyber crime yet, the improvements in Vietnamese law passed in 2009 made it a criminal offense to fraudulently obtain card dat from overseas targets, as well as from victims in Vietnam.
The New Jersey case focuses on Duy Hai Truong, pictured below:
In a statement from the New Jersey US Attorney's Office, Paul Fishman announced that Truong was charged with "conspiracy to commit bank fraud. From 2007 until his recent arrest, Truong allegedly defrauded financial institutions as part of the massive scheme, in which personal identifying information relating to more than 1.1 million credit cards was stolen and resold to criminal customers worldwide." The New Jersey statement alludes to "arrests made over the past week in the United Kingdom, Vietnam, Italy, Germany, and elsewhere" so I am sure there will be additional news in the near future as the details of the case unfold.
The Official Complaint against Duy Hai Truong reveals that fees on the mattfeuter.biz and mattfeuter.com websites varied from $1 to $300 per "dump" (a dump referring to a magnetic card stripe read from a Credit or Debit Card), and that the fees were usually paid through Western Union or Liberty Reserve.
Truong is being held in Vietnam pending the settlement of charges in the UK, but if convicted in the US, Truong could face up to 30 years in prison and a fine of either $1 million or twice the gain from the offense, or twice the losses caused by the offense, whichever is greater.
New Jersey has also released the Sworn Complaint by FBI Special Agent Russell Ficara, who testifies that he reviewed over 1100 bank accounts and many searches of email accounts, residences, offices, and drop addresses related to this case. His testimony includes many of the email accounts used, including mattfeuter123@gmail.com, augustino267@gmail.com, ho.robbie@gmail.com, and included more than 150,000 email messages with more than 1.1 million credit card numbers being traded, including cards and personally identifiable information (PII) related to many victims residing in New Jersey.
As with so many criminals, Truong also had a Facebook account that referred to his real name, made references to the conspiracy, and contained photos of messages to and from Dump Purchasers and making reference to stolen credit cards!
A single Western Union location "in or around Ho Chi Minh City, Vietnam" was documented to have received more than $1.9 million in payments just related to MTCNs (Money Transfer Control Numbers) documented in the emails from the three referenced accounts, all controlled by Truong.
Monday, 13 May 2013
On April 17th & 18th, 2013, we blogged about spammers who were using the Boston Marathon Explosion and the Texas Fertilizer Plant Explosion to dramatically increase the size of their botnet. The botnet in question was the Kelihos botnet, and the primary purpose of the malware being delivered in that two day campaign was to cause newly infected computers to also join the botnet as additional spam-sending computers. Malcovery Security, where I serve as Chief Technologist, put out a free copy of their daily malware "Top Threats Today" report because the prevalence of that spam was nearly 80 times the level that we normally consider to be an "outbreak" of malicious activity.
So, what have the criminals behind Kelihos been doing with all of their new spam-sending power? Primarily they are sending Pump and Dump spam.
Pump & Dump
A Pump and Dump spam campaign is an email that claims a particular stock symbol is going to have a large increase in value in the near future and encourages investors to jump in while the price is still low. These are usually sub-penny stocks where the criminals have arranged to own millions of shares of an existent publicly traded "pink sheets" company. They then do false press releases about new business developments, accompanied with a spam campaign. We've seen stocks rise from 1/5th of a cent to 30 or 40 cents or on rare occasion $1 per share before the criminal dumps his millions of shares for a 10,000% profit. These attacks often coincide with brokerage phishing attacks where a stolen Fidelity account (or something like it) is used to buy the initial shares, or to buy many shares to give the appearance of high market activity in the junk stock to encourage wary investors.Over the weekend, the Kelihos Pump & Dump target is "GT RL" which they claim is a small movie studio that is primed for an acquisition. In the spam emails they tell the story of an investor who owned 39% of Lions Gate and earned $1 Billion USD when the studio was acquired by a larger organization. GTRL is "Get Real USA, Inc." which claims last summer to have had "Academy Award Nominee Dean Wright" join their board of advisors, according to their website, which is denying any involvement in the current spam run.
On March 4, 2013, GTRL opened the market day trading at $0.0052. Friday it closed at $0.01 on a volume of 1.9 million shares traded. So someone is certainly buying shares!
Why do we care? Primarily because it has been one of the top spam-sending botnets ever since the Boston explosion spam. Yesterday, May 11, we saw a RIDICULOUS number of spam subject lines, all touting this penny stock.
Spam Data Mine
Long time readers will be familiar with the UAB Spam Data Mine. In December, we licensed the Spam Data Mine technology to Malcovery who use the Malcovery Spam Data Mine to identify Today's Top Threats for their customers, based on techniques and methodologies developed at UAB over the past six years. The Spam Data Mine receives in the neighborhood of a million messages per day, which we "parse" to extract key features which are stored in a PostgreSQL database. As we look at the top subjects recently, they have been dominated by Pump & Dump spam. For example, here are some of yesterday's Top Subject lines related to Stock:
1267 | It is Our New Alert! This Low Float Monster is a Must See
1203 | You won't beleive your eyes!
1123 | This Stock is Starting to Heat Up
1109 | Perfect Time To Add!
1103 | Our Featured Gem
804 | It`s official, this stock is a 100% perfect buy!
621 | There should be outrage against bailouts!
617 | Things to Know Before Your Next Trade
574 | Closing out the week with Mega Gains!
534 | This Stock is moving up as it should
526 | Exciting Trade Idea Details Inside!
503 | New Pick Coming Tomorrow, This is a Must Read!
496 | This Stock is well positioned for another monster run!
494 | Spectacular bouquets, only $19.99!
478 | Stocks on watch for mega gains this week!
460 | This Company IS RED HOT!!!
458 | This Company is on Immediate Alert! This Bull is Positioning for a Major Run
If we just limit our search to spam that contained the word "Stock" or "Company" in the spam, we had more than 175,000 emails yesterday, using 1,976 subject lines! But how would we know the other subject lines in the campaign? "Perfect Time To Add!" doesn't have the word "Stock" or "Company" in the subject. There is also no guarantee that all of the messages containing these words are part of this spam campaign.
To get a better handle on this, we are going to do a series of queries to build a candidate pool, and then use IBM's i2 Analyst's Notebook to perform what we call "Visual Pre-Clustering" to help us determine some ground truth and to help us screen out some possible outliers. If there are several unrelated botnets all sending Pump and Dump spam, the clusters should be easily identifiable using this technique, while if there are other spam messages unrelated to Pump and Dump being sent by Kelihos, those should also be easily identifiable.
First, let's pile up our data:
Spam Queries to Build a Candidate Data Set
To begin, I'm going to collect a list of IP addresses of computers that sent me spam on May 11, 2013 that used the word "stock" or "company" in their spam message. This query creates a temp table called "may11stockip" that contains the list of IP addresses that sent me those messages and a count of how many times each was used.
spam=> select count(*), sender_ip into may11stockip from spam where (subject ilike '%stock%' or subject ilike '%company%') and receiving_date = '2013-05-11' group by sender_ip order by count desc;This gave me 27,425 unique addresses. Our next step is to ask the Spam Data Mine for other subjects that were sent by that group of IP addresses. While it is true that I could build one massive query to do all of this work, we've found over time that the temporary tables can be useful to have preserved, and using the temporary tables actual speeds up the final result.
spam=> select count(*), subject into may11stocksub from spam a, may11stockip b where a.sender_ip = b.sender_ip and receiving_date = '2013-05-11' group by subject order by count desc;
This generated 6,420 spam subject lines! Far more than the 1976 that contained the words "stock" or "company"! In fact, given the size of the botnet, it is actually likely that I may have received some spam from computers that DID NOT use the word "stock" or "company", so we'll run one more iteration. Dropping the "may11stockip" table, we rebuild it from any computer that sent a subject found in the new temptable, may11stocksub.
spam=> select count(*), sender_ip into may11stockip from spam a, may11stocksub b where a.subject = b.subject and receiving_date = '2013-05-11' group by sender_ip;
Now we have 93,538 candidate IP addresses to consider as possible Kelihos nodes!
Our last iteration in building our "Pile of Data" to hand to i2 is to create relationships between those 93,538 candidate IP addresses and all of the subjects they used. Our goal is to have a nice table that can be imported into i2 Analyst's Notebook.
spam=> select count(*), a.sender_ip, subject into may11stockpairs from spam a, may11stock b where receiving_date = '2013-05-11' and a.sender_ip = b.sender_ip group by a.sender_ip, subject order by count desc;This generates 282,763 pairs of "sender_ip x subject".
Visual Pre-Clustering with i2 Analyst's Notebook
From these 282,763 pairs, we're going to let i2 do all the hard work. Here's the basic idea. Let's say we have 4 computers, A, B, C, and D and each of these computers sent an email from the set M1, M2, M3, M4, M5, M6, M7. For the sake of argument, we are going to say that because there is NO CHANCE that the computers would have sent the same email, unless they were CONTROLLED by the same criminal spammer. If we can demonstrate which computers sent the same messages, we could then determine which computers were controlled by the same criminal.If we were to draw a picture of that, just as you see it on the list, it might look like this:
A - M1
A - M2
A - M3
B - M4
B - M5
C - M1
C - M6
C - M7
D - M1
D - M6
D - M7
But if we allow i2 to give a more intuitive layout, it would look like this, which makes it very plain that Computers A, C, and D are sending "the same" emails, while Computer B is sending "different" emails.
One Day of Kelihos in i2 Analyst's Notebook
You might say to yourself, "That didn't seem to add much value?" But now imagine that there are 282,763 rows on your list instead of eleven, and that instead of having four computers you have 93,538 and instead of having seven email subjects you have 7,226.Here's the chart you get when you do that!
or with some labels on it:
Cluster A
The cluster labeled as "A" is our main "Stock Pump & Dump" cluster. All of our "main" Stock and Company subjects are in the heart of that cluster, with many related computers coming from them.
Cluster B
This cluster is primarily formed of spam for "Work at Home" scams. Some sample subjects from this group include:
Ready to be your own boss?
Business Startup
Your second chance in life just arrived
Sick of paying bills?
Wanna pay off your debts?
Stop just barely making ends meet every month
Make Money Online
Wanna Learn how to make money online?
Success Kit
Ill show you the road to early retirement
Successful Business
New Income
Wanna make up to $6500/month?
Job openings in your area!
At Home Income
A living online is easier than you think
Work From Home Jobs Available!
One slight "False join" is linking "A" and "B" and has to be manually eliminated. "Empty Subject" is the only subject in Cluster H hidden in the midst of the Corpus Callosum that joins A and B. After discovering this, we manually deleted that subject from the chart, and re-ordered the chart, after also first removing "disjointed" clusters that had not tie to the core, such as Cluster F and the others at the top, and many of the "Fan-subclusters" such as Cluster I that surrounded Cluster A.
The "Cleaned Up" version of the chart still makes it abundantly clear that THOUSANDS of IP addresses that are part of the "Stock Pump and Dump" cluster on the left are ALSO part of the "Work at Home" (B) and "Pharmacy Express" (C,D,E) clusters on the right. The Cleaned Up chart, shown below, still has 91,833 IP Addresses and 6,242 Email Subjects, with 277,747 unique "pairs" between them.
IP addresses closer to the right have primarily "Work at Home" spam subjects, such as 95.57.242.156:
count | subject
-------+------------------------------------------
2 | TODAY`S TRADING IDEA IS `Advanced`
1 | Work for Moms
1 | It moves up nicely on heavy accumulation
1 | Job Hiring is at an all time low...
1 | Sick of paying bills?
1 | Business Startup
(6 rows)
or 31.7.57.214:
count | subject
-------+-------------------------------------
13 | Successful Business
1 | Sick of not making ends meet?
1 | Wanna make up to $6500/month?
1 | Job Hiring is at an all time low...
1 | What kind of investor are you?
(5 rows)
IP addresses closer to the left have primarily "Stock Pump and Dump" spam subjects, such as 178.90.148.44:
count | subject
-------+------------------------------------------------------------------------
5 | This Company is Ready to Run
5 | It is one to watch this week!
4 | Analysts gives this stock a "STRONG SPECULATIVE BUY" rating
4 | New Play Coming
3 | This Company has a history of Huge Rallies, on verge of another Rally?
3 | New Wild Breakout Pick Coming TONIGHT!
3 | The NEW TRADE ALERT
3 | A Potential Mover from Penny Stock
3 | It Is Wasting Little Time Making Waves
2 | This Company Ends Last Week Strong
2 | Get Ready For The Hottest Gold Pick On The Planet!
2 | Our New Blazin Sub-Penny Alert!
1 | Be Ready
1 | Success Kit
1 | This Company exploded in volume today
1 | Second chance for traders who have `calmed down`...
1 | Sick of a dead end job?
1 | We`ve Got A Bouncer On Our Hands!
1 | This Stock Signs Agreement With Reputable PR Agency
1 | Back to work week will get this play really going!
(20 rows)
The "Bumps" that circle cluster B are groups of IP addresses that share "some but not all" of the subjects found in Cluster B. There are many IP addresses that we saw only once or twice -- because of their low volume, they do not appear as "fully meshed" as the IP addresses in the "core" of Cluster B. A couple examples will demonstrate this.
In the core of Cluster B we see thousands of IP addresses that were used for at least 2 or 3 Work at Home messages:
'59.94.88.82/32'Small "micro clusters" of IP addresses used for both the "C" or "D" Pharma spam and one or more of the Work at Home subjects fill the ridge between Clusters "B" and "C, D, E":
-------+-------------------------------
2 | Successful Business
1 | Wanna make up to $6500/month?
1 | Income At Home
'120.60.69.113/32'
-------+-----------------------------------------------
1 | Success Kit
1 | Stop just barely making ends meet every month
'212.62.37.89/32'
-------+-------------------------------
2 | Success Kit
1 | Wanna make up to $6500/month?
1 | Income At Home
'87.241.142.252/32'
-------+------------------------------
2 | Work for Moms
1 | Replace your nine to five...
'37.99.26.121/32'
-------+------------------
1 | Business Startup
1 | Success Kit
'2.146.92.235/32'
-------+-----------------------------------------
1 | Make Money Online
1 | Your second chance in life just arrived
'176.33.176.120/32'
-------+-----------------------------------------
1 | ð°ð°ð°Cialis (30 pills 20mg) USD 91.50 & Viagra (30 pills 100mg) USD 81.90ð°ð°ð°
1 | ð°ð°ð°Viagra (30 pills 100mg) USD 81.90 & Cialis (30 pills 20mg) USD 91.50 ð°ð°ð°
1 | Your second chance in life just arrived
'113.22.157.247/32'
-------+------------------------------
1 | ð°ð°ð°Cialis (30 pills 20mg) USD 91.50 & Viagra (30 pills 100mg) USD 81.90ð°ð°ð°
1 | Replace your nine to five...
1 | ð°ð°ð°Viagra (30 pills 100mg) USD 81.90 & Cialis (30 pills 20mg) USD 91.50 ð°ð°ð°
Here are two example IP addresses from a single "Bump" on the left edge of Cluster B.
'190.236.188.41/32'
-------+-----------------------------------------------
1 | Stop just barely making ends meet every month
'118.68.119.212/32'
-------+-----------------------------------------------
1 | Stop just barely making ends meet every month
Cluster C, D, and E
These are Viagra Spam clusters. C & D are two very popular subjects, both resolving to "Pharmacy Express" websites. The small cluster "E" is formed of IP addresses that sent spam for both Cluster C and Cluster D.
Cluster F & Friends
Cluster F and the neighboring small clusters at the top of the chart have been included primarily through a coincidental usage of the word "Company" in their subject lines. F, for example, is a well-known spammer of the type the industry calls a "Snowshoe spammer." They rotate through hosted data centers, paying their bills for nice hardware to be used for spamming with stolen credit cards. When they get thrown out of one data center for spamming, they move to the next.
Cluster G & J
These clusters are also primarily joined through the coincidental use of the word "Company" in the subcluster subjects.
Cluster I
There are many "Fan-shapes" around the edges of Cluster A. Looking at Cluster I as an example, there are 36 subjects in that "fan cluster" all related to "Replica goods":
A Rolex replica watch
ALL MAJOR DESIGNER REPLICA WATCHES
Bags
Beautiful quartz, water-resistant Replica watches
Box Sets
Bracelets
Cufflinks
Gold Watches
Gucci Bags
...
Only a single (subject x sender_ip) pair links this fan-cluster to the main Cluster A. The subject "replica watches! rolex, patek philippe, vacheron constantin and others!" which was attached to dozens of IP addresses in the fan-cluster, is also attached to the IP address "201.9.120.242" That IP address also sent us two messages with the email subjects "This Stock Move Starting!".
154 IP addresses in Cluster A also used the subject "This Stock Move Starting!"
To focus on the core activity, disconnected subclusters, such as F, and "fan-clusters" such as I are removed from the chart, and the layout is performed again.
Thursday, 9 May 2013
CBS News in New York has a video on their website this morning title Cyber-attacks behind possibly record-breaking bank heist. Former FBI Assistant Director John Miller shares the story and says "We've learned how they carried out this cyber-attack, and it's unlike anything ever seen before."
Except it isn't. In fact, on Tuesday morning this week I was sharing a presentation about financial cyber crimes with Iberia Bank in New Orleans, LA. I mentioned that one of the things that banks still need to be on the lookout for is true "intrusions" into their system. By planting malware on internal bank systems, criminals can gain deep penetrating access to the internal workings of the bank and take their time, recruiting specialists to help them learn the inner workings of the bank to coordinate very elaborate schemes.
The attack described by Miller involves a group who had partnered together around the world calling themselves the "Unlimited Operation". In the scheme he describes, hackers gain internal access to a bank, or in the most recent case "a Visa/MasterCard processing Center," and gain the ability to manipulate the withdrawal limit on certain ATM Debit cards. These card numbers are then distributed around the world to "Cashing Gangs" that make local copies of the ATM cards and build a network of cashers who "work the machines."
One of the most notorious hacking operations in U.S. History was "Solar Sunrise" - a deep penetration into the Pentagon's computer operations that served as a wake up call for the U.S. Government and lead to the production of a video (now available on YouTube) called
The hacker mastermind behind Solar Sunrise was an Israeli hacker, Ehud Tenenbaum, who called himself The Analyzer. In September of 2008 we wrote about him on this blog in the story Is The Analyzer Really Back? (The return of Ehud Tenenbaum) because Tenenbaum was the mastermind behind an attack against a Calgary-based financial services company. In that case, Tenenbaum penetrated the company's internal systems and gained the ability to alter or remove the ATM withdrawal limits. Then, teams of cashers, armed with counterfeit ATM cards bearing the magnetic stripe information corresponding to those accounts, hit the streets withdrawing $2 Million dollars in a blitz of ATM-withdrawals.
But that's not the only time it happened. This blog also ran the story in November 2009 called The $9 Million World-Wide Bank Robbery that shared the details of exactly the same type of raid being performed against RBS WorldPay, headquartered in Atlanta, Georgia. In that case, Estonian hackers penetrated the financial services company, that specializes in "Payroll Debit Cards". After doing so, they contracted with fellow-criminals in Russia, Yevgeny Anikin and Viktor Pleschcuk, who have both confessed their crimes, and received suspended sentences in the Russian bribery-based version of Justice. (See article: Hacker3 escapes jail time in RBS WorldPay ATM heist.) Anikin and Pleschuk worked with the famous Credit Card trading criminal BadB (Vladislav Horohorin) to build a network of cashers operating in 280 cities. Over the course of 12 hours, 2100 ATM machines in 280 cities allowed more than $9 Million in withdrawals from those 44 accounts.
That doesn't mean Cyber Criminals can't go to jail though! Vladislav Horohorin was arrested in Nice, France as he prepared to return to Moscow. (See the Daily Mail story, One of world's most wanted cyber criminals caught on French Riviera.) Horohorin, or "BadB" was the founder of Carder Planet, and was actually returned to the US, where he was tried and in April 2013 Sentenced to 88 Months in Prison.
For a look at one of the US-based casher rings in the RBS WorldPay case, we could also consider the case of Sonya Martin, a Nigerian woman, who ran the Chicago casher gang used in that case. Sonya's ring only withdrew $89,120 in Chicago, but she still got a 30 month sentence back in August 2012. See: Cell leader in RBS WorldPay fraud scheme sentenced.
One other case that used this methodology, and also had New York City ties, was the case that charged Ukrainians Yuriy Ryabinin and Ivan Biltse with performing $750,000 in ATM withdrawals. BankInfoSecurity.com reported the story in 2008, which documented that $5 million was withdrawn in more than 9,000 withdrawals "all around the world" on September 30th and October 1st of that year. According to an affidavit shared by Wired Magazine, this case was tied to a breach of a Citibank server that processed ATM withdrawals at 7-Eleven convenience stores.
In the current case described this morning by CBS, it was described that later today New York U.S. Attorney's office prosecutor Loretta Lynch would announce the arrest of seven members of a New York casher gang that hit ATM's up and down Broadway for almost $2 million during the most recent "Unlimited Operation" case. "Unlimited" was involved in a similar $5 Million raid against a financial institution in India. CBS shared a graphic of the location of ATM machines that were used in the arrests that will be announced later today.
In the New York case, the arrested cashers were:
- ALBERTO YUSI LAJUD-PEÑA, 23 (deceased)
- JAEL MEJIA COLLADO, 23
- JOAN LUIS MINIER LARA, 22
- EVAN JOSE PEÑA, 35
- JOSE FAMILIA REYES, 24
- ELVIS RAFAEL RODRIGUEZ, 24
- EMIR YASSER YEJE, 24
- CHUNG YU-HOLGUIN, 22
The Eastern District of New York's Press Release, Eight Members of New York Cell of Cybercrime Organization Indicted in $45 Million Cybercrime Campaign, released today, May 09, 2013, explains the details of how the cashers above, who withdrew $2.8 Million in New York, fit in to the larger "Unlimited Operations." In the first operation, the New York crew withdrew $400,000 from 140 ATMs in New York City in two hours and 25 minutes. In the second operation, February 19-20, 2013, the crew performed 3,000 ATM withdrawals, scoring $2.4 Million in cash between 3 PM on the 19th and 1:26 AM on the 20th, stealing about $240,000 per hour!
The worldwide take on the Feb 19-20 raid included 36,000 transactions and $40 million!
Alberto Yusi Lajud-Peña, the leader of the New York casher ring, laundered the cash, in one case depositing 7,491 $20 bills in a single transaction in Miami, Florida. The crew bought and sold "portable luxury goods" with the cash, including luxury watches and cars, including a Mercedes SUV and a Porsche Panamera valued at $250,000 between the two. Alberto, also known as "Prime" online, was murdered in the Dominican Republic sometime after these robberies occurred.
U.S. Attorney Lynch says that law enforcement authorities in Japan, Canada, Germany, and Romania made great contributions in the case, but that they also received cooperation from the authorities in the UAE, Dominican Republic, Mexico, Italy, Spain, Belgium, France, United Kingdom, Latvia, Estonia, Thailand, and Malaysia.
What these cases are intended to demonstrate is the importance of closely monitoring the internal corporate network for signs of a breach. In a presentation at ITWeb Security Summit this week, "Formulating an attack-focused security plan", Mandiant CSO Richard Bejtlich shares that 75% of break-ins happen through someone clicking on or responding to a malicious email, and that in 2/3rds of incidents, the breach isn't discovered by the company but is reported by a third party organization. Bejlitch says that by the time the attacker is discovered "they will have been inside your company for around eight months."
That's what Malcovery's Today's Top Threats report is intended to address. What is that Top Threat email that is going to lead to criminals having control of one or more of your internal employees? It takes time for the criminal to learn enough about your organization's internal workings to be able to take over and reset ATM balances. Quick detection of the breach is key to preventing problems like those described above.
Wednesday, 8 May 2013
Timeline:
- December 20, 2011 - Federal Indictment was filed in chambers
- December 21, 2011 - Arrest warrant issued to US Marshalls
- March 2012 - MicrosoftDCU, FS-ISAC, and NACHA vs. Zeus - the Microsoft digital crimes unit files civil actions against John Does 1-39, which included Bx1.
- Jan 10, 2013 - Krebs: Police Arrest Alleged ZeuS Botmaster “bx1”
- April 29, 2013 - Redacted indictment unsealed
- May 3, 2013 - Three-Year Hunt Nabs Hacker Who Popularized Cybercrime
The BX1 Indictment
(Click to download the Bx1 Indictment) North District of Georgia (Atlanta)Criminal Docket for Case#: 1:11-cr-00557-UNA-1 (filed 12/20/2011)
Counts:
(1) 18:1349 Attempt and Conspiracy to Commit Mail Fraud
(2-11) 18:1343 & 2 – Fraud by Wire, Radio, or Television
(13) 18:1030(a)(5)(A), 1030(c)(4)(B) – Fraud Activity Connected with Computers
(14-23) 18:1030(a)(2)(C), 1030(c)(2)(B)(i) – Fraud Activity Connected with Computers
From December 2009 to September 2011 [Redacted] and Hamza Bendelladj, AKA Bx1 conspired to … defraud financial institutions and individuals and obtain money and property from them by means of materially false and fraudulent pretenses, representations and promises, as well as omission of material facts, including moneys, funds, credits, assets, and other properties.
Botnets were defined and described, and SpyEye was described as having the capabilities to “facilitate the theft of confidential personal and financial information by numerous examples including a data grabber or keystroke logger, and at times by presenting a fake bank web page or portions of a bank web page to trick a user into entering personal information.
(The principal author of SpyEye is redacted in the published Indictment). Bx1 is listed as a co-conspirator who helped develop SpyEye components. The behavior of SpyEye is described in great detail, including the creation and deployment of particular Web Injects and how they behave.
Bx1 communicated through email, instant messaging programs, and web forums to discuss purchasing, updating, customizing, developing components for, and pricing SpyEye, as well as aspects of operating SpyEye components.
From at least February 21, 2011 through February 24, 2011 at least one of Bx1’s C&C servers were located in Atlanta, Georgia, distributing configs that targeted 253 unique financial institutions.
Counts 2 through 11 of the indictment trace particular infections that could be documented through the logs of the Atlanta-based server and which lead to confirmed financial losses of particular victims in California, North Carolina, New York, and Virginia.
Count 12 names particular websites used by Bx1 for his advertising, including the website www.darkode.com where particular messages in January, June, July, and September 2010 are cited. The June issue discussed “Form Grabbing” while an update in September introduced the ability to scan all controlled bots for Credit Card credentials. In April 2011, the YouTube user “danielhb1988” called himself Bx1 and claimed to be selling SpyEye in a video advertised on that site. In July 2011, an undercover law enforcement officer purchased SpyEye from Bx1 for $8,500, receiving his purchased code from www.sendspace.com.
Counts 14 through 23 document particular examples of the SpyEye server at 75.127.109.16, communicating with protected computers
The Atlanta Server
During the time period stated in the indictment, the IP address indicated was known to be distributing malware from the hostile URL (spaces added for safety):www . 100myr . com / cp / bin / exe . exe
www . 100myr . com / cp / gate . php ? guid = (infected machine configuration report stuff here)
That server was hosted at Global Network Access (gnax.net) in Atlanta.
The domain was registered January 20, 2011 on Joker.com by random68@live.com
That same email address was used to register the domain "bx1.biz"
Each year the Federal Trade Commission puts out a report called the Consumer Sentinel Report that is not a statistical projection about Identity theft and fraud, but a listing of actual complaints received.
(102 page report here: Consumer Sentinel 2012)
| Metropolitan Statistical Area | Complaints per 100,000 |
|---|---|
| Miami / Fort Lauderdale / Pompano Beach, FL | 645.4 |
| Naples / Marco Island, FL | 397.8 |
| Tampa / St. Petersburg / Clearwater, FL | 352.3 |
| Cape Coral / Fort Myers, FL | 292.5 |
| Tallahassee, FL | 288.5 |
| Lakeland / Winter Haven, FL | 281 |
| Port St. Lucie / Fort Pierce, FL | 272.6 |
| Atlanta / Sandy Springs / Marietta, GA | 246.6 |
| North Port / Bradenton / Sarasota, FL | 244.9 |
| Orlando / Kissimmee / Sanford, FL | 233.8 |
| Punta Gorda, FL | 220.7 |
| Valdosta, GA | 218.5 |
| Ocala, FL | 213.4 |
| Albany, GA | 209.1 |
| Columbus, GA/AL | 205.9 |
| Montgomery, AL | 203.7 |
| Jacksonville, FL | 190.4 |
| Detroit / Warren / Livonia, MI | 188.2 |
| Sebastian / Vero Beach, FL | 184.7 |
| Savannah, GA | 183.3 |
| Palm Bay / Melbourne / Titusville, FL | 182.6 |
| Gainesville, FL | 182.4 |
| Deltona / Daytona Beach / Ormond Beach, FL | 177.9 |
| Beaumont / Port Arthur, TX | 176 |
| Macon, GA | 170.5 |
16 of top 25 in Florida
6 of top 25 in Georgia
1 in Alabama
1 in Michigan
1 in Texas
Alabama, my home state, seems to have some seriously bad scores in the area of Identity Theft. The report lists "per capita" complaints, ordered by the "Metropolitan areas" as defined by the US Census Bureau.
Alabama Cities:
#15 - Columbus, GA/AL (205.9 per 100,000)
#16 - Montgomery, AL (203.7 per 100,000)
#42 - Auburn-Opelika, AL (124.1 per 100,000)
#62 - Birmingham-Hoover, AL (111 per 100,000)
#91 - Enterprise-Ozark, AL (97.8 per 100,000)
#118 - Anniston-Oxford, AL (90.2 per 100,000)
#125 - Tuscaloosa, AL (88.4 per 100,000)
#132 - Dothan, AL (87.2 per 100,000)
#145 - Gadsden, AL (84.3 per 100,000)
#195 - Decatur, AL (72.8 per 100,000)
#198 - Daphne-Fairhope-Foley, AL (72.4 per 100,000)
#303 - Florence-Muscle Shoals, AL (56.4 per 100,000)
Subscribe to:
Posts (Atom)
