nellie2 Posted August 6, 2005 Report Share Posted August 6, 2005 AUGUST 05, 2005 (COMPUTERWORLD) - Officials at Sunbelt Software, a Clearwater, Fla.-based vendor of antispyware tools, said the company stumbled upon a massive ID theft ring that is using a well-known spyware program to break into and systematically steal confidential information from an unknown number of computers worldwide. The operation was discovered yesterday during research Sunbelt was doing on a spyware program belonging to a particularly dangerous class of browser hijacking tools called CoolWebSearch (CWS), according to Sunbelt's president, Alex Eckelberry. CWS programs are extremely hard to detect and remove, and are used to redirect users to Web sites that use spyware tools to collect a variety of information from infected computers. The CWS variant being researched by Sunbelt turned infected systems into spam zombies and uploaded a wide variety of personal information to a remote server apparently located in the U.S. That server holds a "treasure trove of information" for ID thieves, Eckelberry said. Sunbelt's research showed that the information being uploaded to the remote server included chat sessions, user names, passwords and bank information, he said. The bank information included details on one company bank account with more than $350,000 in deposits and another belonging to a small California company with over $11,000 in readily accessible cash, he said. Many of the records being uploaded also contained eBay account information, he said. Among the highly personal bits of information Sunbelt was able to retrieve from the server were one family's vacation plans, instructions to a limo driver to pick up passengers from an airport and details about one computer user with a penchant for pedophilia. Sunbelt officials did not say how they accessed the material. But the existence of a large file that the company said it retrieved from the remote server was confirmed by Computerworld. Sunbelt said the file contained user names, addresses, account information, phone numbers, chat session logs, monthly car payment information and salary data. "It's one of the most egregious things we have ever seen," Eckelberry. "We know this kind of data is out there, but this is the first time we actually have the data that the criminals are using." Information gathered from infected computers is uploaded to the remote server and stored in highly organized files that appear to be accessed by multiple ID thieves, Eckelberry said. The files grow to anywhere from 10MB to 20MB in size before they are refreshed with new information, he said. The FBI has been contacted and is working on the case, Eckelberry said. In addition, Sunbelt has contacted some of the individuals and banks whose data has been logged to warn them of the compromise. The domain of the remote server appears to have been registered in China, although the server itself is located in the U.S., Eckelberry said. "We are working to get that server taken down." He declined to offer more details. A spokesman for the FBI could not be reached for comment. Sunbelt's discovery brings home the seriousness and scope of the growing ID theft problem, said Pete Lindstrom, an analyst at Spire Security LLC in Malvern, Pa. "I think this stuff is much more significant than the notification of [compromises] by credit card companies," Lindstrom said. That's because the credit card industry as a whole has better controls in place to detect and prevent abuses resulting from such compromises than individuals, he said. "This stuff hits home because it's personal. It's like taking something out of your home," Lindstrom said. "Each and every one of these accounts can be compromised, and it hurts someone."sourceIf anyone suspects they have been affected by this they need to immediately do the following: Disconnect from the Internet, contact their all their banks and credit card companies immediately. Change passwords to all email and online accounts and seek help to clean their computers before going onlne again. Please check your hosts file... you can do this by running a scan with hijackthis, if you see a long list of hosts like the following, then let me know pleaseO1 - Hosts: 82.146.42.123 lloydstsb.co.uk O1 - Hosts: 82.146.42.123 online.lloydstsb.co.uk O1 - Hosts: 82.146.42.123 www.lloydstsb.co.uk O1 - Hosts: 82.146.42.123 www.lloydstsb.com O1 - Hosts: 82.146.42.123 personal.barclays.co.uk O1 - Hosts: 82.146.42.123 barclays.co.uk O1 - Hosts: 82.146.42.123 ibank.barclays.co.uk O1 - Hosts: 82.146.42.123 www.barclays.co.uk O1 - Hosts: 82.146.42.123 www.nwolb.com O1 - Hosts: 82.146.42.123 nwolb.com O1 - Hosts: 82.146.42.123 hsbc.co.uk O1 - Hosts: 82.146.42.123 www.hsbc.co.uk O1 - Hosts: 82.146.42.123 abbey.com O1 - Hosts: 82.146.42.123 www.abbey.com O1 - Hosts: 82.146.42.123 www.abbey.co.uk O1 - Hosts: 82.146.42.123 abbey.co.uk O1 - Hosts: 82.146.42.123 cahoot.com O1 - Hosts: 82.146.42.123 www.cahoot.com O1 - Hosts: 82.146.42.123 www.cahoot.co.uk O1 - Hosts: 82.146.42.123 cahoot.co.uk O1 - Hosts: 82.146.42.123 www.co-operativebank.co.uk O1 - Hosts: 82.146.42.123 co-operativebank.co.uk O1 - Hosts: 82.146.42.123 www.co-operativebank.com O1 - Hosts: 82.146.42.123 co-operativebank.com O1 - Hosts: 82.146.42.123 welcome2.co-operativebankonline.co.uk O1 - Hosts: 82.146.42.123 welcome6.co-operativebankonline.co.uk O1 - Hosts: 82.146.42.123 welcome8.co-operativebankonline.co.uk O1 - Hosts: 82.146.42.123 welcome10.co-operativebankonline.co. Quote Link to comment Share on other sites More sharing options...
andsome Posted August 6, 2005 Report Share Posted August 6, 2005 Good tip, but I personally NEVER bank on line. Quote Link to comment Share on other sites More sharing options...
Scarecrow Man Posted August 7, 2005 Report Share Posted August 7, 2005 http://www2.spywareinfo.com/category/news/cws-id-theft/ Quote Link to comment Share on other sites More sharing options...
dadyassa Posted August 7, 2005 Report Share Posted August 7, 2005 Thanks for the tip nel, as you advised i checked with HJT, but sometimes although not recently i bank on line with a Spanish bank, there were no 01 host files.Just before where i think they should be is this " R3 - Default URLSearchHook is missing "Is this the problem or do I just not have any host files :blink: Quote Link to comment Share on other sites More sharing options...
nellie2 Posted August 7, 2005 Author Report Share Posted August 7, 2005 You probably don't have any hosts files... hijackthis will list hosts it doesn't recognise so the bad hosts will be listed in a log.You can fix that R3 though... don't worry about it, it's just a registry entry that should be fixed. Quote Link to comment Share on other sites More sharing options...
dadyassa Posted August 7, 2005 Report Share Posted August 7, 2005 You probably don't have any hosts files... hijackthis will list hosts it doesn't recognise so the bad hosts will be listed in a log.You can fix that R3 though... don't worry about it, it's just a registry entry that should be fixed.Thanks nel :flowers: :flowers: Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.