Cyber Crime

Koobface command and control servers silent

by certifiedbug on January 19, 2012

in Internet Security

H Security

The Koobface network is apparently down, according to Facebook. Ryan McGeehan, Facebook security official, told Reuters that the company’s decision to expose the five men alleged to be behind the malware had had an effect within 24 hours: “The thing that we are most excited about is that the botnet is down.” Yesterday, Facebook decided to publish the names of alleged gang members based on details of research carried out in 2009-2010 by two German researchers. One of the researchers works for Security company Sophos, which pre-empted Facebook’s announcement by publishing the report.

http://www.h-online.com/security/news/item/Koobface-C-C-goes-silent-after-alleged-controllers-exposed-1416869.html

{ 0 comments }

Koobface malware gang exposed

by certifiedbug on January 17, 2012

in Internet Security

H Security

The five men behind the Koobface worm, which spreads over Facebook and other social networks, hide in plain sight, living comfortably in St Petersberg, Russia, according to Facebook investigators and other security researchers.

http://www.h-online.com/security/news/item/Koobface-gang-to-be-exposed-by-Facebook-1414813.html

IDG News Service -
http://www.computerworld.com/s/article/9223484/Facebook_researchers_turn_up_heat_on_Koobface_gang

{ 0 comments }

FBI Press Release
Manhattan U.S. Attorney Charges Seven Individuals for Engineering Sophisticated Internet Fraud Scheme That Infected Millions of Computers Worldwide and Manipulated Internet Advertising Business

Malware Secretly Re-Routed More Than 4 Million Computers, Generating at Least $14 Million in Fraudulent Advertising Fees for the Defendants

In conjunction with the arrests yesterday, authorities in the United States seized computers at various locations, froze the defendants’ financial accounts, and disabled their network of U.S.-based computers—including dozens of rogue DNS servers located in New York and Chicago. Additionally, authorities in the United States took steps with their foreign counterparts to freeze the defendants’ assets located in other countries. Remediation efforts were immediately undertaken to minimize any disruption of Internet service to the users of computers infected with the Malware. This remediation was necessary because the dismantling of the defendants’ rogue DNS servers—to which millions of computers worldwide had been redirected—would potentially have caused all of those computers, for all practical purposes, to lose access to websites.

The remediation effort is being carried out pursuant to the order of a Manhattan federal court judge. As part of that order, the defendant’s rogue DNS servers have been replaced with legitimate ones. Internet Systems Consortium (“ISC”), a not-for-profit entity, was appointed by the court to act as a third-party receiver for a limited period of 120 days during which time it will administer the replacement DNS servers. Although the replacement DNS servers will provide continuity of Internet service to victims, those replacement servers will not remove the Malware from the infected computers. Users who believe their computers may be infected can find additional information at FBI.gov.

http://www.fbi.gov/newyork/press-releases/2011/manhattan-u.s.-attorney-charges-seven-individuals-for-engineering-sophisticated-internet-fraud-scheme-that-infected-millions-of-computers-worldwide-and-manipulated-internet-advertising-business

{ 0 comments }

Rejected Federal Tax Transaction Scam

by certifiedbug on October 4, 2011

in Internet Security

A malicious scam which continues to do the rounds with three caught by my spam filter, the transaction ID changes.

How does IRS e-file work?A. You or your tax professional, prepare your tax return. In many cases, the tax professional is also the Electronic Return Originator (ERO) who is authorized to file your return electronically to the IRS. Ask your tax professional to file your return through IRS e-file.You sign your electronic tax return by either using a Self-Select PIN for e-file for a completely paperless return, or by signing Form 8453, US. Individual Income Tax Transmittal for an IRS e-file Return.See ” If the return is electronic, how do I sign it?” for more information.After you sign the return using a Self-Select PIN or Form 8453,the ERO transmits the return to the IRS or to a third-party transmitter who then forwards the entire electronic record to the IRS for processing. Once received at the IRS, the return is automatically checked by computers for errors and missing information. If it cannot be processed, it is sent back to the originating transmitter (usually the ERO) to clarify any necessary information. After correction, the transmitter retransmits the return to the IRS. Within 48 hours of electronically sending your return to IRS, the IRS sends an acknowledgment to the transmitter stating the return is accepted for processing. This is your proof of filing and assurance that the IRS has your return information. The Authorized IRS e-file Provider then sends Form 8453 to the IRS.If due a refund, you can expect to receive it in approximately three weeks from the acknowledgment date – even faster with Direct Deposit (half the time as when filed on paper). If you owe tax, see “What if I owe Money?” for payment options available this year.

Internal Revenue Service,
Metro Plex 1,
8401 Corporate Drive, Suite 300,
Landover, MD 20785

Forbes. 6/23/2011
http://www.forbes.com/sites/kellyphillipserb/2011/06/23/tax-scams-making-the-rounds-again/

{ 0 comments }

Microsoft: Rustock Civil Case Closed

September 22, 2011

The Official Microsoft® Blog Rustock Civil Case Closed: Microsoft Refers Criminal Evidence to FBI 22 Sep 2011 As you may have read in this morning’s edition of CNET, on Sept. 13th, Judge James L. Robart, of the U.S. District Court for the Western District of Washington ruled that the domain names and Internet protocol addresses [...]

Read the full article →

TDSS botnet sophisticated threat

September 7, 2011

Krebs on Security The TDSS botnet is the most sophisticated threat today, according to experts at Russian security firm Kaspersky Lab. First launched in 2008, TDSS is now in its fourth major version (also known as TDL-4). The malware uses a “rootkit” to install itself deep within infected PCs, ensuring that it loads before the [...]

Read the full article →

Stolen Bank Cards Vendor Hacked

August 17, 2011

Krebs On Security Brian Krebs recently wrote about an online service that was selling access to stolen credit and debit card data. “The real news is that few of these fraud shops are secure enough to keep their stock of stolen data from being pilfered by thieves’, said Krebs. A prime example is the shop [...]

Read the full article →

eThieves Steal $217k

August 17, 2011

Last month Cyber Criminals stole $217,000 from the Metropolitan Entertainment & Convention Authority (MECA), a nonprofit organization. Krebs On Security Lea French, MECA’s chief financial officer, said the trouble began when an employee with access to the organization’s online accounts opened a booby-trapped email attachment containing password-stealing malware. The attackers used MECA’s online banking credentials [...]

Read the full article →

UK Police chief warns of rise in Internet crime

October 4, 2010

Sir Paul Stephenson, the Metropolitan Police Commissioner, said organised crime gangs were increasingly turning to the internet in pursuit of illegal profits. Writing in the Sunday Telegraph he said forces faced with a budget squeeze should not cut specialists tacking such complex crimes in order to maintain bobbies on the beat, adding “Uniform officers alone [...]

Read the full article →

Nineteen Arrested in £20 million ZeuS Banking Fraud

September 29, 2010

Officers arrested 15 men and four women aged between 23 and 47 on suspicion of the Computer Misuse Act, Proceeds of Crime Act and Fraud Act. Detective Chief Inspector Terry Wilson told the Mail that the Virtual Taskforce worked closely with several UK banks to gather the evidence and information needed to shut down the [...]

Read the full article →