Feeds

Massachusetts PCs infected by data-hungry worm

How nasty was it? Let us count the ways

Intelligent flash storage arrays

Computers operated by the state of Massachusetts were infected for more than three weeks with a sophisticated piece of malware that security researchers say stealthily stole more than a gigabyte's worth of sensitive data over the past 10 days.

Not all of the banking credentials, email passwords and other data lifted by the Qakbot worm originated with the PCs belonging to the Massachusetts Departments of Unemployment Assistance and Career Services networks, but the figure, included in an analysis (PDF here) published Friday by Symantec, gives an idea of how the advanced capabilities of the malware allow it to steal wholesale amounts of sensitive information.

"Analysis of the recent version of Qakbot show that this financial institution targeting malware can result in significant monetary loss for infected clients," researchers from the antivirus provider wrote. "By capturing and sending session information to the malware controllers in real time, the malware authors are able to extend legitimate online sessions and illegally transfer funds."

On Tuesday, Massachusetts officials warned residents that about 1,500 computers operated by the two unemployment agencies had been infected by Qakbot. It said anyone who conducted business with them from April 19 to May 13 may be at risk for theft of their social security numbers, employer identification numbers, email addresses, and residential or business addresses.

Officials "learned yesterday that the computer virus (W32.QAKBOT) was not remediated as originally believed and that the persistence of the virus resulted in a data breach," the advisory stated. "Once it was discovered, the system was shut down and the breach is no longer active."

According to Symantec, Qakbot infections spiked in the week leading up to the compromise of the Massachusetts agencies, from well under 50,000 PCs to more than 200,000. The amount of compromised data uploaded to Qakbot servers also skyrocketed, reaching almost 300 megabytes on May 13 alone, and exceeding 200 megabytes per day for the five previous days. The Symantec figures show upload rates for a 10-day period only, starting on May 7, that show well over a gigabyte of information being transferred. The figure includes data stolen from all Qakbot-infected machines, not just those operated by Massachusetts.

Qakbot contains rootkit capabilities to remain hidden. It initially is downloaded when end users visit malicious sites that exploit known vulnerabilities on their machines. From there, the malware can spread through network shares and removable drives.

The bot has the ability to extend online banking sessions even after the end user thinks they have been completed so that the criminals behind the malware can then siphon funds out of victims' accounts. It even comes with the ability to remove logoff icons from bank webpages to make it harder for victims to terminate sessions. ®

Top 5 reasons to deploy VMware with Tegile

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.