Feeds

Massachusetts PCs infected by data-hungry worm

How nasty was it? Let us count the ways

Beginner's guide to SSL certificates

Computers operated by the state of Massachusetts were infected for more than three weeks with a sophisticated piece of malware that security researchers say stealthily stole more than a gigabyte's worth of sensitive data over the past 10 days.

Not all of the banking credentials, email passwords and other data lifted by the Qakbot worm originated with the PCs belonging to the Massachusetts Departments of Unemployment Assistance and Career Services networks, but the figure, included in an analysis (PDF here) published Friday by Symantec, gives an idea of how the advanced capabilities of the malware allow it to steal wholesale amounts of sensitive information.

"Analysis of the recent version of Qakbot show that this financial institution targeting malware can result in significant monetary loss for infected clients," researchers from the antivirus provider wrote. "By capturing and sending session information to the malware controllers in real time, the malware authors are able to extend legitimate online sessions and illegally transfer funds."

On Tuesday, Massachusetts officials warned residents that about 1,500 computers operated by the two unemployment agencies had been infected by Qakbot. It said anyone who conducted business with them from April 19 to May 13 may be at risk for theft of their social security numbers, employer identification numbers, email addresses, and residential or business addresses.

Officials "learned yesterday that the computer virus (W32.QAKBOT) was not remediated as originally believed and that the persistence of the virus resulted in a data breach," the advisory stated. "Once it was discovered, the system was shut down and the breach is no longer active."

According to Symantec, Qakbot infections spiked in the week leading up to the compromise of the Massachusetts agencies, from well under 50,000 PCs to more than 200,000. The amount of compromised data uploaded to Qakbot servers also skyrocketed, reaching almost 300 megabytes on May 13 alone, and exceeding 200 megabytes per day for the five previous days. The Symantec figures show upload rates for a 10-day period only, starting on May 7, that show well over a gigabyte of information being transferred. The figure includes data stolen from all Qakbot-infected machines, not just those operated by Massachusetts.

Qakbot contains rootkit capabilities to remain hidden. It initially is downloaded when end users visit malicious sites that exploit known vulnerabilities on their machines. From there, the malware can spread through network shares and removable drives.

The bot has the ability to extend online banking sessions even after the end user thinks they have been completed so that the criminals behind the malware can then siphon funds out of victims' accounts. It even comes with the ability to remove logoff icons from bank webpages to make it harder for victims to terminate sessions. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
Hackers thrash Bash Shellshock bug: World races to cover hole
Update your gear now to avoid early attacks hitting the web
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
Ello? ello? ello?: Facebook challenger in DDoS KNOCKOUT
Gets back up again after half an hour though
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.