Feeds

Massachusetts PCs infected by data-hungry worm

How nasty was it? Let us count the ways

Using blade systems to cut costs and sharpen efficiencies

Computers operated by the state of Massachusetts were infected for more than three weeks with a sophisticated piece of malware that security researchers say stealthily stole more than a gigabyte's worth of sensitive data over the past 10 days.

Not all of the banking credentials, email passwords and other data lifted by the Qakbot worm originated with the PCs belonging to the Massachusetts Departments of Unemployment Assistance and Career Services networks, but the figure, included in an analysis (PDF here) published Friday by Symantec, gives an idea of how the advanced capabilities of the malware allow it to steal wholesale amounts of sensitive information.

"Analysis of the recent version of Qakbot show that this financial institution targeting malware can result in significant monetary loss for infected clients," researchers from the antivirus provider wrote. "By capturing and sending session information to the malware controllers in real time, the malware authors are able to extend legitimate online sessions and illegally transfer funds."

On Tuesday, Massachusetts officials warned residents that about 1,500 computers operated by the two unemployment agencies had been infected by Qakbot. It said anyone who conducted business with them from April 19 to May 13 may be at risk for theft of their social security numbers, employer identification numbers, email addresses, and residential or business addresses.

Officials "learned yesterday that the computer virus (W32.QAKBOT) was not remediated as originally believed and that the persistence of the virus resulted in a data breach," the advisory stated. "Once it was discovered, the system was shut down and the breach is no longer active."

According to Symantec, Qakbot infections spiked in the week leading up to the compromise of the Massachusetts agencies, from well under 50,000 PCs to more than 200,000. The amount of compromised data uploaded to Qakbot servers also skyrocketed, reaching almost 300 megabytes on May 13 alone, and exceeding 200 megabytes per day for the five previous days. The Symantec figures show upload rates for a 10-day period only, starting on May 7, that show well over a gigabyte of information being transferred. The figure includes data stolen from all Qakbot-infected machines, not just those operated by Massachusetts.

Qakbot contains rootkit capabilities to remain hidden. It initially is downloaded when end users visit malicious sites that exploit known vulnerabilities on their machines. From there, the malware can spread through network shares and removable drives.

The bot has the ability to extend online banking sessions even after the end user thinks they have been completed so that the criminals behind the malware can then siphon funds out of victims' accounts. It even comes with the ability to remove logoff icons from bank webpages to make it harder for victims to terminate sessions. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.