Feeds

Massachusetts PCs infected by data-hungry worm

How nasty was it? Let us count the ways

Security for virtualized datacentres

Computers operated by the state of Massachusetts were infected for more than three weeks with a sophisticated piece of malware that security researchers say stealthily stole more than a gigabyte's worth of sensitive data over the past 10 days.

Not all of the banking credentials, email passwords and other data lifted by the Qakbot worm originated with the PCs belonging to the Massachusetts Departments of Unemployment Assistance and Career Services networks, but the figure, included in an analysis (PDF here) published Friday by Symantec, gives an idea of how the advanced capabilities of the malware allow it to steal wholesale amounts of sensitive information.

"Analysis of the recent version of Qakbot show that this financial institution targeting malware can result in significant monetary loss for infected clients," researchers from the antivirus provider wrote. "By capturing and sending session information to the malware controllers in real time, the malware authors are able to extend legitimate online sessions and illegally transfer funds."

On Tuesday, Massachusetts officials warned residents that about 1,500 computers operated by the two unemployment agencies had been infected by Qakbot. It said anyone who conducted business with them from April 19 to May 13 may be at risk for theft of their social security numbers, employer identification numbers, email addresses, and residential or business addresses.

Officials "learned yesterday that the computer virus (W32.QAKBOT) was not remediated as originally believed and that the persistence of the virus resulted in a data breach," the advisory stated. "Once it was discovered, the system was shut down and the breach is no longer active."

According to Symantec, Qakbot infections spiked in the week leading up to the compromise of the Massachusetts agencies, from well under 50,000 PCs to more than 200,000. The amount of compromised data uploaded to Qakbot servers also skyrocketed, reaching almost 300 megabytes on May 13 alone, and exceeding 200 megabytes per day for the five previous days. The Symantec figures show upload rates for a 10-day period only, starting on May 7, that show well over a gigabyte of information being transferred. The figure includes data stolen from all Qakbot-infected machines, not just those operated by Massachusetts.

Qakbot contains rootkit capabilities to remain hidden. It initially is downloaded when end users visit malicious sites that exploit known vulnerabilities on their machines. From there, the malware can spread through network shares and removable drives.

The bot has the ability to extend online banking sessions even after the end user thinks they have been completed so that the criminals behind the malware can then siphon funds out of victims' accounts. It even comes with the ability to remove logoff icons from bank webpages to make it harder for victims to terminate sessions. ®

Beginner's guide to SSL certificates

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
NOT OK GOOGLE: Android images can conceal code
It's been fixed, but hordes won't have applied the upgrade
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
prev story

Whitepapers

Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.