Feeds

Massachusetts PCs infected by data-hungry worm

How nasty was it? Let us count the ways

Using blade systems to cut costs and sharpen efficiencies

Computers operated by the state of Massachusetts were infected for more than three weeks with a sophisticated piece of malware that security researchers say stealthily stole more than a gigabyte's worth of sensitive data over the past 10 days.

Not all of the banking credentials, email passwords and other data lifted by the Qakbot worm originated with the PCs belonging to the Massachusetts Departments of Unemployment Assistance and Career Services networks, but the figure, included in an analysis (PDF here) published Friday by Symantec, gives an idea of how the advanced capabilities of the malware allow it to steal wholesale amounts of sensitive information.

"Analysis of the recent version of Qakbot show that this financial institution targeting malware can result in significant monetary loss for infected clients," researchers from the antivirus provider wrote. "By capturing and sending session information to the malware controllers in real time, the malware authors are able to extend legitimate online sessions and illegally transfer funds."

On Tuesday, Massachusetts officials warned residents that about 1,500 computers operated by the two unemployment agencies had been infected by Qakbot. It said anyone who conducted business with them from April 19 to May 13 may be at risk for theft of their social security numbers, employer identification numbers, email addresses, and residential or business addresses.

Officials "learned yesterday that the computer virus (W32.QAKBOT) was not remediated as originally believed and that the persistence of the virus resulted in a data breach," the advisory stated. "Once it was discovered, the system was shut down and the breach is no longer active."

According to Symantec, Qakbot infections spiked in the week leading up to the compromise of the Massachusetts agencies, from well under 50,000 PCs to more than 200,000. The amount of compromised data uploaded to Qakbot servers also skyrocketed, reaching almost 300 megabytes on May 13 alone, and exceeding 200 megabytes per day for the five previous days. The Symantec figures show upload rates for a 10-day period only, starting on May 7, that show well over a gigabyte of information being transferred. The figure includes data stolen from all Qakbot-infected machines, not just those operated by Massachusetts.

Qakbot contains rootkit capabilities to remain hidden. It initially is downloaded when end users visit malicious sites that exploit known vulnerabilities on their machines. From there, the malware can spread through network shares and removable drives.

The bot has the ability to extend online banking sessions even after the end user thinks they have been completed so that the criminals behind the malware can then siphon funds out of victims' accounts. It even comes with the ability to remove logoff icons from bank webpages to make it harder for victims to terminate sessions. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.