'Crimeserver' Discovered with Treasure Trove of Stolen Data

**NewsDude** · 05-08-2008, 02:40 PM

Cybercriminals collect a treasure trove of data from Web surfers whose computers are infected with Trojans. That's all-too-common news these days, but a recent case shows that the problem is getting worse. Finjan Inc., which makes secure Web gateway products, discovered a server in Malaysia being used by hackers to store more than 1.4 gigabytes of stolen data. What surprised the Finjan researchers was that the data was stolen from businesses as well as individuals -- and it was amassed in just three weeks.
Yuval Ben-Itzhak, Finjan's chief technology officer, told us that there were other surprises from the discovery of the Malaysian-based "crimeserver" that was being used as a command-and-control center for the Trojans installed on infected PCs around the world.
"Quite often we see end-user online banking information being logged, but on this server we found a lot of business-related data, such as e-mail communications, patient medical histories, and even screenshots of Outlook," he said. This compromised information could lead to a host of problems for an organization, from violations of federal regulations about patient privacy to the loss of critical business information.
Crimeware as a Service
Ben-Itzhak said the crimeserver was left totally open so that data could be accessed by anyone. The Finjan report about the attack surmised that crimeware is evolving with a new and alarming customer-service focus.
"Crimeware has reached a new level of sophistication. After the birth of sophisticated crimeware toolkits, closely followed by Crimeware-as-a-Service (CaaS), we now see the availability of user data as a 'customer' service by granting open access to the crimeware server with the harvested data."
Finjan researchers noted that the Malaysian server had changed hosting locations a number of times between late last year and the time the crimeserver was discovered, "likely to prevent it from being closed down...

More...

Thread Tools
Show Printable Version Email this Page
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

05-08-2008, 02:40 PM	#1 (permalink)
NewsDude Status: *** Elder Join Date: Mar 2008 Location: News Office Posts: 1,295** Spent time on board: 0:05:24 Hours Rep Power: 3	Cybercriminals collect a treasure trove of data from Web surfers whose computers are infected with Trojans. That's all-too-common news these days, but a recent case shows that the problem is getting worse. Finjan Inc., which makes secure Web gateway products, discovered a server in Malaysia being used by hackers to store more than 1.4 gigabytes of stolen data. What surprised the Finjan researchers was that the data was stolen from businesses as well as individuals -- and it was amassed in just three weeks. Yuval Ben-Itzhak, Finjan's chief technology officer, told us that there were other surprises from the discovery of the Malaysian-based "crimeserver" that was being used as a command-and-control center for the Trojans installed on infected PCs around the world. "Quite often we see end-user online banking information being logged, but on this server we found a lot of business-related data, such as e-mail communications, patient medical histories, and even screenshots of Outlook," he said. This compromised information could lead to a host of problems for an organization, from violations of federal regulations about patient privacy to the loss of critical business information. Crimeware as a Service Ben-Itzhak said the crimeserver was left totally open so that data could be accessed by anyone. The Finjan report about the attack surmised that crimeware is evolving with a new and alarming customer-service focus. "Crimeware has reached a new level of sophistication. After the birth of sophisticated crimeware toolkits, closely followed by Crimeware-as-a-Service (CaaS), we now see the availability of user data as a 'customer' service by granting open access to the crimeware server with the harvested data." Finjan researchers noted that the Malaysian server had changed hosting locations a number of times between late last year and the time the crimeserver was discovered, "likely to prevent it from being closed down... More...