Partner With Us Corporate Gifts Imprinted Gifts Logo Design Baby Photo Contest Phone Cards Boat Donations Logo Design Memory Upgrades Dental Insurance Get Business Software Web Hosting Directory Computer Deals Promos and Premiums KVM over IP

Search

For the past year, Eastern European-based hackers have been systematically exploiting known Windows NT vulnerabilities to steal customer data, according to reports from the FBI and SANS Institute.

More than a million credit cards have been taken and more than 40 sites have been victimized to date. According to SANS Institute, The Center for Internet Security will be releasing Patchwork, a scanning utility that that automatically checks systems for the vulnerabilities and also looks for files the FBI has found present on many compromised systems.

The tool was developed for the FBI by Steve Gibson of Gibson Research. The Center's tools are normally available only to members, but because of the importance of the problem, the Center agreed to make it available to all who need it.

Patchwork will scan servers for signs of files left behind by intruders, as well as the presence of a set of known hacking tools. The free utility will also check the system to make sure it is running all the latest security patches from Microsoft.

"It's super small and super fast to download. Any site that's worried can run it and find out if they're secure for these known vulnerabilities, and if not, why and where, and also if there's any debris that would indicate that maybe somebody has been lurking around," said Gibson.

The tool can be ordered by clicking here.

The FBI and Secret Service Thursday released forensic information from ongoing investigations because of the importance of the attacks. According to the data, the National Infrastructure Protection Center (NIPC) has been coordinating investigations into a series of hacker activities that specifically target U.S. computer systems associated with e-commerce or e-banking.

The hacking activities initiated from Eastern Europe, specifically Russia and the Ukraine, and have penetrated U.S. e-commerce computer systems by exploiting vulnerabilities in unpatched Microsoft Windows NT operating systems.

.

.

.

>

.

These vulnerabilities, according to SANS, were originally reported and addressed in Microsoft Security Bulletins MS98-004 (re-released in MS99-025), MS00-014, and MS00-008. As early as 1998, Microsoft discovered these vulnerabilities and developed and publicized patches to fix them. Computer users can download these patches from Microsoft for free.

Once the hackers gain access, they download proprietary information, customer databases and credit card information. The hackers subsequently contact the victim company through facsimile, email or telephone.

After notifying the company of the intrusion and theft of information, the hackers make a veiled extortion threat by offering Internet security services to patch the system against other hackers. Victims are told that without the hackers' intervention, there is no guarantee that other hackers will be unable to access the network and post the credit card information and details about the compromise on the Internet.

When the victimized company is not cooperative in making payments or hiring the group for their security services, the hackers' correspondence with the victim company has become more threatening.

FBI agents believe that in some instances the credit card information is being sold to organized crime groups. There has been evidence that the stolen information is at risk whether or not the victim cooperates with the demands of the intruders.

According to the FBI, the exploitation has affected more than 40 victims located in 20 states have been identified and notified in ongoing investigations in 14 Federal Bureau of Investigation Field Offices and 7 United States Secret Service Field Offices.

As of press time, no arrests in this case had been announced.

The NIPC has issued an updated Advisory 01-003 regarding these vulnerabilities being exploited. The update includes specific file names that may indicate whether a system has been compromised.

If these files are located on your computer system, the NIPC Watch in Washington D.C. should be contacted at (202) 323-3204/3205/3206. Incidents may also be reported online.

The advisory is an update to the NIPC Advisory 00-060, "E- Commerce Vulnerabilities." Since the advisory was published in December 2000, the FBI has continued to observe hacker activity targeting victims associated with e-commerce or e- finance/banking businesses.

In many cases, the hacker activity had been ongoing for several months before the victim became aware of the intrusion.

In addition to the above exploits, several filenames have been identified in connection with the intrusions, specific to Microsoft Windows NT systems.

The presence of any of these files on your system should be reviewed carefully because they may indicate that your system has been compromised:

• ntalert.exe
• sysloged.exe
• tapi.exe
• 20.exe
• 21.exe
• 25.exe
• 80.exe
• 139.exe
• 1433.exe
• 1520.exe
• 26405.exe
• i.exe

In addition, system administrators may want to check for the unauthorized presence of any of the following executable files, which are often used as hacking tools:

• lomscan.exe
• mslom.exe
• lsaprivs.exe
• pwdump.exe
• serv.exe
• smmsniff.exe