RealTime IT News

Firm to Air Online Security Tool for FBI

For the past year, Eastern European-based hackers have been systematically exploiting known Windows NT vulnerabilities to steal customer data, according to reports from the FBI and SANS Institute.

More than a million credit cards have been taken and more than 40 sites have been victimized to date. According to SANS Institute, The Center for Internet Security will be releasing Patchwork, a scanning utility that that automatically checks systems for the vulnerabilities and also looks for files the FBI has found present on many compromised systems.

The tool was developed for the FBI by Steve Gibson of Gibson Research. The Center's tools are normally available only to members, but because of the importance of the problem, the Center agreed to make it available to all who need it.

Patchwork will scan servers for signs of files left behind by intruders, as well as the presence of a set of known hacking tools. The free utility will also check the system to make sure it is running all the latest security patches from Microsoft.

"It's super small and super fast to download. Any site that's worried can run it and find out if they're secure for these known vulnerabilities, and if not, why and where, and also if there's any debris that would indicate that maybe somebody has been lurking around," said Gibson.

The tool can be ordered by clicking here.

The FBI and Secret Service Thursday released forensic information from ongoing investigations because of the importance of the attacks. According to the data, the National Infrastructure Protection Center (NIPC) has been coordinating investigations into a series of hacker activities that specifically target U.S. computer systems associated with e-commerce or e-banking.

The hacking activities initiated from Eastern Europe, specifically Russia and the Ukraine, and have penetrated U.S. e-commerce computer systems by exploiting vulnerabilities in unpatched Microsoft Windows NT operating systems.






These vulnerabilities, according to SANS, were originally reported and addressed in Microsoft Security Bulletins MS98-004 (re-released in MS99-025), MS00-014, and MS00-008. As early as 1998, Microsoft discovered these vulnerabilities and developed and publicized patches to fix them. Computer users can download these patches from Microsoft for free.

Once the hackers gain access, they download proprietary information, customer databases and credit card information. The hackers subsequently contact the victim company through facsimile, email or telephone.

After notifying the company of the intrusion and theft of information, the hackers make a veiled extortion threat by offering Internet security services to patch the system against other hackers. Victims are told that without the hackers' intervention, there is no guarantee that other hackers will be unable to access the network and post the credit card information and details about the compromise on the Internet.

When the victimized company is not cooperative in making payments or hiring the group for their security services, the hackers' correspondence with the victim company has become more threatening.

FBI agents believe that in some instances the credit card information is being sold to organized crime groups. There has been evidence that the stolen information is at risk whether or not the victim cooperates with the demands of the intruders.

According to the FBI, the exploitation has affected more than 40 victims located in 20 states have bee