For the past year, Eastern European-based hackers have been systematically
exploiting known Windows NT vulnerabilities to steal customer data,
according to reports from the FBI and SANS Institute.
More than a million credit cards have been taken and more than 40 sites
have been victimized to date. According to SANS Institute, The Center for Internet Security will
be releasing Patchwork, a scanning utility that that automatically checks
systems for the vulnerabilities and also looks for files the FBI has found
present on many compromised systems.
The tool was developed for the FBI by Steve Gibson of Gibson Research. The Center’s tools are
normally available only to members, but because of the importance of the
problem, the Center agreed to make it available to all who need it.
Patchwork will scan servers for signs of files left behind by intruders,
as well as the presence of a set of known hacking tools. The free utility will
also check the system to make sure it is running all the latest security
patches from Microsoft.
“It’s super small and super fast to download. Any site that’s worried can
run it and find out if they’re secure for these known vulnerabilities, and
if not, why and where, and also if there’s any debris that would indicate
that maybe somebody has been lurking around,” said Gibson.
The tool can be ordered by clicking here.
The FBI and Secret Service Thursday released forensic information from
ongoing investigations because of the importance of the attacks. According
to the data, the National Infrastructure Protection Center (NIPC) has been
coordinating investigations into a series of hacker activities that
specifically target U.S. computer systems associated with e-commerce or
e-banking.
The hacking activities initiated from Eastern Europe, specifically Russia
and the Ukraine, and have penetrated U.S. e-commerce computer systems by
exploiting vulnerabilities in unpatched Microsoft Windows NT operating
systems.
.
.
.
>
.
These vulnerabilities, according to SANS, were originally reported and
addressed in Microsoft Security Bulletins MS98-004 (re-released in
MS99-025), MS00-014, and MS00-008. As early as 1998, Microsoft discovered
these vulnerabilities and developed and publicized patches to fix them. Computer users can download these patches from Microsoft for free.
Once the hackers gain access, they download proprietary information,
customer databases and credit card information. The hackers subsequently
contact the victim company through facsimile, email or telephone.
After notifying the company of the intrusion and theft of information,
the
hackers make a veiled extortion threat by offering Internet security
services to patch the system against other hackers. Victims are told that
without the hackers’ intervention, there is no guarantee that other hackers
will be unable
to access the network and post the credit card information and details
about the compromise on the Internet.
When the victimized company is not cooperative in making payments or
hiring the group for their security services, the hackers’ correspondence
with the victim company has become more threatening.
FBI agents believe that in some instances the credit card information is
being sold to organized crime groups. There has been evidence that the
stolen information is at risk whether or not the victim cooperates with the
demands of the intruders.
According to the FBI, the exploitation has affected more than 40 victims
located in 20 states have bee
n identified and notified in ongoing
investigations in 14 Federal Bureau of Investigation Field Offices and 7
United States Secret Service Field Offices.
As of press time, no arrests in this case had been announced.
The NIPC has issued an updated Advisory
01-003 regarding these vulnerabilities being exploited. The update
includes specific file
names that may indicate whether a system has been compromised.
If these files are located on your computer system, the NIPC Watch in
Washington
D.C. should be contacted at (202) 323-3204/3205/3206. Incidents may also
be reported online.
The advisory is an update to the NIPC Advisory 00-060, “E- Commerce
Vulnerabilities.” Since the advisory was published in December 2000, the FBI
has continued to observe hacker activity targeting victims associated with
e-commerce or e- finance/banking businesses.
In many cases, the hacker activity had been ongoing for several months
before the victim became aware of the intrusion.
In addition to the above exploits, several filenames have been
identified in connection with the intrusions, specific to Microsoft Windows
NT systems.
The presence of any of these files on your system should be reviewed
carefully because
they may indicate that your system has been compromised:
- ntalert.exe
- sysloged.exe
- tapi.exe
- 20.exe
- 21.exe
- 25.exe
- 80.exe
- 139.exe
- 1433.exe
- 1520.exe
- 26405.exe
- i.exe
In addition, system administrators may want to check for the
unauthorized presence of any of the following executable files,
which are often used as hacking tools:
- lomscan.exe
- mslom.exe
- lsaprivs.exe
- pwdump.exe
- serv.exe
- smmsniff.exe
