Zeus Trojan found on 74,000 PCs in global botnet

More than 74,000 PCs at nearly 2,500 organizations around the globe were compromised over the past year and a half in a botnet infestation designed to steal login credentials to bank sites, social networks, and e-mail systems, a security firm said Wednesday.

The systems were infected with the Zeus Trojan and the botnet was dubbed “Kneber” after a username that linked the infected PCs on corporate and government systems, according to NetWitness.

The Wall Street Journal reported that Merck, Cardinal Health, Paramount Pictures, and Juniper Networks were among the targets in the attack. NetWitness speculated that criminals in Eastern Europe using a command-and-control server in Germany sent attachments containing the malware in e-mails or links to the malware on Web sites that employees within the companies clicked on.

NetWitness said it discovered more than 75 gigabytes worth of stolen data during routine analytic tasks as part of an evaluation of a client network on January 26. The cache of stolen data included 68,000 corporate login credentials, access to e-mail systems, online banking sites, Facebook, Yahoo, Hotmail, 2,000 SSL (Secure Sockets Layer) certificate files and data on individuals, NetWitness said in a statement and in a whitepaper available for download from its Web site.

In addition to stealing specific data, Zeus can be used to search for and steal any file on the computer, download and execute programs and allow someone to remotely control the computer.

More than half of the compromised machines were also infected with peer-to-peer bot malware called Waledac, the company said. Nearly 200 countries were affected, with most of the infections found in Egypt, Mexico, Saudi Arabia, Turkey and the United States.

The news comes after Google announced an attack targeting it and what is believed to be more than 30 other companies and which was linked back to China. McAfee dubbed that attack “Operation Aurora.”

“While Operation Aurora shed light on advanced threats from sponsored adversaries, the number of compromised companies and organizations pales in comparison to this single botnet,” said Amit Yoran, chief executive of NetWitness and former Director of the National Cyber Security Division. “These large-scale compromises of enterprise networks have reached epidemic levels.”

February 17, 2010 6:59 PM PST
by Elinor Mills

Click Here To Chat With A Representative Now

Call us today 1-800-905-GEEK (4335) or visit us online www.geeksoncall.com

Broad New Hacking Attack Detected

Global Offensive Snagged Corporate, Personal Data at nearly 2,500 Companies; Operation Is Still Running

Hackers in Europe and China successfully broke into computers at nearly 2,500 companies and government agencies over the last 18 months in a coordinated global attack that exposed vast amounts of personal and corporate secrets to theft, according to a computer-security company that discovered the breach.

The damage from the latest cyberattack is still being assessed, and affected companies are still being notified. But data compiled by NetWitness, the closely held firm that discovered the breaches, showed that hackers gained access to a wide array of data at 2,411 companies, from credit-card transactions to intellectual property.

The hacking operation, the latest of several major hacks that have raised alarms for companies and government officials, is still running and it isn’t clear to what extent it has been contained, NetWitness said. Also unclear is the full amount of data stolen and how it was used. Two companies that were infiltrated, pharmaceutical giant Merck & Co. and Cardinal Health Inc., said they had isolated and contained the problem.

Starting in late 2008, hackers operating a command center in Germany got into corporate networks by enticing employees to click on contaminated Web sites, email attachments or ads purporting to clean up viruses, NetWitness found.

In more than 100 cases, the hackers gained access to corporate servers that store large quantities of business data, such as company files, databases and email.

They also broke into computers at 10 U.S. government agencies. In one case, they obtained the user name and password of a soldier’s military email account, NetWitness found. A Pentagon spokesman said the military didn’t comment on specific threats or intrusions.

At one company, the hackers gained access to a corporate server used for processing online credit-card payments. At others, stolen passwords provided access to computers used to store and swap proprietary corporate documents, presentations, contracts and even upcoming versions of software products, NetWitness said.

Data stolen from another U.S. company pointed to an employee’s apparent involvement in criminal activities; authorities have been called in to investigate, NetWitness said. Criminal groups have used such information to extort sensitive information from employees in the past.

The spyware used in this attack allows hackers to control computers remotely, said Amit Yoran, chief executive of NetWitness. NetWitness engineer Alex Cox said he uncovered the scheme Jan. 26 while installing technology for a large corporation to hunt for cyberattacks.

That discovery points to the growing number of attacks in recent years that have drafted computers into cyber armies known as botnets—intrusions not blocked by standard antivirus software. Researchers estimate millions of computers are conscripted into these armies.

“It highlights the weaknesses in cyber security right now,” said Adam Meyers, a senior engineer at government contractor SRA International Inc. who reviewed the NetWitness data. “If you’re a Fortune 500 company or a government agency or a home DSL user, you could be successfully victimized.”

Disclosure of the attack comes on the heels of Google Inc.’s allegation that it and more than 20 other companies were breached by Chinese hackers. This operation appears to be more far-reaching, infiltrating some 75,000 computers and touching 196 countries. The highest concentrations of infected computers are in Egypt, Mexico, Saudi Arabia, Turkey and the U.S.

NetWitness, based in Herndon, Va., said it was sharing information with the companies infected. Mr. Yoran declined to name them. The company provides computer security for U.S. government agencies and companies. Mr. Yoran is a former Air Force officer who also served as cyber security chief at the Department of Homeland Security.

Besides Merck and Cardinal Health, people familiar with the attack named several other companies infiltrated, including Paramount Pictures and software company Juniper Networks Inc.

Merck said in a statement that one computer had been infected. It said it had isolated the attack and that “no sensitive information was compromised.”

Cardinal said it removed the infected computer from its network. Paramount declined to comment. Juniper’s security chief, Barry Greene, wouldn’t speak about any specific incidents but said the company worked aggressively to counter infections.

Journal CommunityDISCUSS
“The key is not to pour money into protecting information, but to develop a global approach to neutralizing its value. By creating secrets, we have created value, which is pursued by opportunists. ”
—John M. Brock
NetWitness, which does extensive work for the U.S. government and private-sector clients, said it was sharing its information with the Federal Bureau of Investigation. The FBI said it received numerous allegations about potential compromises of network systems and responded promptly, in coordination with law-enforcement partners.

The computers were infected with spyware called ZeuS, which is available free on the Internet in its basic form. It works with the FireFox browser, according to computer-security firm SecureWorks. This version included a $2,000 feature that works with FireFox, according to SecureWorks.

Evidence suggests an Eastern European criminal group is behind the operation, likely using some computers in China because it’s easier to operate there without being caught, said NetWitness’s Mr. Yoran.

There are some electronic fingerprints suggesting the same group was behind a recent effort to dupe government officials and others into downloading spyware via emails purporting to be from the National Security Agency and the U.S. military, NetWitness’s Mr. Yoran said.

That attack was described in a Feb. 5 report from the Department of Homeland Security, which said it was issuing an alert to the government and other organizations to “prevent further compromises.”

A DHS official said that ZeuS was among the top five reported tools for malware infections.

Click Here To Chat With A Representative Now

Call us today 1-800-905-GEEK (4335) or visit us online www.geeksoncall.com

Geeks On Call Strengthens Its Position Since Acquisition

VIRGINIA BEACH, Va., Feb. 16 /PRNewswire/ -- Since the late-fall acquisition by On Call Holdings International, LLC (OCHI), Geeks On Call has reorganized, refocused and is methodically expanding its reach of businesses and the services it provides.

"We will be the premiere provider for small and medium-sized businesses for both technical support and telecommunications services," announced OCHI CEO Glenn Davis. "The Geeks On Call brand will continue to provide expert assistance for the individual user, but the partnerships we've created will expand services for business telecom needs." Davis has revamped the Geeks On Call website, www.geeksoncall.com, to make it more interactive and user friendly.

Davis was the President of Comverge, a successful telecommunications firm based in Hampton Roads, Virginia, which has provided business telecom services for the past eight years. He initiated the Geeks On Call acquisition with the goals of returning the organization to profitability, renewing the partnership and connection with franchisees, and growing the business model to a more modern marketplace. The deal included all of the franchise agreements, trademarks and brand of Geeks On Call.

"It's honestly a case study of how to make a deal to turn a company around," explained Davis. "But the hardest work was to restore confidence of our franchisees."

Goal number one was to repair, strengthen and reenergize the existing 129 franchises, and earn their trust in Davis' business model and his plans for profitability. To date, franchisees have been excited and positive about the new leadership and the positive direction. In just a few short months, Geeks On Call has grown to 190 franchises.

On Call Holding International's next step will be to maximize existing partnerships to grow Geeks On Call into servicing small and medium-size businesses with technical support and telecommunications services.

It's a part of business services that Davis' team knows all too well. "I thought the marriage of the Geeks On Call technical expertise and our experience in business telecom was a natural fit," explained Davis.

Leveraging partnerships with companies like Qwest, ACC - an AT&T company, Paetec and Cavalier Telephone will bring substantial benefits to clients. Geeks On Call plans to consider additional franchisees by the end of the second quarter.

CONTACT: Brian Kirwin, +1-757-718-3225, brian@rourkpr.com, for Geeks On Call

SOURCE Geeks On Call

RELATED LINKS
http://www.geeksoncall.com/

'Why Firefox?' and 'Why Windows?'--same answer?

Is Mozilla becoming too much like Microsoft?

In a strange bit of irony, Mozilla, the foundation behind the popular open-source Firefox browser, increasingly relies on Microsoft's playbook to promote Firefox adoption. No, Mozilla executives aren't secretly plotting an open-source monopoly to replace Microsoft's, and, indeed, are focusing precisely on doing the opposite.

But the answer to the "Why Firefox?" question increasingly sounds the same as the answer to "Why Windows?"

Two peas in a pod?

Namely, community/application support, to the exclusion of significant improvements in its performance.

I've been using Google's Chrome browser on Linux, Mac, and Windows during the past week and it screams. While Firefox hogs system resources, Google Chrome gets its job done much faster and with far fewer resources.

So why do I continue to promote Firefox? For the same reason and in the same way that Mozilla does: community.

There's more to Mozilla's marketing, of course. Mozilla executive Mitchell Baker talks urgently and eloquently about the importance of an open Web, served by a community-driven, completely open browser.

But at its foundation, Mozilla's argument sounds eerily similar to Microsoft's: we may not be faster, but we have a better community.

After using Chrome for a week, I'm not sure this will be enough. Chrome, after all, has support for the Firefox extensions that I care most about (like AdBlock), and it has internalized others within its standard features (like "Pin tab" instead of relying on Faviconize, as I do in Firefox). And Chrome marries these to a super-fast browsing experience.

Microsoft for years has argued that it's better simply because it has broad application support.

This is a compelling differentiator, but is it the one that we really want for Firefox?

I know I don't. I love the Firefox browser. It has been my preferred browser for years, and I expect it to remain such.

But however much I may prefer Firefox because of its third-party extension support and its cross-platform approach, it's not going to be enough if Chrome pulls significantly ahead in performance and catches up with add-on support. Not while Firefox consumes so much of my system resources and follows, rather than leads, Google in speed.

Mozilla has been improving Firefox performance, but not as rapidly as Google has been increasing Chrome's, in my experience. This needs to change.

Community is a compelling differentiator for Firefox. But it's not the only one, and it may not be enough if Mozilla doesn't leverage that community to outpace Google Chrome performance.

February 15, 2010 11:21 AM PST

by Matt Asay