[SecurityRatty] tag: romanian

Romanian pleads guilty to phishing-related charges

Thu, 09 Oct 2008 20:00:00 +0000

A Romanian man pleaded guilty earlier this week to charges related to possession of stolen credit card information obtained from fraudulent Web sites.

Romanian phishing busts were years in the making

Thu, 11 Sep 2008 20:00:00 +0000

The U.S. Federal Bureau of Investigation spent years laying the groundwork for an investigation that led to the arrest of dozens of people involved in illegal phishing scams operated from Romania and the U.S., a senior FBI official said Friday.

On Doomsaying (Terry Childs case)

Thu, 24 Jul 2008 08:48:00 +0000

Maybe I should call it "on stupidity" and add it to my "Nobody Is That Dumb... Oh Wait" series?

Really, when I've heard about it first, I was like "ah, come on, I am sure the journalists are just mis-reporting it; nobody is that dumb in their approach to system security."

Well, they really were that dumb.

Honestly, from the "blatant disregard of common sense", this is very, very high on the list (many in security agree, some in IT disagree). This is where the words "a huge data security risk" really sound like a mild understatement.

But you know what is the most scary about this case? The fact that there are MANY organizations who manage their networks the same way: one admin with ALL the access and NONE of the monitoring.

One person + ALL access + NO accountability = you are screwed!

Also, in light of this, do you still think that "insider attacks" is some kinda security vendor propaganda? Well, go tell Terry Childs that :-) Even though some people still think that he is a good guy (more on that on Slashdot)

What also caught my attention is that some retard called his bail ($5m) "ridiculously high." Well, if he was an outside hacker, say a Romanian script kiddie, jailed for hacking SF network, would they release him for $5m? Maybe not! Now, do you get that this case is actually MUCH WORSE! Hacker might have gained access to many assets; this guy did have access.

So, think, think, think: CAN YOUR SYSADMINS "0WN" YOUR BUSINESS? (BTW, some people think that IT "owns" you already!)

Are you OK with it?

If not, do something - start logging and monitoring (and then controlling) their actions! If you think you cannot control them, then just monitor; if you think you can neither control nor monitor, then at least log them so they will know that there will be enough good evidence to let them rot in jail for many years ... Or, if you prefer an easier alternative, stop calling your business YOUR business.

Possibly related posts:

"Protecting logs from admins"

Romanian admits to phishing, could face five years

Tue, 22 Jul 2008 20:00:00 +0000

A Romanian man pleaded guilty Tuesday to a federal fraud charge for his role in setting up fake Web sites in order to steal credit and debit card details.

Losses likely to rise from latest Romanian crime ring

Wed, 16 Jul 2008 20:00:00 +0000

The losses caused by a cybercrime ring broken up on Tuesday by Romania could reach into the millions of euros, an official with the General Inspectorate of the Romanian National Police said on Thursday.

Security Briefing: June 12th

Thu, 12 Jun 2008 10:52:30 +0000

Well, imagine that. I received this email at 9:31 am yesterday from the marketing folks at Infosecurity Canada.

Sorry Dave…I will make arrangements for a badge to be ready for pick up at pre-registration.

Um, yeah see I was on the other side of the city. At least Myrcurial is on the ground. Maybe he’ll grace us with an update.

Click here to subscribe to Liquidmatrix Security Digest!.

And now, the news…

Banks slip through virus loophole | The Guardian UK
Danish filter catches Romanian child-porn sites | Computer World
City officials confident information is secure (This is funny. They’re claiming 15 char password is secure. Sigh)| Belleville Intelligencer
Sophos assists Computer Crime Unit in bringing botnet master to justice | Sophos Press
U.S. warns on Olympics computer security | UPI
Lawmakers accuse China of hacking computers | Reuters
China denies hacking into US computers | Associated Press
Customer fears grow after mass hacking of retail website | Customer Strategy
Online medical records offer convenience, may limit privacy | USA Today

Tags: News, Daily Links, Security Blog, Information Security, Security News

38 in US, Romania charged in phishing schemes

Sun, 18 May 2008 20:00:00 +0000

Thirty-eight people in the U.S. and Romania have been charged in two indictments alleging they used complicated Internet phishing schemes to steal thousands of credit and debit card numbers, U.S. and Romanian authorities announced Monday.

Romanian Script Kiddies and the Screensavers Botnet

Mon, 07 Apr 2008 23:48:40 +0000

Shall we turn into zombies, and peek into the modest botnet courtesy of Romanian script kiddies, that are currently spamming postcard.scr greeting cards? Meet the script kiddies. This botnet is going nowhere mostly because knowing how to compile an IRC bot doesn't necessarily mean you posses a certain know-how, a know-how that experienced botnet masters have been outsourcing for years. Malware is obtained through links pointing to :

xhost.ro/filehost/phrame.php?action=saveDownload&fileId=15735
xhost.ro/filehost/phrame.php?action=editDownload&fileId=12923
xhost.ro/filehost/phrame.php?action=saveDownload&fileId=3656
xhost.ro/filehost/phrame.php?action=editDownload&fileId=10936

Scanners result : Result: 22/32 (68.75%)
Trojan.Zapchas.F; IRC/BackDoor.Flood; Backdoor.IRC.Zapchast
File size: 735139 bytes
MD5...: 015e5826084f2302b4b2c3237a62e244
SHA1..: 7d05949f6dfffdc58033c9d8b86210a9bd34897c

Sample traffic output :
"NICK Mq2kC01
USER las "" "pic.kauko.lt" :Px7aW6
USER las "" "Helsinki.FI.EU.Undernet.org" :Px7aW6
USERHOST Mq2kC01
NICK :Rk1zK50
AWAY :Eu te scuip in cap si'n gura, tu ma pupi in cur si'n pula =))!
MODE Mq2kC01 +i
ISON loverboy loveru SirDulce
JOIN #madarfakar
USER kzg "" "Helsinki.FI.EU.Undernet.org" :Ho5xI1
NICK :Vm3uF52
MODE Mq2kC01 +wx"

And in next couple of hours, the most interesting domain that joined the IRC channel was :

Ny2fW15 is fwuser@mails.legislature.maine.gov * Kg1jT7
Ny2fW15 on #madarfakar
Ny2fW15 using Noteam.Vs.undernet.org I'm too lazy to edit ircd.conf
Ny2fW15 is away: Eu te scuip in cap si'n gura, tu ma pupi in cur si'n pula =))!
Ny2fW15 has been idle 1min 31secs, signed on Fri Apr 04 12:05:17
Ny2fW15 End of /WHOIS list.

This botnet's futile attempt to scale is a great example of the growing importance of knowlege and experience empowered botnet masters, as a key success factor for sustainability, and also, basic understanding of economic forces, namely, when they're not making an investment there cannot be a return on investment on their efforts at the first place. Take a peek at the efficiency level of remote file inclusion achieved by another botnet, and at alternative botnet C&C channels courtesy of botnet masters realizing that diversity is vital.