Worm Steals At Least 45,000 Facebook Logins
Next time you're on Facebook and get a link from some friends, be careful: It might be part of a scam to snag your login info and hack into financial institutions.
Stories of Facebook accounts getting hacked <a href=http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CB4QFjAA&url=http%3A%2F%2Fwww.escapistmagazine.com%2Fforums%2Fread%2F7.320322-600-000-Facebook-Accounts-Get-Hacked-Daily&ei=aS4GT4_fEcOWiQLRr5VC&usg=AFQjCNGMQVoO79QXyFrSzxosQCUvoM5JUg&sig2=jP0OmgxmIB0J5kaEFcsf4A>aren't all that uncommon, but this latest case is a doozy. A worm that was originally designed to compromise bank systems has been repurposed and is now stealing Facebook login credentials.
Security company Seculert has been actively keeping track of the worm Ramnit, which was originally discovered in April 2010. Microsoft, meanwhile, <a href=http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32/Ramnit>has explained that the worm is "a family of multi-component malware that infects Windows executable files, Microsoft Office files and HTML files. Win32/Ramnit spreads to removable drives, steals sensitive information such as saved FTP credentials and browser cookies. The malware may also open a backdoor to await instructions from a remote attacker."
Basically, Ramnit is capable of bypassing two-factor authentication systems, which means it's been able to gain remote access to financial institutions.
Seculert has discovered that approximately 800,000 machines were infected with Ramnit between September and December. On top of that, a variant of the worm has stolen the login information for over 45,000 Facebook accounts.
According to Seculert:
"We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further. In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks."
If your friends start sending out a bunch of links, be extra careful. Don't let yourself wind up a part of this statistic.
Source: <a href=http://blog.seculert.com/2012/01/ramnit-goes-social.html>Seculert via <a href=http://arstechnica.com/business/news/2012/01/worm-steals-45000-facebook-login-credentials-infects-victims-friends.ars?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+Featured+Content%29>Ars Technica
Permalink
Next time you're on Facebook and get a link from some friends, be careful: It might be part of a scam to snag your login info and hack into financial institutions.
Stories of Facebook accounts getting hacked <a href=http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CB4QFjAA&url=http%3A%2F%2Fwww.escapistmagazine.com%2Fforums%2Fread%2F7.320322-600-000-Facebook-Accounts-Get-Hacked-Daily&ei=aS4GT4_fEcOWiQLRr5VC&usg=AFQjCNGMQVoO79QXyFrSzxosQCUvoM5JUg&sig2=jP0OmgxmIB0J5kaEFcsf4A>aren't all that uncommon, but this latest case is a doozy. A worm that was originally designed to compromise bank systems has been repurposed and is now stealing Facebook login credentials.
Security company Seculert has been actively keeping track of the worm Ramnit, which was originally discovered in April 2010. Microsoft, meanwhile, <a href=http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Win32/Ramnit>has explained that the worm is "a family of multi-component malware that infects Windows executable files, Microsoft Office files and HTML files. Win32/Ramnit spreads to removable drives, steals sensitive information such as saved FTP credentials and browser cookies. The malware may also open a backdoor to await instructions from a remote attacker."
Basically, Ramnit is capable of bypassing two-factor authentication systems, which means it's been able to gain remote access to financial institutions.
Seculert has discovered that approximately 800,000 machines were infected with Ramnit between September and December. On top of that, a variant of the worm has stolen the login information for over 45,000 Facebook accounts.
According to Seculert:
"We suspect that the attackers behind Ramnit are using the stolen credentials to log-in to victims' Facebook accounts and to transmit malicious links to their friends, thereby magnifying the malware's spread even further. In addition, cybercriminals are taking advantage of the fact that users tend to use the same password in various web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.) to gain remote access to corporate networks."
If your friends start sending out a bunch of links, be extra careful. Don't let yourself wind up a part of this statistic.
Source: <a href=http://blog.seculert.com/2012/01/ramnit-goes-social.html>Seculert via <a href=http://arstechnica.com/business/news/2012/01/worm-steals-45000-facebook-login-credentials-infects-victims-friends.ars?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+Featured+Content%29>Ars Technica
Permalink
