Two million password stealers fingered

Microsoft update reveals extent of problem.

Microsoft's Malicious Software Removal Tool - a program that removes malware from Windows machines - detected password-stealing software from more than 2 million PCs in the first week after it was updated.

One password stealer, called Taterf, alone was detected on 700,000 computers in the first day after the update. That's twice as many infections as were spotted during the entire month after Microsoft began detecting the notorious Storm Worm malware last September.

"These are ridiculous numbers of infections my friends, absolutely mind-boggling," said Matt McCormack, from Microsoft's Malware Response Centre.

Between 10 June and 17 June, Microsoft removed Taterf from about 1.3 million machines, he said.

Microsoft's September detections seriously hobbled the Storm Worm botnet, once considered a top Internet threat.

Password stealers such as Taterf are among the most common types of malicious software on the Internet. That's because there's big money to be made selling the virtual currencies used in online games for real-world cash.

Once a criminal learns a gamer's username and password, he can log into the game and sell the victim's virtual possessions for virtual gold coins. Those coins are then handed to another character in the game who sells the gold for real-world dollars at an online exchange such as IGE, said Greg Hoglund, CEO of HBGary and a co-author of the book "Exploiting Online Games."

"There's no way to audit that money transfer, so effectively they're doing money laundering," he said. "There's almost zero risk for the attackers."

The password-stealing programs are often installed via web-based attack code that exploits flaws in multimedia programs such as Adobe's Flash Player or Apple's QuickTime Player, Hoglund said.

The attacks are often technically sophisticated, exploiting previously undisclosed bugs in Windows software, said Roger Thompson, chief research officer with AVG Technologies. "The 'World of Warcraft' password stealers have provided most of the innovation over the last twelve months," he said via instant message.

Microsoft's McCormack provided some data on where most of the password stealer detections occurred. Not surprisingly, China was the top country, with 529,003 detections.

Security experts say Chinese games are frequently the target of these attacks. Rounding out the top five countries for detections were Taiwan with 279,428, Spain with 235,381, the US with 213,374 and Korea with 184,306.

About 330 million copies of the Malicious Software Removal Tool update were downloaded during this June period.

Gamers can make easy targets for criminals because some of them disable anti-virus software to boost gaming performance, while others download free "cracked" versions of games, which can contain malware, McCormack said.

"So how does one avoid being infected?" he asked. "Running an up-to-date anti-virus solution is a good start. Running an up-to-date, patched browser is another necessity," he said. "Enabling Automatic Updates helps a whole bunch, too."


What are your views on this subject? Use the form below to post a comment on this article up to 500 characters.


Characters remaining: 500

Add your commentComments

Dante | Published: 16:38 GMT, 23 June 2008

Headline should be changed to read: Two Million Retards Found Online. Do you want to be part of the solution instead of part of the problem? Than send out kill viruses. The old fashion viruses that just kills the machines it infects. The more kill viruses out there, the less retards will be online spamming us or DOS attacking us. Remember, Nature kills off genetic rejects. This has worked for billions of years. Why shouldn't we adopt Nature's time proven methods online?

Related Security news

Reader exploit prompts Adobe update alert

Malicious PDF running amok

IBM to release secure software development tools

Security testing and code scanning combined

FDIC: Hackers stole $120m in three months of online bank fraud

Malware on online banking customers PCs is most common attack

Bogus intranets scam university students

Pwn in the USA



Email this article to a friend or colleague:


PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Email archiving: Top 10 myths and challenges

This survey looks at a number of challenges and myths around email archiving that may also slow adoption of full archiving.

Download Whitepaper

Strategic mobile deployments

Deploying mobile applications? Supporting multiple devices? See why mobile platforms should be part of your IT strategy.

Download Whitepaper

Six essential steps to successful IT centralisation

This report provides some practical insights for CIOs, CTOs, Heads of IT, IT Directors and those involved more closely with the service management function.

Download Whitepaper

Creating an AUP: Common myths & mistakes

Avoid the common myths & mistakes when implementing your AUP

Download Whitepaper

Techworld UK - Technology - Business

COLT White Paper

Virtualisation 2.0
Driving to higher ground beyond the basics

Virtualisation can deliver unparalleled efficiency and cost reductions to your business, allowing direct access to servers and guaranteeing a dependable, rapid response in times of crisis. Read this e-book to learn more about consolidation, discover the latest technologies and find out how to reduce the TCO of virtualisation.

Download E-Book
COLT White Paper

IT Misuse Survey

Complete this survey and you could win a Nexus One

Techworld are running a short survey to discover how UK businesses are managing Internet and email misuse in the Enterprise.

Complete Survey

Webcast: IT Financial Management: Cost Optimisation for Efficiency and Agility.
On Demand Webcast
Join this webcast to learn about the techniques and technologies that can help you prove the value of IT to the business by understanding the true cost of today's IT services and those that will be necessary to deliver future success.

Register Today

Site Map

IDG Network

* *