Go to:

IT Jobs

A security researcher at SecureWorks has uncovered a data cache stolen by a variant of Prg, a Trojan program. Many of the victims were infected by visiting jobsearch sites, including Monster.com

The stolen data, which was taken from about 46,000 individuals, includes bank and credit card account information and Social Security numbers, as well as usernames and passwords for online accounts.

Don Jackson, the SecureWorks researcher who found the collection, said it was the largest single cache of data he discovered from the Prg Trojan, a piece of malware first seen in the wild in June. According to Jackson, the server he examined is still collecting stolen data, with up to 10,000 victims feeding it information at any particular time.

That server is one of 20 similar servers worldwide that are collecting and storing data stolen by Prg. Twelve of those servers - including the one with the large data cache - are being managed by a single hacking group known for naming their attacks after car manufacturers such as Bugatti, Ford and Mercedes, Jackson said.

The "car group's" success in compromising and stealing information from so many individuals is based on two factors, Jackson said. The first factor appears to have been their success in widely distributing the malware. He says the group used online ad aggregation services to place infected ads on job-search services as well as other websites, he said.

A user clicking on one of the malicious ads is taken to an exploit page that "fingerprints" the user's browser and then serves up between one and four exploits designed to infect the user's system with the Trojan. From that point on, all information the user enters into the browser is captured and sent off to the hacking group's servers, Jackson said.

The other reason for the widespread compromises is the group's sheer industry - they've been releasing a new variant of the Trojan every five days to a week, on average, and sometimes even quicker. Anti-virus tools are having a hard time keeping up with the variants, Jackson said, so infections are going undetected for several weeks in many cases. Many of those whose data has been stolen appear to have been infected multiple times by successive variants of the Trojan.

A number of Prg variants are known to operate in part by opening up port 6081 on victim's computers and listening for connections there. Some experts suggest that concerned parties looking to cut Prg off at the knees might start by blocking inbound and outbound traffic on 6081.

Prg appears to be a variant of a somewhat older Trojan known as wnspoem, discovered last October. Like the earlier model, Prg is designed to sniff sensitive data from Windows internal memory buffers before the data is encrypted, which means that the malware can circumvent SSL security measures. When SecureWorks researchers noted back in June that a Prg construction kit was making the rounds, the data caches they analysed contained a remarkable amount of information from corporate PCs - indicating perhaps that attackers are now expanding their focus.

It's not entirely clear how the stolen information in the latest attacks is being used, but Jackson says that the kind of data that the Trojan has cached seems to indicate that the data is being stolen for identity theft purposes.

Latest White Papers

A buyer's guide to hosted security
>> Download whitepaper

Is social networking really bad for business?
>> Download whitepaper

Phishing for victims: Truth, myth and cybercrime
>> Download whitepaper

Question of the day!

Does your smartphone replace your need for a laptop when on the move?

% of Techworld readers agree with you

Yes

TBC

No

TBC

What tasks can your smartphone do that would have traditionally been done on a laptop?

Tweet your answer here...

Twitter account details

Username: Password:

Don't worry, your login info is sent through the secure Twitter API and is not stored.

119 characters remaining

Follow the conversation at @SmartphoneFocus