2013 Outcomes in Cybercrime

[Ющук Евгений Леонидович]

2013 Outcomes in Cybercrime

EconBez.ru: Society: Results of 2013 in the field of cybercrime

Experts at ESET International Antivirus Company presented a final report on key events in 2013 in the field of information security.

Cyber attacks on IT corporations and the media

The outgoing year was remembered for a number of significant events, one of which was a series of cyberattacks against leading media and IT corporations located mainly in the USA - at different times, the New York Times, Wall Street Journal, Washington Post, as well as Twitter, Facebook, were attacked. Evernote, Apple, and Microsoft.

These attacks, to one degree or another, led to the leakage of personal data of company employees and service users. So, the result of a cyber attack on Adobe Systems was the compromise of tens of millions of customer accounts of the company, as well as the leak of the source codes of such common products as Adobe Acrobat, ColdFusion and Photoshop.

Social networks under attack

However, the activity of hackers was aimed not only at IT companies, but also at ordinary users. So, in February, ESET experts discovered a malicious PokerAgent code that infected players in the Zynga Poker Facebook application. The aim of the hackers was the personal data of users, as well as information about bank cards tied to their accounts. To obtain the desired data, a botnet was created from several hundred infected devices that followed the instructions of the command center.

As a result, PokerAgent stole data from more than 16,000 Facebook accounts. Another noteworthy malicious program threatening regulars of social networks was aimed exclusively at Russian users - the Win32 / Bicololo.A Trojan was distributed via phishing messages in the guise of links to harmless graphic files. When such a link was activated, malware was loaded instead of the image. Once on the computer, Bicololo modified the system files so that when a user tries to access the Vkontakte, Odnoklassniki website or check mail on Mail.ru, he would enter his data on a fake page belonging to the attackers.

Phishing attacks on Internet messengers

In 2013, not only users of social networks were under attack, but also fans of communication through Internet instant messengers. Thus, a large-scale spam campaign discovered by ESET experts in Skype, Gtalk, QIP and a number of other instant messengers endangered over half a million users worldwide (including 40,000 users from Russia). Using phishing messages, criminals infected the system with malware, gaining access to the personal and authentication data of the victims. Another major attack was the spread of spyware among Polish users. Analysts at the ESET virus lab in Krakow recorded an attack on users of Skype, MSN Messenger, Jabber, GTalk, ICQ, and other messengers. The Spy.Agent program collected information about visited sites, installed applications, passwords for Wi-Fi, and also recorded messages entered from the keyboard and even listened to calls.

The capture of cybercriminals

But the actions of cybercriminals did not go unanswered - so, thanks to the activity of Microsoft, in 2013 the Citadel botnet was liquidated. With the support of law enforcement agencies, providers and special services, the corporation conducted an operation to disrupt the operation of one of the largest botnets in the world. The damage from his activity at that time exceeded half a billion dollars.

In addition, Williams Ulbricht, the founder of the website for the sale of illicit drugs Silk Road, was not lucky - he was arrested in the United States. At the other end of the world, in Russia, Ulbricht's “colleague”, a hacker known as Paunch, was also detained. He became famous as the owner of the well-known set of Blackhole exploit hackers, which was actively used by cybercriminals around the world to covertly penetrate user systems.

Threats to TOR

Cybercriminals picked up the trend for anonymity back in the middle of the year - it was then that ESET experts discovered the Atrax botnet, the technically most complex and interesting botnet for the anonymous TOR network. Since data transfer on this network is not a fast process, the botnet was not used to steal large amounts of data. Instead, he collected information entered into authorization forms on various portals, and also downloaded additional malicious files onto a PC.

Atrax enters the PC through a special malicious page disguised as a PayPal customer support site. Detecting and destroying the command center of this botnet is not an easy task, because in this case the anonymity of TOR protects not the users, but the cybercriminals themselves. It can be assumed that with the growth of migration to the “hidden Internet” we will see new, technologically even more advanced threats for TOR.

Mobile Threats

Another, so far relatively exotic variety of botnets, have become botnets for mobile devices. First recorded in 2012, today most of the malware for Android contains functionality for combining infected smartphones and tablets into botnets.

If we talk about mobile threats in general, compared to the same period last year, the number of new malware families for Android (which still make up 99% of all mobile threats) in 2013 increased by 43.6%, and this not only about the growth of activity of known threats, but about the emergence of new categories of software.

∙ Downloader: Attempts to download other malware files from the Internet and install them on the device.
∙ Dropper: installs other threats to the device at startup; threats are in the body of the dropper himself.
∙ Clicker: designed to generate traffic to sites through an artificial increase in the number of clicks.
∙ Banking malware: specializes in stealing user confidential information, which is used to carry out operations related to online banking.

One of the most active mobile threats was the SMS trojan detected by ESET products as TrojanSMS.Agent (its modifications demonstrate especially high activity in Russia and the countries of the former USSR). In 2011, 31 modifications of this program were discovered, and in 2013 there were already 324 of them. Such trojans can secretly send messages to paid numbers from the user, emptying the mobile account. Over the past year, the total number of malware for the Android platform has grown by 63%. The highest growth rates of Android threats were demonstrated by Iran, China and Russia. Similar growth rates will continue in 2014; new mobile threats will demonstrate not only quantitative, but also qualitative growth - in particular, they will increasingly use the vulnerabilities of mobile platforms and their components.

Ransomware

The ransomware activity in 2013 also showed significant growth - for example, ESET experts in Russia detected a rapid increase in the activity of the FileCoder ransomware Trojan, which requires a ransom for decrypting the user's personal files. Compared with the average level recorded in the first half of 2013, FileCoder activity increased by more than 200%.

According to ESET, Russian users accounted for more than 44% of detections of this program. Another ransomware common in 2013, CryptoLocker, used a countdown as a psychological attack - an infected user was given only 70 hours to pay a ransom and gain access to encrypted personal data. Otherwise, he said goodbye to them forever. The Nymaim Trojan detected by ESET experts can also block the user's computer for ransom.

Previously, the infection with this software was carried out using the already mentioned BlackHole exploit kit, but later cybercriminals reoriented themselves to distribution through a Google search. Having clicked on a malicious link in the search results, instead of the information sought, the user initiated the download of the malicious archive. In 2014, one should also not expect a decrease in ransomware activity - in particular, the appearance of new modifications will spur the popularity of the Bitcoin virtual currency.

Due to its anonymity and high rate, cybercriminals will increasingly demand a ransom precisely in bitcoins. However, some cybercriminals decided not to extort bitcoins from users, but steal them directly - for example, a new modification of the famous banking Trojan Hesperbot, which is widespread in Europe, is now aimed at stealing electronic currency. Theft is realized through gaining access to an electronic wallet containing secret keys.


The picture opens completely here: https://econbez.ru/modules/spaw2/uploads ... 3rw-eb.jpg

ESET Research

In 2013, ESET conducted a number of large-scale studies among Russian and foreign users. Here are their brief results:

· 60% of users at least once lost access to accounts on social networks as a result of hacking (25% were hacked more than once).

· For 56% of mobile device users, the contact list remains the most valuable information.

· 6% of respondents value the data necessary for making mobile Internet payments.

· 5% and 4%, respectively, fear losing access to mail or allowing the leak of confidential work information.

· 76% of users suffer from mobile spam.

· 11% of users receive advertising calls. · 56% of users do not hide compromising data in their profiles on social networks when searching for work.

· 65% of employers are looking for candidates on social networks who have sent them a resume. The vast majority take into account the information received, deciding on the candidate.

· Today, 49% of respondents actively communicate in at least two social networks (and 13% use four or more services).

· 86% of users are more or less concerned about information security issues.

· 64% of respondents recognize personal responsibility in protecting personal data from hacker attacks and malware.

With such statistics, one can be optimistic about the future - despite the growing number of mobile and computer threats, the awareness of Internet users and the understanding that their security is in their own hands are growing.

ESET experts

 

[Плотников Юрий Михайлович]

Thank!

 

[Краев Евгений Леонидович]

Thank you, very curious!

 

[Турабян Владимир]

Thank!