An identity theft service has hacked several data broker behemoths, according to a seven-month investigation by KrebsOnSecurity, and yes, it may be the mother of all hacks.
Here's the backstory: For the past two years, SSNDOB.ms marketed itself on underground cybercrime forums as a reliable and affordable service that customers can use to look up Social Security numbers, birthdays and other personal data on any U.S. resident, Krebs reports. The price: from 50 cents to $2.50 a record and from $5 to $15 for credit and background checks. The subscription-based service accepted anonymous virtual currencies like Bitcoin and WebMoney.
Late last month, Krebs reports, network analyses uncovered that credentials SSNDOB admins used were also responsible for operating a botnet that apparently tapped into the internal systems of large data brokers. LexisNexis confirmed that it was compromised as far back as April 10. Krebs reports that a program installed on the server was designed to open an encrypted channel of communications from within LexisNexis's internal systems to the botnet controller on the public Internet.
Five Data Brokers Breached
"Two other compromised systems were located inside the networks of Dun & Bradstreet, a Short Hills, New Jersey data aggregator that licenses information on businesses and corporations for use in credit decisions, business-to-business marketing and supply chain management," Krebs explains. "According to the date on the files listed in the botnet administration panel, those machines were compromised at least as far back as March 27, 2013."
According to Krebs, the fifth server compromised as part of this botnet was located at Internet addresses assigned to Kroll Background America. Kroll, which is now part of HireRight, provides employment background, drug and health screening. Altegrity owns both Kroll and HireRight. Krebs says files left behind by intruders into the company's internal network suggest the HireRight breach extends back to at least June 2013.
"An initial analysis of the malicious bot program installed on the hacked servers reveals that it was carefully engineered to avoid detection by antivirus tools," Krebs says. "A review of the bot malware in early September using Virustotal.com -- which scrutinizes submitted files for signs of malicious behavior by scanning them with antivirus software from nearly four dozen security firms simultaneously -- gave it a clean bill of health: none of the 46 top anti-malware tools on the market today detected it as malicious (as of publication, the malware is currently detected by six out of 46 anti-malware tools at Virustotal)." (continued...)
Ulf Mattsson :
Posted: 2013-10-13 @ 8:20am PT
I agree with "recommends a layered security approach, rather than relying on any single technology or approach as the silver bullet".
I recently read an interesting report from the Aberdeen Group that revealed that “Over the last 12 months, tokenization users had 50% fewer security-related incidents (e.g., unauthorized access, data loss or data exposure than tokenization non-users”. The name of the study, released a few months ago, is “Tokenization Gets Traction”.
This report is showing how NEW technology can prevent computer attacks. Very interesting.
Ulf Mattsson, CTO Protegrity