The attack was first discovered in January while a security analyst at Hernon, Va.-based NetWitness was installing a monitoring system for a client. In investigating the discovery, the company found Kneber had compromised 68,000 corporate log-ins; access to various e-mail systems, including Yahoo and Hotmail; access to online banking sites; and access to social-networking sites, including Facebook. All of this was done in a four-week period.

Kneber has been identified as a botnet, where compromised computers run software remotely.

"Systems compromised by this botnet provide the attackers not only user credentials and confidential information, but remote access inside the compromised networks," said Amit Yoran, CEO of NetWitness and former director of the National Cyber Security Division.

Damage Done

The Kneber botnet is not stopped by traditional malware protection or other intrusion-detection systems, and NetWitness analysts fear organizations will not see the damage from this attack until it has already occurred.

More than half the infected machines were also infected with a peer-to-peer botnet dubbed Waledac, a worm that is capable of collecting and forwarding password information. It's also capable of receiving commands from a remote server , including to upgrade malware components or send information from the infected computer.

Used together, the botnets have the potential to enable hackers to collaborate in what NetWitness said may be a "criminal underground."

"On a microlevel, there are new versions of Trojans and viruses that come out all the time and some gain traction while others do not," said Matthew Prince, cocreator of Project Honey Pot, a spam tracking network. "On the macrolevel it is really scary."

Cybercriminal Revolution

The Zeus line of credential-stealing viruses is like a whole new disease that has emerged in the cyber infection space, according to Prince. The bad guys are taking technology that has emerged through the Zeus virus and leveraged it into newer attacks such as Kneber.

"The revolution that has happened and the supply chain of criminal enterprises that has been built up by the Zeus virus has allowed them to do damage in a way that was not before possible," Prince said.

"These large-scale compromises of enterprise networks have reached epidemic levels," explained NetWitness's Yoran. "Cybercriminal elements like the Kneber crew quietly and diligently target and compromise thousands of government and commercial organizations across the globe." (continued...)

1  |  2  |  Next Page >

 

Anonymous:

Anonymous:

Anonymous:

Anonymous: