05:47 PM
Connect Directly
Repost This

Worm Siphons 45,000 Facebook Accounts

Ramnit financial malware gets social with new variant

A server housing tens of thousands of stolen Facebook credentials was discovered -- and it turns out the attackers employed a new version of an existing worm to pilfer the goods.

Researchers at Seculert say the attackers used a new variant of the Ramnit worm, which is best-known as a financial malware family that steals FTP credentials and most recently morphed into a Zeus-like weapon that performs HTML code injection into browsers to steal online banking credentials. Ramnit represents some 17 percent of all new malware infections, according to Symantec data.

Ramnit is best-known for its ability to spread quickly and on a large scale. "This is a variant which expands the financial-stealing of the previous version and now steals Facebook login credentials," says Aviv Raff, CTO at Seculert. "We suspect they are using the login credentials to increase the spread of Ramnit. The malware by itself is a worm -- or a file infector -- and this feature adds to this worm capability."

Seculert employed a sinkhole to gather data on Ramnit's activity and found that the attackers had stolen more than 45,000 Facebook credentials from all over the world, but mainly from users in the U.K. and France. Even more alarming is that the attackers appear to be using duplicate passwords to hack victims' corporate accounts and, thus, their employers. Seculert has handed the information over to Facebook.

"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks," according to Seculert's blog posting on the find today.

[Ramnit has been evolving for months, including targeting online banking. See Worm Morphs, Attacks Banks With Zeus-Like Features.]

"Cybercriminals are abusing the stolen credentials to try and access victims' corporate networks," Raff says. "We see that happen a lot."

Attackers are retooling malware families to target social networks as an alternative to email spam.

"Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time,” says Michael Sutton, vice president of security research at Zscaler ThreatLabZ. "Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account from which the communication was received may itself have already been compromised."

Facebook is well-aware of this trend, but is limited in stopping these attacks, according to Sutton: "This is indicative of what we're seeing at Facebook overall -- the site is not generally being used to host malware as Facebook is fortunately doing a decent job of preventing such attacks, but it has so far been playing a losing game when it comes to preventing the social network from being used as a catalyst to promote attacks."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/12/2012 | 1:36:17 PM
re: Worm Siphons 45,000 Facebook Accounts
So, are you suggesting that someone remember 20+ unique strong passwords??-á Let me give you a hint - passwords are OLD news...common/designer malwares will not brute force your password, they will either A: trick you into submitting it, or B: log it from your keystrokes...

...and if "threat A" wanted to (besides a quick dictionary brute force) crack your strong password, they could.-á Google's new Gmail authentication is a good example of a company thinking forward.

Try this one "IT departments should require an additional layer of authentication"...there, I fixed it.
User Rank: Ninja
1/6/2012 | 11:13:40 PM
re: Worm Siphons 45,000 Facebook Accounts
"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks." - This isn't surprising, but it is unfortunate. I was just talking to someone recently who commented that users are often the weakest link in security.Brian Prince, InformationWeek/Dark Reading Comment Moderator
User Rank: Apprentice
1/6/2012 | 9:40:23 PM
re: Worm Siphons 45,000 Facebook Accounts
Viruses and worms are becoming more sophisticated and as such, they are a real threat not only to people who let their guard down, but also to the organizations that those victims work for.

Many end users are not diligent with choosing unique passwords for corporate systems.-á They often reuse the same personal password (that they use on probably 20+ different websites) as their login on company systems such as company webmail, VPNs, CRMs, and SharePointGǪamong others.

This is just another reminder to IT departments that it is important to require end users to have strong passwords, and also require them to change those passwords at least every couple of months.
Register for Dark Reading Newsletters
White Papers
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-04-24
Cisco IOS before 15.3(2)S allows remote attackers to bypass interface ACL restrictions in opportunistic circumstances by sending IPv6 packets in an unspecified scenario in which expected packet drops do not occur for "a small percentage" of the packets, aka Bug ID CSCty73682.

Published: 2014-04-24
Cisco ASR 1000 devices with software before 3.8S, when BDI routing is enabled, allow remote attackers to cause a denial of service (device reload) via crafted (1) broadcast or (2) multicast ICMP packets with fragmentation, aka Bug ID CSCub55948.

Published: 2014-04-24
Cross-site scripting (XSS) vulnerability in IBM SmartCloud Analytics Log Analysis 1.1 and 1.2 before allows remote attackers to inject arbitrary web script or HTML via an invalid query parameter in a response from an OAuth authorization endpoint.

Published: 2014-04-24
The password recovery service in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 makes an improper decision about the sensitivity of a string representing a previously used but currently invalid password, which allows remote attackers to obtain potent...

Published: 2014-04-24
The E-Mail autoconfiguration feature in Open-Xchange AppSuite before 7.2.2-rev20, 7.4.1 before 7.4.1-rev11, and 7.4.2 before 7.4.2-rev13 places a password in a GET request, which allows remote attackers to obtain sensitive information by reading (1) web-server access logs, (2) web-server Referer log...

Best of the Web