05:47 PM
Connect Directly

Worm Siphons 45,000 Facebook Accounts

Ramnit financial malware gets social with new variant

A server housing tens of thousands of stolen Facebook credentials was discovered -- and it turns out the attackers employed a new version of an existing worm to pilfer the goods.

Researchers at Seculert say the attackers used a new variant of the Ramnit worm, which is best-known as a financial malware family that steals FTP credentials and most recently morphed into a Zeus-like weapon that performs HTML code injection into browsers to steal online banking credentials. Ramnit represents some 17 percent of all new malware infections, according to Symantec data.

Ramnit is best-known for its ability to spread quickly and on a large scale. "This is a variant which expands the financial-stealing of the previous version and now steals Facebook login credentials," says Aviv Raff, CTO at Seculert. "We suspect they are using the login credentials to increase the spread of Ramnit. The malware by itself is a worm -- or a file infector -- and this feature adds to this worm capability."

Seculert employed a sinkhole to gather data on Ramnit's activity and found that the attackers had stolen more than 45,000 Facebook credentials from all over the world, but mainly from users in the U.K. and France. Even more alarming is that the attackers appear to be using duplicate passwords to hack victims' corporate accounts and, thus, their employers. Seculert has handed the information over to Facebook.

"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks," according to Seculert's blog posting on the find today.

[Ramnit has been evolving for months, including targeting online banking. See Worm Morphs, Attacks Banks With Zeus-Like Features.]

"Cybercriminals are abusing the stolen credentials to try and access victims' corporate networks," Raff says. "We see that happen a lot."

Attackers are retooling malware families to target social networks as an alternative to email spam.

"Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time,” says Michael Sutton, vice president of security research at Zscaler ThreatLabZ. "Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account from which the communication was received may itself have already been compromised."

Facebook is well-aware of this trend, but is limited in stopping these attacks, according to Sutton: "This is indicative of what we're seeing at Facebook overall -- the site is not generally being used to host malware as Facebook is fortunately doing a decent job of preventing such attacks, but it has so far been playing a losing game when it comes to preventing the social network from being used as a catalyst to promote attacks."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Senior Editor at She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/12/2012 | 1:36:17 PM
re: Worm Siphons 45,000 Facebook Accounts
So, are you suggesting that someone remember 20+ unique strong passwords??-á Let me give you a hint - passwords are OLD news...common/designer malwares will not brute force your password, they will either A: trick you into submitting it, or B: log it from your keystrokes...

...and if "threat A" wanted to (besides a quick dictionary brute force) crack your strong password, they could.-á Google's new Gmail authentication is a good example of a company thinking forward.

Try this one "IT departments should require an additional layer of authentication"...there, I fixed it.
User Rank: Ninja
1/6/2012 | 11:13:40 PM
re: Worm Siphons 45,000 Facebook Accounts
"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks." - This isn't surprising, but it is unfortunate. I was just talking to someone recently who commented that users are often the weakest link in security.Brian Prince, InformationWeek/Dark Reading Comment Moderator
User Rank: Apprentice
1/6/2012 | 9:40:23 PM
re: Worm Siphons 45,000 Facebook Accounts
Viruses and worms are becoming more sophisticated and as such, they are a real threat not only to people who let their guard down, but also to the organizations that those victims work for.

Many end users are not diligent with choosing unique passwords for corporate systems.-á They often reuse the same personal password (that they use on probably 20+ different websites) as their login on company systems such as company webmail, VPNs, CRMs, and SharePointGǪamong others.

This is just another reminder to IT departments that it is important to require end users to have strong passwords, and also require them to change those passwords at least every couple of months.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.