Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


05:47 PM
Connect Directly

Worm Siphons 45,000 Facebook Accounts

Ramnit financial malware gets social with new variant

A server housing tens of thousands of stolen Facebook credentials was discovered -- and it turns out the attackers employed a new version of an existing worm to pilfer the goods.

Researchers at Seculert say the attackers used a new variant of the Ramnit worm, which is best-known as a financial malware family that steals FTP credentials and most recently morphed into a Zeus-like weapon that performs HTML code injection into browsers to steal online banking credentials. Ramnit represents some 17 percent of all new malware infections, according to Symantec data.

Ramnit is best-known for its ability to spread quickly and on a large scale. "This is a variant which expands the financial-stealing of the previous version and now steals Facebook login credentials," says Aviv Raff, CTO at Seculert. "We suspect they are using the login credentials to increase the spread of Ramnit. The malware by itself is a worm -- or a file infector -- and this feature adds to this worm capability."

Seculert employed a sinkhole to gather data on Ramnit's activity and found that the attackers had stolen more than 45,000 Facebook credentials from all over the world, but mainly from users in the U.K. and France. Even more alarming is that the attackers appear to be using duplicate passwords to hack victims' corporate accounts and, thus, their employers. Seculert has handed the information over to Facebook.

"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks," according to Seculert's blog posting on the find today.

[Ramnit has been evolving for months, including targeting online banking. See Worm Morphs, Attacks Banks With Zeus-Like Features.]

"Cybercriminals are abusing the stolen credentials to try and access victims' corporate networks," Raff says. "We see that happen a lot."

Attackers are retooling malware families to target social networks as an alternative to email spam.

"Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time,” says Michael Sutton, vice president of security research at Zscaler ThreatLabZ. "Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account from which the communication was received may itself have already been compromised."

Facebook is well-aware of this trend, but is limited in stopping these attacks, according to Sutton: "This is indicative of what we're seeing at Facebook overall -- the site is not generally being used to host malware as Facebook is fortunately doing a decent job of preventing such attacks, but it has so far been playing a losing game when it comes to preventing the social network from being used as a catalyst to promote attacks."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
1/12/2012 | 1:36:17 PM
re: Worm Siphons 45,000 Facebook Accounts
So, are you suggesting that someone remember 20+ unique strong passwords??- Let me give you a hint - passwords are OLD news...common/designer malwares will not brute force your password, they will either A: trick you into submitting it, or B: log it from your keystrokes...

...and if "threat A" wanted to (besides a quick dictionary brute force) crack your strong password, they could.- Google's new Gmail authentication is a good example of a company thinking forward.

Try this one "IT departments should require an additional layer of authentication"...there, I fixed it.
User Rank: Ninja
1/6/2012 | 11:13:40 PM
re: Worm Siphons 45,000 Facebook Accounts
"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks." - This isn't surprising, but it is unfortunate. I was just talking to someone recently who commented that users are often the weakest link in security.Brian Prince, InformationWeek/Dark Reading Comment Moderator
User Rank: Apprentice
1/6/2012 | 9:40:23 PM
re: Worm Siphons 45,000 Facebook Accounts
Viruses and worms are becoming more sophisticated and as such, they are a real threat not only to people who let their guard down, but also to the organizations that those victims work for.

Many end users are not diligent with choosing unique passwords for corporate systems.- They often reuse the same personal password (that they use on probably 20+ different websites) as their login on company systems such as company webmail, VPNs, CRMs, and SharePointGǪamong others.

This is just another reminder to IT departments that it is important to require end users to have strong passwords, and also require them to change those passwords at least every couple of months.
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-20
The Transaction Insight reporting component of TIBCO Software Inc.'s TIBCO Foresight Archive and Retrieval System, TIBCO Foresight Archive and Retrieval System Healthcare Edition, TIBCO Foresight Operational Monitor, TIBCO Foresight Operational Monitor Healthcare Edition, TIBCO Foresight Transaction...
PUBLISHED: 2020-10-20
The Boxstarter installer before version 2.13.0 configures C:\ProgramData\Boxstarter to be in the system-wide PATH environment variable. However, this directory is writable by normal, unprivileged users. To exploit the vulnerability, place a DLL in this directory that a privileged service is looking ...
PUBLISHED: 2020-10-20
In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.
PUBLISHED: 2020-10-20
DomainMOD before 4.14.0 uses MD5 without a salt for password storage.
PUBLISHED: 2020-10-20
Netwrix Account Lockout Examiner before 5.1 allows remote attackers to capture the Net-NTLMv1/v2 authentication challenge hash of the Domain Administrator (that is configured within the product in its installation state) by generating a single Kerberos Pre-Authentication Failed (ID 4771) event on a ...