Worm Siphons 45,000 Facebook Accounts

A server housing tens of thousands of stolen Facebook credentials was discovered -- and it turns out the attackers employed a new version of an existing worm to pilfer the goods.

Researchers at Seculert say the attackers used a new variant of the Ramnit worm, which is best-known as a financial malware family that steals FTP credentials and most recently morphed into a Zeus-like weapon that performs HTML code injection into browsers to steal online banking credentials. Ramnit represents some 17 percent of all new malware infections, according to Symantec data.

Ramnit is best-known for its ability to spread quickly and on a large scale. "This is a variant which expands the financial-stealing of the previous version and now steals Facebook login credentials," says Aviv Raff, CTO at Seculert. "We suspect they are using the login credentials to increase the spread of Ramnit. The malware by itself is a worm -- or a file infector -- and this feature adds to this worm capability."

Seculert employed a sinkhole to gather data on Ramnit's activity and found that the attackers had stolen more than 45,000 Facebook credentials from all over the world, but mainly from users in the U.K. and France. Even more alarming is that the attackers appear to be using duplicate passwords to hack victims' corporate accounts and, thus, their employers. Seculert has handed the information over to Facebook.

"The cybercriminals are also taking advantage of the fact that people usually use the same passwords for different web-based services (Facebook, Gmail, Corporate SSL VPN, Outlook Web Access, etc.), to gain remote access to corporate networks," according to Seculert's blog posting on the find today.

[Ramnit has been evolving for months, including targeting online banking. See Worm Morphs, Attacks Banks With Zeus-Like Features.]

"Cybercriminals are abusing the stolen credentials to try and access victims' corporate networks," Raff says. "We see that happen a lot."

Attackers are retooling malware families to target social networks as an alternative to email spam.

"Ramnit is a reflection of a shift that has been ongoing in the malware domain for some time,” says Michael Sutton, vice president of security research at Zscaler ThreatLabZ. "Ramnit was not initially designed to harvest Facebook credentials, but the Ramnit maintainers have recognized the value of Facebook accounts for propagation. Whereas email can be easily spoofed and is therefore more likely to be ignored, receiving communication from a trusted contact on Facebook will have much higher click-through rates. Victims are simply not aware that the 'trusted' Facebook account from which the communication was received may itself have already been compromised."

Facebook is well-aware of this trend, but is limited in stopping these attacks, according to Sutton: "This is indicative of what we're seeing at Facebook overall -- the site is not generally being used to host malware as Facebook is fortunately doing a decent job of preventing such attacks, but it has so far been playing a losing game when it comes to preventing the social network from being used as a catalyst to promote attacks."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.