Stolen data on 'crime server'
2008-05-07 12:02
London - A web security firm said on
Tuesday it had tipped off international banks and police after
finding a huge trove of stolen business and personal data
amassed on a server in the space of just three weeks.
Finjan Inc said it had notified the US Federal Bureau of
Investigation, police in various countries and more than 40
financial institutions in the United States, Europe and India
about the discovery of the so-called "crime server".
"This server was running for about three weeks and within
this period it managed to collect 1.4 gigabytes of data. It is
indeed the largest treasure we've found in this very short
time," Yuval Ben-Itzhak, chief technology officer of the
California-based firm, said in a phone interview from Israel.
The stolen data consisted of 5 388 unique log files
including 1 037 from Turkey, 621 from Germany, 571 from the
United States, 322 from France, 308 from India and 232 from
Britain.
It included company personnel files, insurance details,
social security numbers, medical records, credit card details
and exchanges of confidential business e-mail, in one case
including details of a pending court case.
Ben-Itzhak said it was striking that the crime server itself
was not security-protected, meaning anyone could potentially
have accessed it over the internet.
"The server was not secure at all. It indicates that these
people that are doing the crime today, they are not security
experts, they are not computer science experts.
"They are people who are buying the crime toolkits ...
software packages that hackers, the smart people, are selling,"
he told Reuters.
"The person that operated this server had no clue on
security, he had no clue about how to configure a web server. He
just took a ... toolkit and started to use it and in three weeks
he managed to have this fortune, this treasure on his server."
'Trojan' software
The crime server had a "command and control" application that
enabled the user to define what types of target to infect with
"trojan" software.
"Online statistics reports are included in this command and
control. They can tell you who you managed to infect; where they
are coming from; if the trojan that is now installed on their
machine is sending you data, how much data you're getting - you
get all these online reports as well."
The hosting server was located in Malaysia and the web
domain was registered to a Russian individual with a Moscow
address. Ben-Itzhak said this could not be validated because
domains can easily be registered in false names.
He said the discovery highlighted a growing trend for
criminals to target commercial data. Details of pricing, company
policies and stock-sensitive earnings results were all at risk.
"It's not just individuals at home doing their online
banking and someone is stealing their password... The big picture
is these criminals are looking for business data."