How Much is That Phished PayPal Account?

Compromised PayPal accounts are a valuable commodity in the criminal underground, and crooks frequently trade them in shadowy online forums. But it wasn’t until recently that I finally encountered a proper Web site dedicated to selling hacked PayPal accounts.

Compromised PayPal accounts for sale at iProfit.su

Many of the PayPal accounts for sale at iProfit.su have a zero balance, but according to the proprietor of this shop these are all “verified.” PayPal “verifies” an account when a customer agrees to attach a bank account to it; PayPal then sends a micropayment the bank account, and asks the user the value of that mini deposit. A bonus feature: all the hacked PayPal profiles currently for sale at iProfit.su are advertised as having a credit card attached to them, which is another way PayPal accounts can be verified.

The creator of iProfit.su also advertises private, bulk sales of unverified PayPal accounts; currently he is selling these at $50 per 100 accounts – a bargain at only 50 cents apiece.

Accounts are sold with or without email access (indicated by the “email” heading in the screenshot above): Accounts that come with email access include the username and password of the victim’s email account that they used to register at PayPal, the site’s proprietor told me via instant message. The creator of iProfit.su told me the accounts for sale were stolen via phishing attacks, but the fact that accounts are being sold along with email access suggests that at least some of the accounts are being hijacked by password-stealing computer Trojans on account holders’ PCs.


It’s not clear how this guy prices the verified PayPal accounts. In the accounts I saw advertised (see screenshot above), the prices started at $2.50 for verified accounts with a balance from $0 to $10. Higher-balance verified accounts appear to be priced at between 8 to 12 percent of their total balance. For example, one account — apparently taken from a hapless victim named Abigail — has a current balance of $121.07, and is being sold for $15.

Another account, from Gwynn in Tallmadge (Ohio?) has a hefty balance of $1,102.37; its sale price was set at $45. Taking a look at the domain name in Gwynn’s email address, I decided she must work at or for Gambit Systems, a software development firm in Akron, Ohio. I  sent an email to the administrator at that company, who passed on the information and confirmed that PayPal had since locked down Gwynn’s account.

The proprietors of iProfit.su also run blackservice.su, a “carding” forum where members can sell all kinds of stolen goods and illegal services, from stolen credit cards to services that will look up Social Security numbers and birthdays.
Readers may have noticed that both of the Web sites mentioned in this story end with the “.su” top-level domain (TLD): This TLD identifies the Soviet Union; it’s a holdover from the country-code TLD that was created for the Soviet Union in 1990. It was long considered dead, but .su is now quite popular, particularly among sites catering to Russian-language cybercrime forums.

Read More...

SpyEye Trojan variant attacking Google Android smartphones

SpyEye Trojan variant SpitMo is attacking mobile devices running the Google Android operating system, warns security firm Trusteer.
The change in delivery and infection methods has increased the danger of SpyEye, according to Amit Klein, chief technology officer at Trusteer.

"We always said it was just a matter of time before the true potential of SpitMo was realised," he said.

SpitMo first emerged in April when security firm F-Secure reported the malware was targeting European banks.

The Trojan typically injected fields into a bank's web page asking the customer to input a mobile phone number and the IMEI identity number of the phone.
Initially, the fraudster needed to follow a cumbersome three-stage sequence of getting the IMEI number, generating a certificate and releasing an updated installer.

But now, data gathered by Trusteer's Intelligence Centre has uncovered a new far more intuitive, and modern, approach of SpitMo for Android now active in the wild, said Klein.

"When a user browses to the targeted bank a message is injected presenting a 'new' mandatory security measure, enforced by the bank, in order to use its online banking service," he said.

The initiative pretends to be an Android application that protects the phone's SMS messages from being intercepted and will protect the user against fraud.

Once the user clicks on "set the application" they are given further instructions to walk them though downloading and installing the application.

To complete the installation, the user is instructed to dial the number "325000" to get an activation code to access the bank's site in future, but the call is intercepted by the Android malware and a dummy activation code is returned.

Once the Trojan is installed, all incoming SMS messages will be intercepted and transferred to the attacker's command and control server.

Klein says the attack has yet to gain momentum, but what makes it particularly scary is that the application is invisible on the device's dashboard, making it virtually undetectable, so users are not aware of its presence and will struggle to get rid of it.

"Organisations and individuals need to act now and protect themselves as this variant has traits to become a more serious threat. My advice is to install a desktop browser security solution as part of a multi-layered security approach," said Klein.

nb : computerweekly

Read More...

Hackers steal credit card details at Wisconsin and Tennessee Wilderness resorts

Bad news if you have been on vacation at one of the Wilderness resorts in Tennessee and Wisconsin in the last couple of years - hackers may now have your credit card details.

VacationLand Vendors Inc, a firm which provides arcade and vending machines to businesses, has revealed that a hacker broke into its credit card processing systems and stolen up to 40,000 credit card details.

The credit cards were used in arcades at the Wilderness Hotel & Golf Resort in Wisconsin, and the Wilderness at the Smokies Waterpark Resort in Tennessee.
Precise details of how the data breach occurred have not been made public, but the company has published a warning on its website, and advised customers to keep their eyes peeled for unusual transactions on their credit cards.



Vacationland Vendors says that it "deeply regrets" the security breach and shut down its systems at the affected arcades as soon as it discovered the problem on March 25, 2011 - but that patrons may be impacted as far back as December 12, 2008.

The FTC has produced a website all about how consumers can protect themselves against identity theft.

nb : nakedsecurity.sophos

Read More...