Feature

Who's Stealing Your Passwords? Global Hackers Create a New Online Crime Economy

A sophisticated new breed of online criminals is making it easier than ever for the bad guys to engage in identity theft and other cybercrime.

Inside an Identity Theft Site

An exclusive look at the inner workings of 76service
Click the "Play" button on the video below.

DISCLAIMER: What you see is a film of the video captured by SecureWorks senior security researcher Don Jackson after he was among several unidentified forum participants given an invitation without limitation to explore the site. When we say Jackson "hacked" the site, we are using the term in the non-malicious sense. Jackson's video was filmed to allow us to zoom in on and highlight specific areas on the site. The video has been edited for time, but no information has been changed. IP addresses have been blocked to protect innocent victims. Companies named in the film were not compromised; rather, the machines of consumers who visited those companies' sites were compromised. The information contained within this video was shared with law enforcement.

Berbew’s creator is believed to be a VXer, or malware developer, named Smash, who rose to prominence by co-founding the IAACA—International Association for the Advancement of Criminal Activity–after the Feds busted up ShadowCrew, Smash’s previous hacking group.

Special Report: The Hacking Economy

Who's Stealing Your Passwords? Global Hackers Create a New Online Crime Economy

Hacker Economics 2: The Conspiracy of Apathy

Hacker Economics 3: The Next Wave of Malware

Key Malware Terms

A Trojan's First Second

Death by iFrame

Inside a Hacker's Site: Screenshots

Berbew was wildly effective. Lance James, a researcher with Secure Science Corp., believes it operated undetected for as long as nine months and grabbed as much as 113GB of data—millions of personal credentials.

Like all exploits, Berbew was eventually detected and contained, but, as is customary with malware, strands of Berbew’s form-grabbing code were stitched into new Trojans that had adapted to defenses. The process is not unlike horticulturalists’ grafting pieces of one plant onto another in order to create hardier mums.

Thus, Berbew code reappeared in the Trojan A311-Death, and A311- Death in turn begat a pervasive lineage of malware called the Haxdoor family, authored by Corpse, who many believe was part of a well-known, successful hacking group called the HangUp Team, based in the port city of Archangelsk, Russia, where the Dvina River empties into the White Sea, near the Arctic Circle.

By 2006, online banking was ubiquitous and form-grabbers had been refined into remarkably efficient, multi-purpose bots. Corpse himself was peddling a sophisticated Haxdoor derivative called Nuclear Grabber for as much as $3,200 per copy. Nordea Bank in Sweden lost 8 million kronor ($1.1 million) because of it.

But by last October, despite his success, Corpse decided that it was time to lay low. A message appeared on a discussion board at pinch3.net, a site that sold yet another Haxdoor relative called pinch.

“Corpse does cease development spyware? news not new, but many do not know” reads a post by “sash” translated using Babelfish. It then quotes Corpse: “I declare about the official curtailment of my activity of that connected with troyanami [trojans]”

This past January, a reporter for Computer Sweden chatted with Corpse, pretending to be a potential customer. Corpse tried to sell him Nuclear Grabber for $3,000 and crowed that banks sweep 99 percent of online fraud cases under the rug. After Computerworld Australia published the chat, Corpse disappeared. He hasn’t been heard from since.

But his form-grabbing code resurfaced, when a friend of Don Jackson asked him to look at a file he found on his computer, as a favor.

That file led Jackson behind the curtain to find hacking with a level of sophistication he’d never seen before.

Next: Gozi and the hacking service economy.