Koobface2000
Koobface is a network worm that attacks Microsoft Windows, Mac OS X, and Linux platforms.[1][2][3] This computer worm originally targeted users of networking websites like Facebook, Skype, Yahoo Messenger and email websites such as Gmail, Yahoo Mail, and AOL Mail. This infection allows an attacker to access personal information such as credit cards, passwords and other personal data.[4]
Infection
Yahoo and Gmail faced this problem in 2016. More than a million email accounts and computers were hacked.[5] It then uses compromised computers to build a peer-to-peer botnet. A compromised computer contacts other compromised computers to receive commands in a peer-to-peer fashion. The botnet is used to install additional pay-per-install malware on the compromised computer and hijack search queries to display advertisements. Its peer-to-peer topology is also used to show fake messages to other users for the purpose of expanding the botnet.[6] It was first detected in December 2014 and a more potent version appeared in March 2015.[7] A study by the Information Warfare Monitor, a joint collaboration from SecDev Group and the Citizen Lab in the Munk School of Global Affairs at the University of Toronto, has revealed that the operators of this scheme have generated over $2 million in revenue from June 2014 to December 2015.[5]
Several variants of the worm have been identified:
- Worm:Win32/Koobface.gen!F[8]
- Net-Worm.Win32.Koobface.a, which attacks MySpace
- Net-Worm.Win32.Koobface.b, which attacks Facebook[9]
- WORM_KOOBFACE.DC, which attacks Twitter[10]
- W32/Koobfa-Gen, which attacks Facebook, MySpace, hi5, Bebo, Friendster, myYearbook, Tagged, Netlog, Badoo and fubar[11][12]
- W32.Koobface.D[13]
- OSX/Koobface.A, a Mac version which spreads via social networks such as Facebook, MySpace and Twitter.[14]
In January 2012, the New York Times reported[15] that Facebook was planning to share information about the Koobface gang, and name those it believed were responsible. Investigations by German researcher Jan Droemer[16] and the University of Alabama at Birmingham's Center for Information Assurance and Joint Forensics Research[17] were said to have helped uncover the identities of those responsible.
Facebook finally revealed the names of the suspects behind the worm on January 17, 2012. They include Stanislav Avdeyko (leDed), Alexander Koltyshev (Floppy), Anton Korotchenko (KrotReal), Roman P. Koturbach (PoMuc), Svyatoslav E. Polichuck (PsViat and PsycoMan). They are based in St. Petersburg, Russia. The group is sometimes referred to as Ali Baba & 4 with Stanislav Avdeyko as the leader.[18] The investigation also connected Avdeyko with CoolWebSearch spyware.[16]
References
- ↑ Lucian Constantin (28 October 2010). "New Koobface Variant Infects Linux Systems". softpedia. Retrieved 3 February 2015.
- ↑ Lucian Constantin (30 October 2010). "Linux Java-Based Trojan Might Have Been an Accident". softpedia. Retrieved 3 February 2015.
- ↑ "More Information About the Koobface Trojan Horse for Mac". The Mac Security Blog. October 29, 2010. Retrieved 2012-01-20.
- ↑ Deibert, Ron; Rafal Rohozinski (Nov 12, 2010). "The untouchable hackers of St. Petersburg: Meet Koobface, Facebook's evil doppelgänger". The Globe and Mail. Retrieved 16 November 2010.
- ↑ 5.0 5.1 Koobface: Inside a Crimeware Network
- ↑ "W32.Koobface". symantec.com. Retrieved 3 February 2015.
- ↑ Keizer, Gregg (March 2, 2009). "Koobface worm to users: Be my Facebook friend". Computerworld. Archived from the original on 2012-10-10. Retrieved 2009-08-31.
- ↑ "Worm:Win32/Koobface.gen!F". microsoft.com. Microsoft. Retrieved 3 February 2015.
- ↑ "Koobface malware distribution technique - automatic user account creation on FaceBook, Twitter, BlogSpot and others". Archived from the original on 2010-03-28. Retrieved 2018-06-25.
- ↑ "WORM_KOOBFACE". trendmicro.com. Retrieved 3 February 2015.[permanent dead link]
- ↑ "Sophos stops new version of Koobface social networking worm". Naked Security. Retrieved 3 February 2015.
- ↑ The Allure of Social Networking, describes Win32/Koobface affecting multiple social networks as described on CA's Security Advisor Research blog
- ↑ "W32.Koobface.D". symantec.com. Retrieved 3 February 2015.
- ↑ "Intego Security Memo: Trojan Horse OSX/Koobface.A Affects Mac OS X Mac – Koobface Variant Spreads via Facebook, Twitter and More - The Mac Security Blog". The Mac Security Blog. Retrieved 3 February 2015.
- ↑ Web Gang Operating in the Open
- ↑ 16.0 16.1 "The Koobface malware gang – exposed! - Naked Security". Naked Security. Archived from the original on 14 December 2019. Retrieved 3 February 2015.
- ↑ "Facebook credits UAB with stopping international cyber criminals, donates $250,000 to school". AL.com. Retrieved 3 February 2015.
- ↑ Protalinski, Emil (January 17, 2012). "Facebook exposes hackers behind Koobface worm". ZDNet. Retrieved January 20, 2012.
External links
- The Koobface malware gang - exposed! Archived 2019-12-14 at the Wayback Machine, research by Jan Droemer and Dirk Kollberg.
- The Real Face of KOOBFACE, analysis by Trend Micro.
- Researchers Take Down Koobface Servers, Slashdot article.
This article "Koobface2000" is from Wikipedia. The list of its authors can be seen in its historical and/or the page Edithistory:Koobface2000. Articles copied from Draft Namespace on Wikipedia could be seen on the Draft Namespace of Wikipedia and not main one.
