Identity thieves that hit Facebook last week with a new round of phishing attacks are harvesting passwords for profit, a security researcher said today.

“It’s not surprising that they’re targeting Facebook,” said Kevin Haley, a director on Symantec’s security response team. “Facebook has, what, 200 million-plus users? The bad guys always go where’s there’s a lot of people.”

The newest Facebook attacks resemble previous phishing rounds in their tactics: A compromised account sends a malicious link to friends. That link leads to a site that mimics the legitimate log-in page. But users duped into entering their usernames and passwords are likely giving away more than just their Facebook credentials, said Haley.
“Certainly this isn’t new,” he said, “but we think that what you’re seeing is an attempt to shake out every last dollar they can get.”

The criminals are operating on the assumption that the Facebook password they acquire from any given user has a good chance of being the same password that person uses on other sites, such as online shopping services or even bank accounts.

“Get one password for the right person and it’s like having their wallet handed over,” Symantec researcher Marian Merritt in the post to Symantec’s security response blog said on Friday.

Although Symantec has no statistics on the percentage of users who rely on just a single password for multiple online services or activities — Haley called the evidence “anecdotal” — it’s an assumption that both criminals and researchers make. “When you talk to users, that’s what they tell you they do,” he said.

Facebook has acknowledged the attack, and said it has reset passwords of compromised accounts and eliminated the phishing messages when it has found them.

“It’s not like this is some great new virus technology,” Haley said, noting that the newest attacks are unlike worm-based attempts to infect Facebook accounts with the Koobface worm. This is straight con job. “Cons have been known from the beginning of time,” Haley continued. “But now we’re seeing them coming a little faster and more furious.”

The problem with social sites like Facebook is that they portray a certain level of trust — others are “friends,” after all, Haley added — and while users’ may be wary of clicking on links delivered via traditional e-mail, they haven’t yet made the same connection to social networking.

“People are very wary of e-mail [phishing attacks]. They’ve begun to catch on,” said Haley. “But they don’t have their antenna up when it comes to social networking.”

Symantec’s Merritt urged users to use more caution before clicking on links, to double-check the site’s URL and to use more, and more complex, passwords.

But Haley is pessimistic that the advice would sink in anytime soon. “It’s a progression,” he said, referring to the learning curve users go through before they realize they need to take care of their identities in a new online technology or type of service.

Even then, it’s a never-ending fight. “If there’s a way to figure out a new way to attack, the bad guys will do it,” Haley concluded.

A computer virus that has been spreading around the world for months is set to come alive Wednesday.

Experts have struggled to tackle it, and they do not know who controls it or why it was created. But on Wednesday the virus, dubbed Conficker, will “call home” to its creator to seek new instructions. No one knows what will happen next.

“The biggest mystery about Conficker is why? What exactly is it that these bad guys are planning to do with it?” said Mikko Hypponen of the Finnish computer security company F-Secure.

In the past year, the virus has spread to computers in schools, hospitals and government departments. It has got into the defense forces of Britain, Germany and France, grounding the French Navy’s fighter jets for a time.

Microsoft has offered $250,000 for information about Conficker’s creator. An alliance of leading computer security experts and Internet governance groups has been set up to help to deal with the problem.

Nearly 20 technology companies and organizations are combining forces to disrupt the command-and-control infrastructure of the rapidly spreading Downadup worm, prompted by infection rates of nearly 2.2 million machines each day.

Firms, including Microsoft Corp., Symantec Corp. and VeriSign Inc., have joined ICANN, the nonprofit group that manages the Internet Domain Name System, to preemptively register and remove from circulation the Internet addresses that the worm’s controllers use to maintain their hold on infected machines, said Gerry Egan, director of product management in Symantec’s security response group.

Separately, Microsoft has offered a $250,000 reward for information that results in the arrest and conviction of the hackers who created and launched the worm.

Although Microsoft launched its hacker bounty program in 2003, it has rarely used the $5 million it set aside at the time. The last time it offered a reward was in 2004, when it posted a quarter-million-dollar bounty on the maker of the Sasser worm. A German teenager was arrested in May 2004 and charged with creating Sasser. The following year, Microsoft paid out the reward to two people who helped identify the hacker.

Perhaps not coincidentally, security researchers — including those at Symantec — have recently drawn comparisons between Sasser and Downadup, which also goes by the name “Conficker.” Much of those comparisons relate to the size of the current attack, as well as the fact that the worm targets a wide-scale Microsoft vulnerability.

To stymie Downadup, the coalition plans to either pre-register or remove from circulation as many of the 250 different domains that the worm uses as possible, said Egan. “We’re working with the domain registrars to take them out,” he said. “It’s a combination of registering the domains and removing them from circulation.”

Once it has infected a PC, Downadup generates a list of 250 possible domains — the list changes daily — selects one, then uses that URL to reach a malicious server from which it downloads additional malware to install on the hijacked computer. Symantec and other security vendors, including Helsinki, Finland-based F-Secure Corp., have been preemptively registering some of those domains for weeks. They have then monitored the domains to get an idea of the worm’s back-end processes and to track its spread.
Symantec has used that approach to gauge the current strength of the worm. According to Egan, over the last five days, Symantec has monitored an average of 453,000 different IP addresses infected a day with Downadup.a, the original November version, and 1.74 million more IP addresses infected a day with Downadup.b, the more virulent variant that debuted in late December 2008.

Together, the two versions have infected an average of nearly 2.2 million PCs daily.

Egan declined to say whether the group would be able to completely disable the worm’s control mechanism, but said the consortium’s formation does not mean that researchers have new information about what malicious tasks the infected PCs might be told to perform. “We have no indication of its purpose as of yet,” he said.

Even so, Symantec sounded worried.

“The millions of systems infected by Downadup pose a risk to Internet users as well as to the infrastructure of the Internet,” the company said in a long post to its security blog. “Under the control of attackers, the millions of infected systems could be used to launch distributed denial-of-service attacks against specific users or organizations, crippling their ability to function on the Internet. Additionally, the infected systems could be used to deploy further threats, such as seeding a new worm that targets a more recent or undisclosed vulnerability.”

Last month, Microsoft refreshed its Malicious Software Removal Tool (MSRT), an anti-malware utility that cleans infected Windows PCs, with a signature for Downadup. Microsoft rarely reacts with a new MSRT signature as fast as it did in January.

The company has not responded to a questions about how many PCs the MSRT has scrubbed of Downadup.

While Downadup uses several attack strategies — including using USB storage devices, such as flash drives, to spread — one of its primary infection vectors is by exploiting a Microsoft vulnerability that the company patched with an “out-of-cycle” update in late October 2008.

Security researchers report that the number of machines infected by the Downadup worm has skyrocketed from roughly 2.4 million to over 8.9 million in the last four days alone.

Downadup is a malicious worm that uses computer or network resources to make complete copies of itself. And it may also include code or other malware that damages both a computer and network. The worm also goes by the names “Kido” and “Conflicker.”

Once executed, Downadup disables a number of system services, including Windows Automatic Update, Windows Security Center, Windows Defender, and Windows Error Reporting. The worm then connects to a malicious server, where it downloads additional malware to install on the infected computer.

Name :  Worm:W32/Downadup.AL
Detection Names :  Net-Worm.Win32.Kido
Worm:W32/Downadup.AL

Aliases :  Worm:Win32/Conficker (Microsoft)
W32/Conficker.worm.gen (Symantec)
Mal/Conficker (Sophos)

Type: Worm
Category: Malware
Platform: W32