Spyware, viruses, & security forum: NEWS - March 30, 2012

VISA and MasterCard are alerting banks across the country about a recent major breach at a U.S.-based credit card processor. Sources in the financial sector are calling the breach "massive," and say it may involve more than 10 million compromised card numbers.

In separate non-public alerts sent late last week, VISA and MasterCard began warning banks about specific cards that may have been compromised. The card associations stated that the breached credit card processor was compromised between Jan. 21, 2012 and Feb. 25, 2012. The alerts also said that full Track 1 and Track 2 data was taken - meaning that the information could be used to counterfeit new cards.

Neither VISA nor MasterCard have said which U.S.-based processor was the source of the breach. But affected banks are now starting to analyze transaction data on the compromised cards, in hopes of finding a common point of purchase. Sources at two different major financial institutions said the transactions that most of the cards they analyzed seem to have in common are that they were used in parking garages in and around the New York City area.

Continued : http://krebsonsecurity.com/2012/03/mastercard-visa-warn-of-processor-breach/#more-14393

The Draw Something game is a soaraway success, with hundreds of millions of downloads onto iPhone and Android smartphones since it was launched early last month.

Everyone's talking about it, and the hype became even huger when OMGPop, the New York software house that created the app, was sold for a cool $210 million to gaming goliath Zynga.

But with so much buzz and interest in the Pictionary-style game, it's perhaps not a surprise to find scammers trying to make a quick buck by leaping on the bandwagon.

Here's a Twitter account we found, that's spamming users telling them that they have won a prize. [Screenshot]

From what we have seen, the account appears to be targeting Twitter users who have mentioned "Draw Something" in past tweets.

The Twitter account, which is not affiliated with OMGPop, claims it is giving away 5000 prizes to "lucky" Draw Something fans, and that players can claim their award by visiting a newly-created website called drawsomethingwinner.com.

If you visit the site you are asked a few simple questions, before being told that you are eligible to receive an award. [Screenshot]

Continued : http://nakedsecurity.sophos.com/2012/03/29/draw-something-scam-targets-twitter-players/

"But VX Heavens probably didn't pose much of a threat in the current cybercrime landscape"

Ukrainian authorities have shut down a long-running forum that was used to trade tips on writing malicious software, a sign the country's law enforcement may be watching hackers more closely.

Administrators for the forum, VX Heavens, wrote that its servers were seized on March 23 for allegedly creating and intending to sell malicious software programs, a violation of Ukraine's criminal code. The website called the accusation "absurd" but said it couldn't offer services with the pending court case.

VX Heavens might have been easy pickings for Ukraine, which has been noted by computer security experts as being a hotbed of cybercrime.

Graham Cluley, senior technology consultant for security vendor Sophos, wrote that VX Heavens operated for many years, hosting virus-writing tutorials and malicious code samples. But the site is likely just a small player in an expansive cybercriminal underground.

"The folks using the VX Heavens website were probably not in the same league as the financially-motivated organized criminals computer users are often troubled by today, and mirror rather more the hobbyist malware authors of yesteryear," Cluley wrote.

Continued : http://www.computerworld.com/s/article/9225693/Ukraine_shuts_down_forum_for_malware_writers

"A gang of British cyber criminals has been jailed for cheating iTunes and Amazon out of up to £1m"

The final three members of an 11-strong gang that scammed iTunes and Amazon out of £500,000 worth of royalty payments have been charged with fraud and money laundering by Southwark Crown Court.

Craig Anderson, Arran Jassi and Lamar Johnson all pleaded guilty to conspiracy to commit fraud, after using three online music management companies to upload UK-produced urban music albums and tracks for sale on Apple iTunes and Amazon.com.

The principal organiser, Craig Anderson, then reportedly acquired thousands of compromised US and UK credit cards, which then used by a number of individuals to make over 500,000 online purchases of the music.

Anderson has been sentenced to 4 years 8 months imprisonment. Jassi and Johnson were both given 8 months, but Jassi's sentence has been suspended.

Continued : http://news.techworld.com/security/3348248/itunes-amazon-fraudsters-get-prison-sentences/

Also: iTunes scam gang netted 'Madonna-level' royalties

From the CircleID Blog:

Takedown

One fine night in November 2011 I got an opportunity to get my hands dirty, working on a project for the United States Federal Bureau of Investigation (FBI). They were planning to seize a bunch of computing assets in New York City that were being used as part of a criminal empire that we called "DNS Changer" since that was the name of the software this gang used to infect a half million or so computers. I work for Internet Systems Consortium (ISC), a small non-profit company headquartered in California. ISC is best known for our work on the Domain Name System (DNS) and our DNS software (called BIND), but we have a growing Internet security practice as well. My task that night in New York City was to install two replacement DNS servers supplied and operated by ISC. This was important because the victims of DNS Changer were dependent on the assets that the FBI needed for evidence, and none of us wanted a half a million DNS Changer victims to "go dark." It was a little odd for ISC to send me — ISC's Chairman and Founder — on this job, but rank hath its privileges.

It was a very long night, since there was no way to complete a detailed plan before the takedown began. After the DNS Changer gang was in custody and I could "go intrusive" on their equipment, it took me a couple of hours to figure out exactly how everything was wired together and to move the first group of victims over to ISC's replacement DNS servers. It then took a couple more hours to move and test the rest of the victims. All this long night I had a cell phone headset in one ear and a half dozen chat windows open on my laptop — the full takedown team was worldwide and there were other actions occurring elsewhere. By the time we were done and it was safe to power off the DNS Changer equipment, it was 7am and I nearly missed my train. Note to self, if another chance comes along to run — huffing and puffing — through the New York City subway system and Penn Station, trying to keep up with a younger and better conditioned member of FBI's New York division — take it! But maybe next time bring better shoes.

Cleanup

Continued : http://www.circleid.com/posts/20120327_dns_changer/

Thanks! to R. Proffitt.