Spyware Researchers Discover ID Theft Ring

Spyware researchers picking apart one of the more notorious spyware programs have stumbled upon what appears to be a massive identity theft ring hijacking confidential data from millions of infected computers.

Sunbelt Software Inc., makers of the enterprise-grade CounterSpy spyware protection product, made the discovery during an audit of "CoolWebSearch," a program that routinely hijacks Web searchers, browser home pages and other Internet Explorer settings.

During the research, Sunbelt researcher Patrick Jordan deliberately installed the "CoolWebSearch" application on a machine and immediately noticed that the infected system became a spam zombie that was placing callbacks to a remote server.

When Jordan visited the remote server, he was shocked to find that it was being used to distribute sensitive personal information from millions of PC users infected by the spyware application.

"We found the keylogger transcript files that are being uploaded to the servers. We're talking real spyware stuff…chat sessions, usernames, passwords, bank account information, full names, addresses," said Sunbelt president Alex Eckelberry.

In an interview with Ziff Davis Internet News, Eckelberry said the sophistication of the operation suggests it's the work of a "massive identity theft ring" that used keystroke loggers to grab confidential information that could be used to create fake online identities.

"I'm not being dramatic. This is the most repulsive thing I've ever seen. It's very painful to see what's in these log files that are being uploaded in real time. We're seeing a lot of bank information and usernames and passwords to get in," Eckelberry said.

He said the log files included logins to one business bank account with more than $350,000 and another small company in California with over $11,000, readily accessible.

"There are lots of eBay account information and names and addresses of the people owning those accounts. Names, passwords, all matched up," Eckelberry added.

He said the server, which is hosted out of a data center in Texas, was effectively a "massive repository of stolen data" that was being replenished in real time.

"As the [log] file gets to a certain size, it gets taken down and a new file starts generating. This goes on nonstop. We've been watching it for a few days while trying to get to the FBI, and it just keeps growing and growing."

While the site is being hosted in the United States, Eckelberry said the domain name is registered to an offshore company.

Eckelberry said the huge size of the log files is a clear indication that thousands of machines are pinging back daily.

In some cases, where users appeared to be at immediate risk of losing a considerable amount of money, Sunbelt has contacted the affected individuals.

Eckelberry said the "CoolWebSearch" payload included a typical adware download that immediately scanned the infected machine for e-mails to use for spam runs. It then sets up a "very intelligent keylogger" that looks for very specific information.

"This won't get caught by a typical anti-spyware application," he said, noting that the keystroke logger was able to pick up identity-related data for delivery to the remote server.

Anti-virus vendor Trend Micro Inc. provides a free online scanning tool that detects and deletes the "CoolWebSearch" application.

The tool is available for the Microsoft Windows XP, Windows 2000, Windows Millenium Edition and Windows 98 operating systems.

Identity Theft - What To Do Next

You'll never hear the end of it if you decide to press charges. And besides you're not even sure you really want to do that. They might pay you back the money. Not. The burden is on you to sort this mess out and the worst part is once a relative or friend steals your identity, it's almost impossible to trust them again.

We hear about the high profile cases of hackers breaking into the databases of Lexis Nexus or DSW Shoe warehouse, yet most instances of identity theft never make the news. Usually it's something basic like a neighbor stealing a credit card application from your mailbox or a relative going thru your personal belongings

In the Better Business Bureau's 2005 Fraud Survey report they found relatives, close friends and neighbors make up 50 percent of all identity thieves. They also cost you more time and money trying to fix the problem. Javelin Research calculates that the average cost to identity theft victims is $15,607 when the perpetrator is known.

But even that figure is misleading. Many children are falling victim to identity theft (a half million last year according to the Federal Trade Commission) which means the full impact of the damage may not be known until years later when as adults they apply for credit.

For some parents, stealing their child's identity is a stop gap solution. Their own credit is destroyed, so "borrowing" their child's social security number becomes a necessity. All the while, they assure themselves the money will be paid back. Yet the same pattern that destroyed the parent's credit, now puts a negative on the child.

It doesn't matter if the thief is a parent, sibling or best friend, the process of recovering your identity is a tough one and it gets more complicated. Should you report the crime?

"Frequently when we would break up a ring and get a list of victims and find family members were involved in the crime, relatives are very reluctant to co-operate" says Ken Hunter, former Chief Postal Inspector and current president of the Council of Better Business Bureaus.

According to a study done by Gartner, Inc., the chances of an identity thief getting prosecuted are 1 in 700. However, when a relative is the culprit those odds go through the roof. The attitude understandably becomes, "Yes, they did me wrong but I can't send them to jail."

Ken Hunter: "If it's a matter of pilferage at a very low level, nothing much is really going to happen to that person."

On the other hand, if your identity is used to commit crimes on a higher scale, by all means report it to the authorities. You may feel guilty and make a lot of people angry in the process. Families get torn apart because relatives feel the matter should stay private.

It's a tough decision, but remember, this is your good name the identity thief destroyed, not your relatives and it's you who may be wanted for a crime, not them.

Credits:
Daryl Campbell is a writer and home business owner. In minutes, a thief can steal your identity. Within a few hours, they can destroy your good name. It can take years to recover. Could it can happen to you? Watch this movie => http://digbig.com/4dwsx