Database logins: How much would you pay?

Database logins: How much would you pay?

Malicious code rarely lubricates your date is interested in rather interesting information. The rise of malware is targeting the theft of credentials, a valued and popular item.

Facebook is very often associated with potential threats to privacy, in which users cannot protect themselves, and such that goes purely on their account. As we recently informed you of the current privacy was ‘Trusteer’ Research discovered the so-called "Factory Outlet" which offers a large stolen account not just within Facebook, but Twitter. Furthermore, this database also contains access information for cPanel accounts - one of the popular administration interfaces.
Trusteer Research correctly points out that a specially prepared malicious code, which is focused on mining money, can effectively attack the sites offering Internet banking services. Together with the course on the infected computer can also collect additional credentials and that this step is often the beginning of the chain store login information with databases that are not only still negotiable, but also independently exploitable.
How did both beginners and advanced users can catch, and become part of a network of infected computers that secretly collect login information? A typical example of a very famous example, Zeus: a Trojan horse, which in recent years suffered a lot of unsuspecting people. Zeus Trojan makers have chosen this type of malware deliberately, since their risk of spread through reports and programs, which at first glance do other activities. Zeus was first identified in the fake phishing links and links to legitimate downloads like software, in mid-2007. Since then, there has been a large botnet, which is now estimated to contain millions of compromised computers.
Interestingly passwords robber named Zeus is able to be adapted. The corresponding source code is in May last year, escaped and malware creators so it can adapt according to their needs. That imaginary symbolizing the Holy Grail in the theft of sensitive information through a few modifications to the original malware can modify shields advanced to run on virtually any Web service that requires registration through classical forms. In addition, Zeus can be combined with it and buy, for example, according to Wikipedia, the price on underground forums ranging from $ 700 to $ 15 000 depending on the version and its amenities.

Botnets have a large share of all "events", especially for spam. Many brought joy in history such as Rustock shutdown.

Which version for how much?

At the beginning of the realization of user credentials to obtain adequate information, typically according to the scenario that was described in the operating principle of Zeus malware. Once that the corresponding database was built, comes the most important step: how to monetize. It provided a concrete example of current, the above cited report Trusteer Research. Attackers offer credentials to Facebook, Twitter and other services, which include users from all over the world.
With a little exaggeration, illegal trade in databases reminds sale of any other item. Would you like basic equipment in the form of user credentials by services? Or, according to a specific subset of the selected geographic area? Or you previously embodied as an extension of the associated e-mail addresses? Exactly this is the offer of the options currently available comprehensive database, while sellers do not disclose the number of infected machines, but boasts 80 gigabytes of data availability to individual users stolen.
Published information which is now under the current analysis briskly traded represents login to cPanel administration interface that is used to manage your hosted websites. The attackers after the construction of the necessary databases are sold as a pair of addresses of the pages and credentials. Then, if someone receives this information through full access to the administration, for example, can modify the configuration so that the site will serve as a source of malware or convey any other risk.
Sometimes it is surprising those similar offers of trades and the resulting end mass arrests and other sanctions against individual cybercriminals who offered information are apparently illegally stolen. The identity of the most hidden of course, for example, if this published by Trusteer Research was listed as a contact within the account and the opportunity to reach JabberID via ICQ. This is a specific standard payment options and their limitations.

Protection as any other time

Time enough has already demonstrated that botnets could just be the most problematic, due to a silent threat. Their creators may not work "only" about stealing passwords, send spam or mass attacks, led by example with a DDoS, but offers them the possibility of renting systematically follows the established networks - if someone wants to send more spam or denial of services to kill off competition, turns are all questions only to the price. Once the botnet is already built and gradually thanks to the original long-malware collects user data access, you can trade with those databases to make immediate money

The basis of the defense would be like in the case of other threats should be avoidance of botnets, which then can be used for anything, and therefore the end users. Ironically so, defending their privacy, since botnet later stolen login information can be to them. On the other hand it is now another trend: users often voluntarily participate in botnets, currently organized mainly in the case of DDoS attacks. Bot-nets can have two faces, depending on who is what he expects from them and which way to get potential victims.
So, how can the theft of passwords and other attacks from botnets are prevented? First of all, users and network administrators should take care of avoiding becoming part of it - in case Trojans and other ways to enslave another computer, can in most cases provide protection regularly, updated and properly configured antivirus. The computers will form part of a network worm botnet and provide comprehensive defense solutions and regularly patched system. Theft of passwords and botnets are just lingering attackers will want to earn more, and so unnecessarily facilitates them. 

 

Facebook opened Timeline (activities in the Open Graph) and few other services

In September last year, Facebook announced the extension of the Open Graph "activity" which appeared first time only with a few selected partners. On Thursday, 19  in January this functionality unlocked for dozens of other services and new recruits gradually activated. What "activities" in the timeline mean?

In September 2011 Facebook announced the expansion of Open Graph interface of the possibility of adding another "activity" (action).Compared far as present classical and "I" or "Recommend" has appeared in Open Graph option such as "listening" or "read" Facebook and promised that the possibilities of activities will be sequenced according to the interest spread. Part of the new Open Graph was the possibility that the application (web services) through activities gained access to the Timeline (profile) of the user. And along with that as well as his friends, who each record to see Timeline (real time) in the Ticker - things of that impractical, located in the right column on Facebook.

In 19th January, Facebook announced that the new Open Graph "can" use the other sixty applications and services and those interested in the use (and possible expansion of activities and options) may apply and Facebook is going to approve. In practice it works for example, that you have an account on Pinterest.com  - in the account settings you activate the integration with Facebook and new opportunities for access to the Timeline (you have to go through the approval process of applications, as has been customary so far). And from this moment your every activity on Pinterest.com reflected in your account on Facebook. Must add that reflected every activity  - reflected, for example, that you started watching someone or added to your Pinterest a new image.

In a similar way it works Spotify.com example - when activated, every time you listen to music transmitted information "Listened and this song" on Facbeook record and will appear in your profile, and also in the ticker. The difference compared to normal now "Like" (Do) is that the record is not on Facebook need to click on any "like", but just do some activity on the Web (in), which sends information about this on your Facebook.

Information in your Timeline, you can manually re-edit - you can completely hide a particular application, as well as you can delete it (and report spam when it exceeds the limits). Every single activity in the attached application so you can edit - delete, set the visibility, prevent the further possibilities of publishing applications, or directly delete the application.

Automatic sharing unconscious, "frictionless sharing"

It is quite interesting to see how the "sharing" of information (about what we do on the Internet) develops.

·         At the very beginning was to share to Facebook only way that you copied the web address manually and inserted on Facebook

·         Appeared Like / Do, web element that "one" click sharing enabled. Like there was a moment / I and Share / Share with a slight difference in the "volume" of shared information

·         Share / Share was repealed and Like / Do has evolved into a full share on Facebook, but still had to click, though it really enough for a single click

·         New Timeline and activities in the Open Graph share on Facebook, without your knowledge, or without doing anything for it. Just for example, read (open) article and learn about all your friends instantly

In practice, new applications only need to obtain your consent to access your profile on Facebook and then automatically inform just about everything you do in your application.Newspaper Web sites about the articles you read, listened to music sites for music, YouTube could inform about each video, which you look. E-shop for all goods whose details you have viewed and what you bought. Foursquare on every place to which you subscribe to, or, even more alarming in that case, every place where you just were, without you ever having to log in to place.

With hindsight it would appear so that users no longer rule will have no idea to whom applications (sites) allowed access to the Timeline and profile on Facebook so will carry information about what they are doing on the Internet. Probably they will not even bother, that is until the moment when one of their friends know that look (for example) on a somewhat socially inappropriate video. Or when a girl suddenly starts to read a series of articles on pregnancy or abortion. Do not realize that their web activity somewhere transmitted, recorded and published.

"Oversharing" and the question of privacy

In connection with the new possibilities of applications on Facebook (new Open Graph and activities and put in some of its Zynga games) appears the term "oversharing" - captures the essence. We share that more and more to so much that is too much. While up until last year was to be shared on Facebook to do something, a new concept just simply surf the web. Just visit Yahoo News, and while you read. Everything you read, in real time appears on your Facebook. Directly to Yahoo Moreover, you can see what they have read (and maybe even just reading) your friends - Yahoo will show something like this automatically, you do not need to add any friends.

For Facebook and other companies is a record of your activities important for your friends is debatable. In particular, if in this way on his Facebook "will join" more websites (applications) and you'll be any more intensive use. To actually create a flood of entries on Facebook (in the Timeline and Ticker) and your friends will eventually just annoying. Facebook it addresses the fact that records do not go directly into your timeline as individual statuses (contributions) - instead of their own position and combine into a single record. "Oversharing" is indeed so, although in many cases will take place, but the influence of your friends will be considerably smaller than it appears at first glance.

Few of those who can activate the automatic unconscious sharing, but it solves, if you can have an impact on privacy. The answer is simple, of course it can. I've suggested for instance the example of a young girl who suddenly begins to read articles about abortion when it is considered something that now does not want to deal with his or her parents or the originator of the problem. Let alone communicate it to all my friends. The problem is that when filling the Timeline articles in question it will be too late.

Automatic sharing what you do on the Web, of course, will have long term consequences affecting privacy - Facebook and many other companies you get a huge stock of information.While previously only knew of Facebook articles and pages that you liked (intentionally and knowingly clicked on like now) will know all about your habits on sites that allow this functionality. For each article read, watch the video, listened to the song, seen or purchased goods. And since Facebook to get this information to anyone. Without illusion, Facebook does not protect user data and protect never will be. If you sell it, sooner or later appears more and more security flaws that make this data to unauthorized eyes.

Facebook, by the way, the data about your behavior on the sites is a long time. Since he has been there Like / like element, collects detailed information about what web addresses you visit.Once on them Like / like, your visit is stored in the database Facebook. The only thing still missing is the understanding of what actually constitutes the visit. With the change to a specific activity like this will already know Facebook, dates of visits and the use of foreign sites it will remain.

Why do these sites do?

They do it because it gives them additional content distribution. Like / Do is an extremely beneficial addition to most websites - can get more visibility by someone, "something" on his Facebook shares and it shall deliver his friends. Today it is common for traffic from social networks are more than 30% of arrivals to the web. A new timeline with activities offers further strengthen this mechanism.

Moreover, Facebook Open Graph and wants to expand its capabilities even more - you now can with its help the company reach your friends, find out what you have in common, adjust accordingly offer to use historical data to determine what exactly would you be interested. And the more data will be in the Open Graph databases are available, the better it will be possible for them to get needed information. And with Facebook that will be easier, it will be the date of Facebook who stores, processes, allowing them to perform the queries. A simple, efficient and inexpensive manner.

Which sites / services currently support the news recently?

·         Travel - Gogobot, Airbnb, TripAdvisor, Wipolo, Where I've Been

·         Food - Foodspotting, Cookpad, Snooth (wine), Urbanspoon, Yummly, Foodily

·         Shopping and Fashion - Pose, Pinterest, Polyvore, Oodle, Fab.com, eBay, Giftrocket, Payvment, Livingsocial

·         Health - MapMyRun, Runkeeper

·         Entertainment - Rotten Tomatoes, Dailymotion, Cinemur, Metacafe, Ford (game), Wooga (Bubble Island, Diamond Dash), OMGPOP (Draw My Thing), Zynga (Words with Friends, Castleville)

·         Charity - Causes, Fundrazr, Artez.com

·         Other - BranchOut, Monster, Color, Courserank, Grockit, Foursquare, Goodreads, Kobo, StubHub, Ticketmaster, Ticketfly, ScoreBig, Appsfire, Artfinder, AutoTrader

What you share about the new Facebook should remember

New access to your Timeline (Facebook profile) requires a single initial approval "applications" and it's specific behavior depends on the application. How much will it share and whether it will be possible to share control, things are not Facebook.

Everything will be shared by applications, it will be visible to everyone and will appear in the list of messages / posts (in some cases), ticker, and Timeline in the "transparent" form. It can affect just back and see that all your friends. If you want to affect visibility, the best you succeed through friend lists (Lists), and visibility settings for specific lists only, preferably when a certain application, approve access.

    

Automatic sharing of this kind do not use it, it's something that is needed in advance and consciously allow. If at a later time you want to get rid of it can be difficult mainly because the removal of applications on Facebook are drowned deep in the menu. And on a particular site may not be easy to get to set the properties, let alone to remove the link.

Anything you've already been shared, Facebook knows and never removed. Although it can from its Timeline "delete", Facebook has already received the data and delete it certainly will not. Only cease to be visible.