Torpig
Torpig, also known as Anserin or Sinowal is a type of
By November 2008, it was estimated that Torpig had stolen the details of about 500,000
History
Torpig reportedly began development in 2005, evolving from that point to more effectively evade detection by the host system and antivirus software.[2]
In early 2009, a team of security researchers from University of California, Santa Barbara took control of the botnet for ten days. During that time, they extracted an unprecedented amount (over 70 GB) of stolen data and redirected 1.2 million IPs on to their private command and control server. The report[3] goes into great detail about how the botnet operates. During the UCSB research team's ten-day takeover of the botnet, Torpig was able to retrieve login information for 8,310 accounts at 410 different institutions, and 1,660 unique credit and debit card numbers from victims in the U.S. (49%), Italy (12%), Spain (8%), and 40 other countries, including cards from Visa (1,056), MasterCard (447), American Express (81), Maestro (36), and Discover (24).[4]
Operation
Initially, a great deal of Torpig's spread was attributable to
During the main stage of the infection, the malware will upload information from the computer twenty minutes at a time, including financial data like credit card numbers and credentials for banking accounts, as well as e-mail accounts, Windows passwords, FTP credentials, and POP/SMTP accounts.[4]
See also
- Mebroot
- Drive-by download
- Phishing
- Man-in-the-browser
- Conficker a worm that also uses domain name generation (or domain flux)
- Timeline of computer viruses and worms
References
- ^ BBC News: Trojan virus steals bank info
- ^ a b Carnegie Mellon University. "Torpig". Archived from the original on 19 May 2015. Retrieved 25 July 2015.
- ^ UCSB Torpig report
- ^ ZDNet. Archived from the originalon 1 August 2015. Retrieved 1 August 2015.
Further reading
- Taking over the Torpig botnet, IEEE Security & Privacy, Jan/Feb 2011
External links
- UCSB Analysis
- One Sinowal Trojan + One Gang = Hundreds of Thousands of Compromised Accounts by RSA FraudAction Research Lab, October 2008
- Don't be a victim of Sinowal, the super-Trojan by Woody Leonhard, WindowsSecrets.com, November 2008
- Antivirus tools try to remove Sinowal/Mebroot by Woody Leonhard, WindowsSecrets.com, November 2008
- Torpig Botnet Hijacked and Dissected covered on Slashdot, May 2009
- How to Steal a Botnet and What Can Happen When You Do by Richard A. Kemmerer, GoogleTechTalks, September 2009