Torpig botnet – 70GB of stolen data in 10 days

credit-cardA research team from the University of California at Santa Barbara provide a fascinating insight into the Torpig botnet. The researchers managed to infiltrate the network and in effect grab a hold of the botnet itself and monitor just what was happening. The botnet was built using a MBR (master boot record) rootkit that executes at boot time, before the operating system is loaded. Once a machine is infected, the malware harvests and uploads data in 20-minute increments.  The stolen data includes e-mail accounts, Windows passwords, FTP credentials and POP/SMTP accounts.

Over a ten day period, the researchers were able to collect 70GB of stolen data. During this time Torpig stole more than 8300 credentials. They also managed to bag some 1660 unique credit and debit cards. Interestingly, one victim, an agent for an at-home, distributed call center, transmitted no fewer than 30 credit card numbers, presumably belonging to customers. This gives food for thought for those companies using this sort of working model -  they need to better secure these remote data collections end-points.

The full write can be found at the University of California at Santa Barbara Torpig Botnet site.

May 5, 2009 | Filed Under Security 

comments

Leave a Reply