Close
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Logo
Logo
  • Latest News
  • Artificial Intelligence
  • Big Data and Analytics
  • Cloud
  • Networking
  • Cybersecurity
  • Applications
  • IT Management
  • Storage
  • Sponsored
  • Mobile
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cloud
    • Cloud
    • Cybersecurity
    • Networking

    Cyber-Criminals Targeting Retailers With ‘Nice Pack’ Exploit Kit, SQL Injection

    By
    Fahmida Y. Rashid
    -
    October 13, 2011
    Share
    Facebook
    Twitter
    Linkedin

      Retailers are seeing an uptick in Web attacks driven mainly by malware exploit toolkits as cyber-criminals attempt to steal credit card information, according to Dell SecureWorks.

      Hacking attacks against retail customers were up 43 percent from January to September, Dell SecureWorks said Oct. 10. The Dell SecureWorks Counter Threat Unit stopped 91,500 attackers per retail customer in the first nine months of 2011, compared with 63,581 from April through December 2010.

      The increase was driven primarily by the popularity of Web exploit kits, according to Jon Ramsey, Dell SecureWorks’ CTO. A new kit, Nice Pack, has already compromised over 10,000 Websites, according to the report. When unsuspecting users come to the site, they are silently redirected to a different site that is hosting the exploit kit, which tries to download malware onto the user’s computer.

      “Criminals are more aggressively using the Web as a primary attack vector for both clients and servers,” Ramsey said.

      Nice Pack uses a similar attack sequence as the more well-known Black Hold exploit kit. Attackers use various techniques to compromise Web pages and embed malicious JavaScript on the site. The malicious code is apparently identical to the code that was used in the recent compromise of MySQL.com, which directed users to a site hosting the Black Hole toolkit.

      At this point, Nice Pack attempts to install the ZeroAccess Trojan, which is designed to remain hidden on the infected machine as it gathers confidential information and ships it off to a remote server. ZeroAccess has some rootkit-like capabilities that allow it to remain on the system despite attempts to remove it.

      There has also been a jump in the number of SQL injection attacks against retailers, according to Dell SecureWorks researchers. These attacks involve the malicious perpetrator inserting database commands in a textbox or a form on the Website and tricking the system into executing the commands when submitted.

      Just this past spring, Rogelio Hackett Jr. pleaded guilty to using SQL injection attacks to steal account information on 675,000 credit cards and racking up over $36 million in fraudulent transactions.

      Organizations need to make sure they are keeping up with the latest patches for all servers, desktops and software as many of the exploit packs take advantage of older vulnerabilities that have not been closed.

      Old-Fashioned Methods Still in Use

      Scammers and identity thieves aren’t just using Web attacks to steal personal information and credit card data, however. The old-fashioned physical methods are still alive and well.

      Law enforcement authorities in New York arrested more than 100 people accused of participating in an identity theft scam that generated $13 million, according to an Oct. 7 statement from the District Attorney for Queens. The arrested individuals are accused of stealing financial information from consumers in the United States and Europe over a 16-month period. The data was used to forge credit cards, which were then used to buy designer handbags, game consoles and jewelry. The luxury items were fenced online and turned back into cash for scammers.

      The scammers relied on insiders within financial and retail businesses, including bank tellers, store employees and restaurant workers, to steal information, according to the statement.

      Operation Swiper dates back to October 2009 and involved physical surveillance and electronic wiretapping of at least five ringleaders, who are accused of taking the stolen identity information and working with an underground credit card manufacturer to produce forgeries.

      Once stolen, criminals can use the credit card information to make fraudulent purchases or just resell the data to other criminals on underground forums, according to Imperva. Complete credit card information with names, addresses, email addresses, expiration dates and dates of birth are available for sale. An American Visa card is available for as little as $2, according to Imperva.

      Fahmida Y. Rashid
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.
      Get the Free Newsletter!
      Subscribe to Daily Tech Insider for top news, trends & analysis
      This email address is invalid.

      MOST POPULAR ARTICLES

      Latest News

      Zeus Kerravala on Networking: Multicloud, 5G, and...

      James Maguire - December 16, 2022 0
      I spoke with Zeus Kerravala, industry analyst at ZK Research, about the rapid changes in enterprise networking, as tech advances and digital transformation prompt...
      Read more
      Applications

      Datadog President Amit Agarwal on Trends in...

      James Maguire - November 11, 2022 0
      I spoke with Amit Agarwal, President of Datadog, about infrastructure observability, from current trends to key challenges to the future of this rapidly growing...
      Read more
      Applications

      Kyndryl’s Nicolas Sekkaki on Handling AI and...

      James Maguire - November 9, 2022 0
      I spoke with Nicolas Sekkaki, Group Practice Leader for Applications, Data and AI at Kyndryl, about how companies can boost both their AI and...
      Read more
      Cloud

      IGEL CEO Jed Ayres on Edge and...

      James Maguire - June 14, 2022 0
      I spoke with Jed Ayres, CEO of IGEL, about the endpoint sector, and an open source OS for the cloud; we also spoke about...
      Read more
      IT Management

      Intuit’s Nhung Ho on AI for the...

      James Maguire - May 13, 2022 0
      I spoke with Nhung Ho, Vice President of AI at Intuit, about adoption of AI in the small and medium-sized business market, and how...
      Read more
      Logo

      eWeek has the latest technology news and analysis, buying guides, and product reviews for IT professionals and technology buyers. The site’s focus is on innovative solutions and covering in-depth technical content. eWeek stays on the cutting edge of technology news and IT trends through interviews and expert analysis. Gain insight from top innovators and thought leaders in the fields of IT, business, enterprise software, startups, and more.

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Advertisers

      Advertise with TechnologyAdvice on eWeek and our other IT-focused platforms.

      Advertise with Us

      Menu

      • About eWeek
      • Subscribe to our Newsletter
      • Latest News

      Our Brands

      • Privacy Policy
      • Terms
      • About
      • Contact
      • Advertise
      • Sitemap
      • California – Do Not Sell My Information

      Property of TechnologyAdvice.
      © 2022 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×