Microsoft’s June security updates were bad news for online criminals who make their living stealing password information from online gamers.
The company’s Malicious Software Removal Tool (MSRT) – a program that detects and removes viruses and other undesirable programs from Windows machines – zapped game password-stealing software from more than 2 million PCs in the first week after it was updated to detect these programs on June 10.
One password stealer, called Taterf, was detected on 700,000 computers in the first day after the update. That’s twice as many infections as were spotted during the entire month after Microsoft began detecting the notorious Storm Worm malware last September.
“These are ridiculous numbers of infections my friends, absolutely mind-boggling,” wrote Matt McCormack, a spokesman with Microsoft’s Malware Response Center, in a Friday blog posting.
Between June 10 and June 17, Microsoft removed Taterf from about 1.3 million machines, he said.
June’s updates, McCormack noted, are “very significant” for gamers, given the variety of password stealers directly targeting Online games.
“The main targets are mostly based in Eastern Asia (Lineage Online, Legend Of Mir, ZT Online just to name a few), but World of Warcraft and Valve’s Steam client are high on the hit-list too.”
And main password purloining program is Win32/Taterf.
Taterf’s spread over the past few months has been fast and furious, and the family of works constituted more than 80 per cent of the April and May Wildlists.
According to McCormack, the worm itself is a mutation of Win32/Frethog, being based off the same source code.
But he noted that Frethog is just a “drop in the ocean of malware” we’re seeing coming out of China nowadays, many of which are targeting online games.
What are these diabolical programs do?
Taterf, Frethog and their ilk are designed to steal your online game login details, the McCormack said.
“The methods they use vary: from injecting into game clients and reading memory directly, to basic keylogging – but the end result is the same… u get pwned. Once they have your details, they are sent back to a remote location and are eventually sold to the highest bidder. After that, you may find your gold gone and toon naked upon your next login!.”
Taterf spreads by copying itself to the root of all fixed or removable drives on the infected system and ensures it gets executed by creating an ‘autorun.inf’ file in there too.
The autorun.inf file is instructed to execute the worm, whenever the directory is viewed using Windows Explorer.
As McCormack puts it: “It’s a pretty simple method but is very effective.”
And it’s a strategy that’s gathering momentum, he cautioned.
“Oddly enough, we used to see Worms using this method here and there a few years ago, but it never really caught on.
[Today], however it is much more effective; every time someone plugs a USB drive in a computer – infected, every time someone puts that drive into a computer connected to a network – infected, and so on. If you’ve mapped an infected drive over the network, that’ll do it too. It’s today’s version of the old boot sector virus.”
The good news, the Microsoft spokesperson said, is that MSRT has had pretty phenomenal success in obliterating Taterf from user PCs.
“After its first day in MSRT, Taterf components had been removed from over 700,000 machines!”
He contrasted that with Win32/Nuwar (aka ‘Storm worm’) – which was removed from less than half that number of machines – in an entire month.
Microsoft’s September detections seriously hobbled the Storm Worm botnet, once considered a top Internet threat.
Password stealers such as Taterf are among the most common types of malicious software on the Internet. That’s because there’s big money to be made selling the virtual currencies used in online games for real-world cash.
Once a criminal learns a gamer’s username and password, he can log into the game and sell the victim’s virtual possessions for virtual gold coins.
Those coins are then handed to another character in the game who sells the gold for real-world dollars at an online exchange such as IGE, said Greg Hoglund, CEO of HBGary and a co-author of the book “Exploiting Online Games.”
“There’s no way to audit that money transfer, so effectively they’re doing money laundering,” he said. “There’s almost zero risk for the attackers.”
The password-stealing programs are often installed via Web-based attack code that exploits flaws in multimedia programs such as Adobe’s Flash Player or Apple’s QuickTime Player, Hoglund said.
The attacks are often technically sophisticated, exploiting previously undisclosed bugs in Windows software, said Roger Thompson, chief research officer with AVG Technologies. “The ‘World of Warcraft’ password stealers have provided most of the innovation over the last twelve months,” he said via instant message.
Microsoft’s McCormack provided some data on where most of the password stealer detections occurred. Not surprisingly, China was the top country, with 529,003 detections.
Security experts say Chinese games are frequently the target of these attacks. Rounding out the top five countries for detections were Taiwan with 279,428, Spain with 235,381, the U.S. with 213,374 and Korea with 184,306.
About 330 million copies of the Malicious Software Removal Tool update were downloaded during this June period.
Gamers can make easy targets for criminals because some of them disable antivirus software to boost gaming performance, while others download free “cracked” versions of games, which can contain malware, McCormack said.
“So how does one avoid being infected?” he asked. “Running an up-to-date antivirus solution is a good start. Running an up-to-date, patched browser is another necessity,” he said. “Enabling Automatic Updates helps a whole bunch, too.”
With files from Joaquim P. Menezes