Broadband Tech > Security > Security > Poker gamers targeted by a rootkit backdoor

Poker gamers targeted by a rootkit backdoor

quote:

---

This press release comes from F-Secure. For more information on F-Secure's
mailing list policy, see end of message.

PRESS RELEASE

For release May 16, 2006

Poker gamers targeted by a rootkit backdoor

An online poker backdoor, covertly storing gamblers' information for
potential theft has been uncovered by F-Secure rootkit detection technology,
Blacklight. Rootkits are used by malware authors to hide malicious
software.The online tool RBCalc.exe, also known as a Rakeback calculator,
has been distributed from a gaming site Checkraised.com.

The backdoor, a method for securing illegal remote access to a computer was
created by silently dropping four executable files into the user's computer
and using a rootkit driver to conceal the operation. With this in place, the
tool's author could access login information from the user's computer for
various online poker websites including Partypoker, Empirepoker,
Eurobetpoker and Pokernow. Having gained access, the hacker could then play
poker against himself, losing on purpose and reaping the rewards.

Shortly after the discovery, Checkraised.com removed the offending exe file
from its website and issued an official statement on its website advising
users to change their poker site passwords as well as offering instructions
for manually removing the malware.

Speaking about the case, Kimmo Kasslin, a researcher at F-Secure's Data
Security Laboratory said: "Following the exponential rise of interest in
online poker, it is inevitable that malware authors would follow suit with
programs to separate players from their money. What is significant is the
fact that this particular scam was hosted, albeit unwittingly on a
legitimate site and used rootkit technology to cloak itself. Without our
unique Blacklight technology to detect it, many online gamblers could have
become victims of this exploit."

Kasslin continued: "Malware authors are increasingly wise to standard
antivirus and intrusion techniques and are constantly looking for a new
exploits. Having standard data security software from the bigger vendors
would not have protected you against this rootkit exploit. F-Secure's
software does."

F-Secure advises those who have downloaded and executed this binary provided
by checkraised.com, to check their systems immediately for possible
infection. A free scan is available from our new F-Secure Online Scanner
Next Generation Beta, which also now has rootkit detection capabilities
through the F-Secure BlackLight engine.

To view the full statement issued by Checkraised.com, go to:
»www.checkraised.com/site/apps/rb···calc.php

For a technical description and for a screenshot of the malicious RBCalc
application: »www.f-secure.com/v-descs/small_la.shtml

For F-Secure Internet Security 2006 with with Blacklight technology:
»www.f-secure.com/estore/

---

Seems that gambling tends to attract the criminal element in the cyber world as well as the real world.

reply to CalamityJane
Remind me again why I don't play online poker.

Good find and notice for anyone who does play.

Blake

reply to CalamityJane
I see a lot of the poker games installed in the many Hijackthis logs I look at. It's also become a favorite of the younger teens set. Had a parent who found his child had been installing Party Poker behind their back and uninstalling it after playing to hide it. That was on the family PC. I would urge all parents to heads up and make sure you have the kids on Limited User accounts and NOT an admin account.
--
It takes a disaster to make a woman out of a female
Microsoft MVP/Windows Security 2003-2006
Proud Member of ASAP (Alliance of Security Analysis Professionals)

reply to CalamityJane
The people I see playing online poker in our area are a mix of what folks used to call yuppies, the little old ladies who frequent Bingo nights and the retired guys who used to play with their buddies in the garage.

The gambling sites are right up there with the porn, smileys, free music, ringtones, shade tree search sites and lyrics in terms of distributing crapware.
--
Charter member, Harry Lime fan club

reply to CalamityJane

reply to CalamityJane

quote:

---

I would urge all parents to heads up and make sure you have the kids on Limited User accounts and NOT an admin account.

---

reply to MrBradTX

quote:

---

Seems that gambling tends to attract the criminal element in the cyber world as well as the real world.

---

reply to psicop

said by psicop:

You are too nice!

I would give them a good flog and ban them from using the PC for a week. Children learn best the hard way.

G.

reply to CalamityJane
I had an IM that suggested I was joking when I said it was a clever attack. Not at all - I really did think it was a pretty good hack.

After all, what you end up with is the problem of distinguishing (a) some guy whose poker account has been hacked into, and (b) some guy who was a lousy poker player and doesn't want to pay his debts.

The fact that online poker has a slightly disreputable reputation only adds to the cover story.

Just because it's a clever method doesn't mean I approve, of course.

reply to CalamityJane
Reality of the matter is, you don't need a rootkit to fleece someone with online poker. If your the mark and everyone else at the table is sharing information as to what cards they have and they are running odds generation software based on the shared knowledge, odds are pretty good your going to lose your money.

Frankly I often have a hard time determining which is lower on the scum meter, porn or gambling.

Blake
--
Vendor: Author of Link Logger which is a traffic analysis and firewall logging tool

reply to EGeezer

reply to Link Logger

reply to CalamityJane

--
Non impediti ratione cogitationis.

reply to CalamityJane
I play online poker on ESPN.com and never have any problems although I admit to being a bit oblivious to malware or whatever it is. Espn poker is free so not really gambling and if you win enough games you can receive prizes.

reply to CalamityJane
I've been playing with Pokerstars software and online @ Pokeroom for months and both are safe with nothing going on in the background!

Both are owned by Mohawk technologies!
--
Go Sens Go!

reply to cubs4eva