{"id":53069,"date":"2022-12-08T13:38:16","date_gmt":"2022-12-08T05:38:16","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=53069"},"modified":"2022-12-08T13:38:18","modified_gmt":"2022-12-08T05:38:18","slug":"data-of-125-thousand-filipinos-for-sale-on-bot-markets","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2022\/12\/08\/data-of-125-thousand-filipinos-for-sale-on-bot-markets\/","title":{"rendered":"<strong>Data of 125 thousand Filipinos for sale on bot markets<\/strong>"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>At least\u00a0five million\u00a0people have had their online identities stolen and sold on bot markets for\u00a0340 PHP\u00a0on average. Out of all the affected people, 125 thousand are from the Philippines, making the country the 10th most affected by this threat in the world.<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This data comes from&nbsp;<a href=\"https:\/\/u7061146.ct.sendgrid.net\/ls\/click?upn=4tNED-2FM8iDZJQyQ53jATUbJvdnVQKi2QlCB4tG9p0o1b-2BqL8I4Ku7bybbV6RXa9P0tbBJ1zoL8rspK1Inb-2FXMw-3D-3DNLqa_nFwKN9DufOYpQIHzbxdL1Ta0eQ-2FyTvK4yEs067jJ71AOG4i5qLWceVhtO1HL9iSooCWoFPQHBOsforLoSu-2F5H8VKKGUvO9VtVbiDVd4qI8eblvf3YDOA1uKOXSclVNzudUvl2wQCSefpGbWcj7B-2FzIlYm8Lt6RYouZIxPjKS-2BgTx2r2RBkb5zDRnJVqN1a3o89L7ihmfHGlw8SWuFIqjhjDJkgz5Oq3m155LaWe6dwHXpdVjSXgMj9DMqtSZlrd0CxzGMnmbNW5fVrHGirLIn0eYLnRoPWsEpT4H8KsDHWm5Rl0LlohWTiKCDbYgsnwHbQI1zfH-2BlWmqSgeK6kWcCub7GPjkxxzdpV48cesdom0-3D\" target=\"_blank\" rel=\"noreferrer noopener\"><u>research<\/u><\/a>&nbsp;by the cybersecurity company NordVPN, which looked into three major bot markets. The word \u201cbot\u201d in this situation does not mean an autonomous program \u2013 in this case, it refers to data-harvesting malware. Bot markets are online marketplaces hackers use to sell data they have stolen l from their victims\u2019 devices with bot malware. The data is sold in packets, which include logins, cookies, digital fingerprints, and other information \u2014 the full digital identity of a compromised person.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cWhat makes bot markets different from other dark web markets is that they are able to get large amounts of data about one person in one place. And after the bot is sold, they guarantee the buyer that the victim\u2019s information will be updated as long as their device is infected by the bot,\u201d says Marijus Briedis, CTO at&nbsp;<a href=\"https:\/\/u7061146.ct.sendgrid.net\/ls\/click?upn=VnIC4pyKWBIZdl2xIfjF4GMDcw5-2BN2cLoNWTXjSAcJM-3DioEM_nFwKN9DufOYpQIHzbxdL1Ta0eQ-2FyTvK4yEs067jJ71AOG4i5qLWceVhtO1HL9iSooCWoFPQHBOsforLoSu-2F5H8VKKGUvO9VtVbiDVd4qI8eblvf3YDOA1uKOXSclVNzudUvl2wQCSefpGbWcj7B-2FzIlYm8Lt6RYouZIxPjKS-2BgTx2r2RBkb5zDRnJVqN1a3o89L7ihmfHGlw8SWuFIqjhmqQ3OpPyARQLbJiWjrY0MoRA9OvJXhEcAPYIjjczieL1SwTKWm8dKwg0XFbgbiS3PTc7-2BfHbXKfyzBznNJxRqLNrocQ0M2vpkC6T9KdUKHP5LDwSPAcIUHackeLomJgmCT-2FMcLqaujgfZk21KDpeRE-3D\" target=\"_blank\" rel=\"noreferrer noopener\"><u>NordVPN<\/u><\/a>. \u201cA simple password is no longer worth money to criminals, when they can buy logins, cookies, and digital fingerprints in one click for just 340 peso.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Researchers analyzed three major bot markets: the Genesis Market, the Russian Market, and 2Easy. All of the markets were active and accessible on the surface web at the time of analysis. The data on bot markets was compiled in partnership with independent third-party researchers specializing in cybersecurity incident research.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The most popular types of malware that steal data are RedLine, Vidar, Racoon, Taurus, and AZORult.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What information do hackers sell on bot markets?<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Screenshots of a device.<\/strong>&nbsp;During a malicious attack, a virus might take a snapshot of the user\u2019s screen. It can even take a picture with the user\u2019s webcam.<\/li>\n\n\n\n<li><strong>Logins and other credentials.<\/strong>&nbsp;When a virus attacks the user\u2019s device, it may grab logins saved to their browser. The research found&nbsp;<strong>26.6 million<\/strong>&nbsp;stolen logins on the analyzed markets. Among them were 720 thousand Google logins, 654 thousand Microsoft logins, and 647 thousand Facebook logins.<a><\/a><a href=\"https:\/\/mail.google.com\/mail\/u\/3\/#m_-9166540797030431151__ftn1\"><sup>[1]<\/sup><\/a><br>&nbsp;<\/li>\n\n\n\n<li><strong>Cookies.&nbsp;<\/strong>These are also usually stolen from a user\u2019s browser and help criminals bypass two-factor authentication.The research found&nbsp;<strong>667 million<\/strong>&nbsp;stolen cookies on the analyzed markets.<br>&nbsp;<\/li>\n\n\n\n<li><strong>Digital fingerprints.&nbsp;<\/strong>A person\u2019s digital fingerprint includes screen resolution, device information, default language, browser preferences, and other information that makes the user unique. Many online platforms track their users\u2019 digital fingerprints to make sure they properly authenticate them. During the research,&nbsp;<strong>81 thousand<\/strong>&nbsp;stolen digital fingerprints were found on the analyzed markets.<br>&nbsp;<\/li>\n\n\n\n<li><strong>Autofill forms.<\/strong>\u00a0Many people use the autofill function for their names and emails as well as for their payment cards and addresses. All of these details can be stolen by malware. During the research,\u00a0<strong>538 thousand<\/strong>\u00a0autofill forms were found on the analyzed market.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>A perfect crime using bots<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The scariest thing about bot markets is that they make it easy for hackers to exploit the victim\u2019s data. Even a rookie cybercriminal can connect to someone\u2019s Facebook account if they have cookies and digital fingerprints in place, which help them bypass multi-factor authentication.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After logging in to a user&#8217;s account, a cybercriminal can try contacting people on a victim\u2019s friends list and send malicious links or ask for a money transfer. They can also post fake information on the victim\u2019s social media feed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Information stolen from autofill forms or just by taking a device screenshot can help these actions look more believable and trustworthy. And you will have no way to detect who used your data.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cSome tactics are even simpler. A hacker can, for example, take control of a victim\u2019s Steam account by changing the password. Steam accounts are sold for up to $6,000 per account and can be easy money for a criminal,\u201d says Marijus Briedis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">More sophisticated criminals buy this information and target businesses with phishing attacks, trying to impersonate the company\u2019s employees.&nbsp;&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u201cTo protect yourself, use an antivirus at all times. Other measures that could help \u2013 a password manager and file encryptions tools to make sure that even if a criminal infects your device, there is very little for them to steal,\u201d adds Marijus Briedis.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The price of a bot was converted to local currency (from US dollars to PHP)&nbsp; on November 30th.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Data about the number of internet users in certain countries was taken from\u00a0<a rel=\"noreferrer noopener\" href=\"https:\/\/u7061146.ct.sendgrid.net\/ls\/click?upn=4tNED-2FM8iDZJQyQ53jATUdt2AGgTPEFVxp-2Fkm-2B46oihV9F5lAM-2F87N4fwwyhce0qm4Sl_nFwKN9DufOYpQIHzbxdL1Ta0eQ-2FyTvK4yEs067jJ71AOG4i5qLWceVhtO1HL9iSooCWoFPQHBOsforLoSu-2F5H8VKKGUvO9VtVbiDVd4qI8eblvf3YDOA1uKOXSclVNzudUvl2wQCSefpGbWcj7B-2FzIlYm8Lt6RYouZIxPjKS-2BgTx2r2RBkb5zDRnJVqN1a3o89L7ihmfHGlw8SWuFIqjhubJMGheGRotXn7KgOmb-2FtNxF8-2B6MRQJiZG9LAOkTCTILRhUo6cVG4l365Fav6W0lL-2F-2FCgdhieYvgwpu-2BmAXo7ITBIMFumn3c4-2FWc3BgUm1Yizts4Fq8j8iM5jXkV40VnYwZD1qNcrQJrjpl7Q5bm5k-3D\" target=\"_blank\"><u>DataReportal<\/u><\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Stolen logins found on bot markets<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td>Google<\/td><td>720,676<\/td><\/tr><tr><td>Microsoft<\/td><td>654,444<\/td><\/tr><tr><td>Facebook<\/td><td>647,574<\/td><\/tr><tr><td>Amazon<\/td><td>226,264<\/td><\/tr><tr><td>Netflix<\/td><td>223,173<\/td><\/tr><tr><td>PayPal<\/td><td>201,649<\/td><\/tr><tr><td>Instagram<\/td><td>196,904<\/td><\/tr><tr><td>Steam<\/td><td>180,581<\/td><\/tr><tr><td>Ebay<\/td><td>123,955<\/td><\/tr><tr><td>EA Network<\/td><td>115,807<\/td><\/tr><tr><td>Roblox<\/td><td>112,050<\/td><\/tr><tr><td>LinkedIn<\/td><td>108,789<\/td><\/tr><tr><td>Yahoo<\/td><td>105,944<\/td><\/tr><tr><td>Dropbox<\/td><td>105,918<\/td><\/tr><tr><td>Ali Express<\/td><td>100,690<\/td><\/tr><tr><td>Twitch<\/td><td>93,678<\/td><\/tr><tr><td>Apple Store<\/td><td>90,068<\/td><\/tr><tr><td>Twitter<\/td><td>89,469<\/td><\/tr><tr><td>Sony Entertainment<\/td><td>89,421<\/td><\/tr><tr><td>Spotify<\/td><td>75,941<\/td><\/tr><tr><td>Riot Games<\/td><td>75,242<\/td><\/tr><tr><td>Epic Games<\/td><td>72,673<\/td><\/tr><tr><td>MEGAnz<\/td><td>61,150<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">&#8212;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/mail.google.com\/mail\/u\/3\/#m_-9166540797030431151__ftnref1\"><sup>[1]<\/sup><\/a>\u00a0The rest of the stolen logins are indicated in the table \u201cStolen logins found on bot markets\u201d below.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>This growing threat has already affected five million people globally, with hackers selling webcam snaps, screenshots, up-to-date logins, cookies, and digital fingerprints.<\/p>\n","protected":false},"author":6,"featured_media":52014,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[19],"tags":[286,3761,54,2103],"class_list":["post-53069","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-headlines","tag-it-security","tag-nordvpn","tag-security","tag-security-breach"],"_links":{"self":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/53069","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/comments?post=53069"}],"version-history":[{"count":0,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/posts\/53069\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media\/52014"}],"wp:attachment":[{"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/media?parent=53069"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/categories?post=53069"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.upgrademag.com\/web\/wp-json\/wp\/v2\/tags?post=53069"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}