Cyber criminals buy, sell compromised servers for as little as $6: Kaspersky Report

NEW DELHI: In a latest report by Kaspersky Lab, the company says that its researchers have investigated a global forum where cyber criminals can buy and sell access to compromised servers for as little as $6 each.

The xDedic marketplace appears to be run by a Russian-speaking group, indicates Kaspersky’s report. In May 2016, xDedic listed 70,624 hacked Remote Desktop Protocol (RDP) servers from 173 countries for sale. The top 10 countries affected are: Brazil, China, Russia, India, Spain, Italy, France, Australia, South Africa and Malaysia.

xDedic offers its members access to: Servers belonging to government networks, corporations and universities; Servers that have access to or host certain websites and services, including gaming, betting, dating, online shopping, online banking and payment, cell phone networks, ISPs and browsers; Servers with pre-installed software that could facilitate an attack, including direct mail, financial and POS software.

Many of the servers host or provide access to popular consumer websites and services and some have software installed for direct mail, financial accounting and Point-of-Sale (PoS) processing. They can be used to target the owners’ infrastructures or as a launch-pad for wider attacks, while the owners, including government entities, corporations and universities, have little or no idea of what’s happening.

xDedic is a powerful example of a new kind of cyber criminal marketplace: well-organized and supported and offering everyone from entry-level cyber criminals to APT groups fast, cheap and easy access to legitimate organizational infrastructure that keeps their crimes below the radar for as long as possible.

A European internet service provider (ISP) alerted Kaspersky Lab to the existence of xDedic and the companies worked together to investigate how the forum operates.  The process is simple and thorough: hackers break into servers, often through brute-force attacks, and bring the credentials to xDedic. The hacked servers are then checked for their RDP configuration, memory, software, browsing history and more– all features that customers can search through before buying.

From as little as $6 per server, members of the xDedic forum can access all of a server’s data and also use it as a platform for further malicious attacks. This could potentially include targeted attacks, malware, DDoS, phishing, social-engineering and adware attacks, among others.

The servers’ legitimate owners, reputable organizations including government networks, corporations and universities are often unaware that their IT infrastructure has been compromised. Further, once a campaign has been completed, the attackers can put access to the server back up for sale and the whole process can begin again.

“xDedic is further confirmation that cybercrime-as-a-service is expanding through the addition of commercial ecosystems and trading platforms. Its existence makes it easier than ever for everyone, from low-skilled malicious attackers to nation-state backed APTs to engage in potentially devastating attacks in a way that is cheap, fast and effective. The ultimate victims are not just the consumers or organizations targeted in an attack, but also the unsuspecting owners of the servers: they are likely to be completely unaware that their servers are being hijacked again and again for different attacks, all conducted right under their nose,” said Costin Raiu, Director, Global Research and Analysis Team, Kaspersky Lab.

Kaspersky Lab advises organizations to:

Install a robust security solution as part of a comprehensive, multi-layered approach to IT infrastructure security

Enforce the use of strong passwords as part of the server authentication process

Implement a continuous process of patch management

Undertake a regular security audit of the IT infrastructure

Consider investing in threat intelligence services which will keep the organization informed of emerging threats and offer an insight into the criminal perspective to help them assess their level of risk.