Hacked Servers for Sale
Monday, June 20, 2016 @ 12:06 PM gHale
There is a global forum where bad guys can buy and sell access to compromised servers for as little as $6 each, researchers said.
The xDedic marketplace, which appears to be run by a Russian-speaking group, currently lists 70,624 hacked RDP servers for sale, said researchers at Kaspersky Lab.
The servers host or provide access to consumer websites and services and some have software installed for direct mail, financial accounting and PoS processing. They can end up used to target the owners’ infrastructures or as a launch-pad for wider attacks.
All of that could happen while the victims, including government entities, corporations and universities, have little or no idea of what’s happening.
xDedic is an example of offering everyone from entry-level attackers to APT groups fast, cheap, and easy access to legitimate organizational infrastructure that keeps their crimes below the radar for as long as possible.
A European ISP alerted Kaspersky Lab to the existence of xDedic and the companies worked together to investigate how the forum operates.
The researchers found hackers break into servers, often through brute-force attacks, and bring the credentials to xDedic. The hacked servers then end up checked for their RDP configuration, memory, software, browsing history and more, all features customers can search through before buying. After that, they end up added to a growing online inventory that includes access to:
• Servers belonging to government networks, corporations and universities
• Servers tagged for having access to or hosting certain websites and services, including gaming, betting, dating, online shopping, online banking and payment, cell phone networks, ISPs and browsers
• Servers with pre-installed software that could facilitate an attack, including direct mail, financial and PoS software.
From as little as $6 per server, members of the xDedic forum can access all of a server’s data and also use it as a platform for further malicious attacks. This could potentially include targeted attacks, malware, DDoS, phishing, social-engineering and adware attacks.
The servers’ legitimate owners are often unaware their IT infrastructure suffered compromise. Furthermore, once a campaign wraps up, the attackers can put access to the server back up for sale and the whole process can begin again.
The xDedic marketplace seems to have opened for business sometime in 2014, and has become significantly more popular since the middle of 2015. In May 2016, it listed 70,624 servers from 173 countries for sale, posted in the names of 416 different sellers. The top 15 countries affected are: Brazil, China, Russia, India, Spain, Italy, France, Australia, South Africa, Malaysia, United Kingdom, Mexico, Columbia, the United States and Germany.
The group behind xDedic appears to be Russian-speaking, and claims that it merely provides a trading platform and has no links or affiliations to the sellers.