3 ms·

OK, it's great to be able to crack the crackers... The Ars summary of the report seems strange (I've not read the whole pdf) in a couple ways: They talk about

OK, it's great to be able to crack the crackers... The Ars summary of the report seems strange (I've not read the whole pdf) in a couple ways: They talk about percentages of private behavior getting scooped, but not about percentages or numbers of credit card or bank account users/passwords (which they indicate were the primary targets of the botnets). And weirdly, Ars says, "Torpig controllers may have exploited these credentials for between $83,000 and $8.3 million during that time period..." Funny numbers. ?it just happens that the range is 8.3 x 104 to 8.3 x 106 ? Makes me wonder about overall accuracy of post/report.

likpok 17y ago
It might be that they found something like 8.3e(5+-1), and Ars is reporting the bounds rather than the find.
aneesh 17y ago
Well, Torpig obtained credentials for 8310 accounts, so I'm guessing that's just a $10-1000 estimate of the loss per account. But from my experience, $1000 per compromised account seems quite a bit on the high side for credit card accounts (I have no idea about average loss for stolen brokerage accounts). Edit: From the pdf "A report by Symantec [37] indicated (loose) ranges of prices for common goods and, in particular, priced credit cards between $0.10-$25 and bank accounts from $10-$1,000. If these ﬁgures are accurate, in ten days of activity, the Torpig controllers may have proﬁted anywhere between $83k and $8.3M." As an aside, these amounts are a good reason you should you your credit card instead of your debit card.