Slashdot Log In
Security Attacks Increasingly Motivated By Greed
Posted by
CmdrTaco
on Tue Sep 21, 2004 08:19 AM
from the money-money-money-monaaaay dept.
from the money-money-money-monaaaay dept.
earthstar writes "E-commerce has emerged as the "single most targeted industry" according to the latest Internet Security Threat Report from security software provider Symantec, with hackers now appearing to be motivated by economic gain rather than notoriety.
"We're seeing an increase in profit-motivated attacks," says Vincent Weafer, senior director of Symantec's virus research team. Also in
Information week"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
In other news. (Score:5, Insightful)
Re:In other news. (Score:5, Insightful)
If it contains money, they will come. Nothing new here. It has always been like that through the history of humankind. People used to keep money in the form of gold and *they* came. People started keeping money with their head of village and *they* came. People put the money in lockers/safes and *they* came. People started using banks and *they* came. Now people are using the web to store/trasnfer money and *they* are here.
Parent
Re:In other news. (Score:4, Insightful)
Parent
Re:In other news. (Score:4, Interesting)
Parent
In OTHER other news. (Score:4, Interesting)
Parent
Re:In other news. (Score:5, Insightful)
Parent
Re:In other news. (Score:2)
Because... (Score:5, Funny)
Yeah... (Score:4, Funny)
Parent
Re:Because... (Score:5, Funny)
Parent
If we were all passing around those women, (Score:2, Funny)
the way it always works (Score:2, Insightful)
Trickle down Hacking (Score:4, Insightful)
It seems now though more and more of the stupid amateurs are trying to get in on the Hacking for Fun & Profit gig.
Re:Trickle down Hacking (Score:4, Insightful)
And unfortunately it seems to be working [theregister.com]. This little beast should be locked up, or at least made liable for damages. As is he will probably get a very lenient sentence which translates getting off more or less scot free. Let's just hope enough of his victims sign up [theregister.com] to ensure that he will spend a long while paying off the price of his little joke. If the norm for virus authors becomes a slap on the wrist in court closely followed by a fat job offer and not having to pay any substantial damages we are in for a Noah's flood of these idiots.
Parent
That's why... (Score:4, Informative)
Re:That's why... (Score:3, Funny)
Re:That's why... (Score:4, Insightful)
Parent
Curiosity.... (Score:5, Interesting)
So for those who advocate the freedom to "see what I can see" take note of the small leap toward real criminal behavior....
Re:Curiosity.... (Score:5, Informative)
So for those who advocate the freedom to "see what I can see" take note of the small leap toward real criminal behavior....
Circumventing security measures (however weak) on someone else's system without permission is already real criminal behavior [cornell.edu].
Parent
Re:Curiosity.... (Score:3)
What, from your imaginary made-up scenario? That's like the government leafs talking about how pot is a gateway drug. If you smoke pot, you'll do all these other drugs.
As with everything else, there are gradients. I do not doubt that some happen to do what you outline, but others get into "cracking" to learn how to steal, while others stumble on to something and quickly decide the
Is it me? (Score:5, Funny)
In other news... (Score:4, Insightful)
Ha! (Score:4, Insightful)
Apparently Symantec's current marketing strategy wasn't working, so now they have to use profit-related scare tactics. "Vested interest" anyone?
It's more than just security... (Score:5, Insightful)
"Companies using e-commerce also retain a lot of data about customers, account numbers and personal information, and a lot of smaller businesses conducting transactions online don't put the money into security, so they become easy targets," said Donovan.
According to Donovan, many small businesses still do not have an "appropriate level of security".
The larger problem is that many small business do not have an appropriate level of *clues* about security.
Small business owners that are not tech-savvy are no better off than the average Joe Six-Pack that gets on the internet. Most unfortunately wouldn't know what it means to update your anti-virus/malware/spyware signatures, much less do it. By the time they do finally call for tech support their network and much of their IT assets, have been 0wn3d.
It's what happens when hackers go legit (Score:3, Interesting)
So you get a job, naturally, with your skillz, the people willing to hire you aren't exactly altruistic.
Re:It's what happens when hackers go legit (Score:2)
Re:It's what happens when hackers go legit (Score:3, Interesting)
You gravitate towards what you're attracted to (hacking) and the more you run in those circles, the more there'll be people there to exploit you.
It's too bad hackers (should I be using the term "crackers", really?) don't have a highly-developed sense of ethics.
Like other scientists, they end up making tools that can be used to harm people, but maybe a combination of factors makes them even LESS ethically pre-occupied than most scientists.
If you can indeed call hack
Stats? oh. (Score:5, Insightful)
.
"We have seen a pretty rapid shift in the style of threats by hackers as they focus more on key-logging and phishing scams for financial gain," he said.
Oh really? Is Symantec able to quantify an increase in the number of "hackers seeking financial gain" that would qualify the headline of the article? I don't see any stats.
"Companies using e-commerce also retain a lot of data about customers, account numbers and personal information, and a lot of smaller businesses conducting transactions online don't put the money into security, so they become easy targets," said Donovan.
Oh. So businesses should give money to Symantec, right?The article is lacking in a lot of detail (Score:2, Insightful)
Or are they more along the lines of jewel thieves, carefully staking out their victim and carefully planning their heist. My guess is that they are more like the former than the latter, but the study doesn't really sa
Turnabout (Score:3, Funny)
What is amazing ... (Score:5, Insightful)
Re:What is amazing ... (Score:2, Interesting)
"We're seeing an attempt in exploiting Linux environment and as it becomes more widely deployed it will become more of a target," he said
Money vs. FXP (Score:5, Interesting)
The reality is that North and South American hackers are primarily motivated to participate in FXP, or file-sharing using their compromised computers. Russian hackers work with US companies to sell spam drones. German hackers do a mix of both but mainly use their computers to compromise more. Canadians DDoS other hackers. I don't intend to generalize, but it is important to note that the primary objective here is *still* file sharing.
Sites like www.packetnews.com and the like have XDCC searches that help people find free software, like Sims2 the week it comes it. Some movies come out before they are in theatre. I remember seeing Mr. Deeds a month before it came out and Signs about two weeks before it came out.
You don't get that kind of dedication from most hackers. In fact, I would venture to guess that the Russian groups that are doing the majority of the spambot installations have one or two knowledgable people in them, and that is essentially it. The others that work with them are just trying to siphon money. Still, there are a good deal of them with 0-day IE exploits, but unfortunately they haven't been well to adapt to one of the changes Microsoft made blocking an easy way to get files to your computer.
Now, if these guys were bright, they'd keep using the same method and just change the registry so that they can use that method. But it would appear that they don't know how to do that. SP2 also seems to be causing some trouble.
Profit by way of spam relays perhaps (Score:5, Interesting)
It's not just attacks though, seems nearly every security threat (worms, viruses, hacking attempts, etc.) are all converging on one overriding purpose -- SPAM!!! Someone hacked your server? They've probably installed a trojan that makes it a zombie spam relay. User clicked on the blatantly obvious virus in their E-mail and infected their system? It's now a zombie spam relay. Worm managed to get into an unpatched system? Yay, another zombie spam relay!
Even a few years back I felt a lot of hacking and virii/worms were caused by script kiddies playing with hackers tools they found online. Nowadays it's starting to look incredibly organized and methodical. It makes you wonder who's really behind the whole thing. It's getting to be far too orderly (from a spam relay acquiral front particularly) to just be lots of independant greedy folks with no morals trying to make a quick buck. Not to sound like I'm wearing a tinfoil cap but I'd say it's a fair bet that organized crime has moved into the arena and taken charge behind the scenes.
wearing a tinfoil cap (Score:3, Insightful)
Hide your messages in spam with steganography and broadcast them. This way, traffic-flow-based techniques won't work.
By this premise, the DHS has a valid and critical reason to go after spam and zombies.
In other news.... (Score:3, Funny)
Enron and many other companies have been seen to steal money from innocent citizens. Flying directly in the face of previous accounts that said this was for charitable purposes, accounts are now saying that these deeds were based strictly on greed.
Crime = greed? Wow! that is news.
Another side effect of the .crash (Score:5, Insightful)
It makes sense that as legit jobs are harder to get, some people, especially those who got addicted to the easy money, will look for non legit work.
GREED! (Score:3, Insightful)
A sad sign of maturity for e-commerce (Score:3, Insightful)
E-Commerce is big enough now to attract the attention of criminals. I suppose that's an expected milestone for E-Commerce. The cowboy days of fast progress in an arena of trust and goodwill are over.
Newsflash: (Score:5, Insightful)
Helllloooo???? (Score:5, Interesting)
When times are good, crime is not attractive. But when things are really doing bad, crime becomes more and more attractive...
Wake up and smell the coffee (Score:4, Interesting)
So in the past all these people who pay spammers to send out millions of e-mails every hour asking to "update your account", sign up for web hosting accounts to set up phishing sites with stolen credit card numbers, extort money from companies by threatening DOS attacks, set up vast networks of zombies... ...were motivated by notoriety???
Now that cracking has a business model... (Score:5, Interesting)
Now that there's (at least apparently) a viable business model for cracking machines, I think maybe Windows, which is fundamentally unsecurable partly by design and partly by historical practice Microsoft can't/won't break from, will just get overwhelmed. Certainly most of the home Widnows computers I run into have at least one spyware infection, and some are so infested as to be unusable.
Of course, in nature the really virulent pathogens tend to evolve into less nasty forms - killing off all your hosts is not a good long-term strategy. The spyware and zombie bots might become less overtly intrusive and more 'asymptomatic'. Imagine the future of computing... most computers carry some 'viral load' more or less constantly... [shudder].
Online fraud... helping Linux/OSS adoption? (Score:5, Insightful)
I get at least one purchase made by a stolen card every week, and in some instances I've been able to trace the owner of the card details.
In every single case, they've told a tale of how their PC got trojaned a few weeks back and they had to get it cleaned up. They're always quite shocked to learn of the real effects of what happened. Up until then, they just see it as an inconvenience and something you just have to put up with once in a while, like unblocking the kitchen sink.
Sometimes though, they review their credit card statements and find other small purchases that they're overlooked, then realise that they had been screwed little by little over a long period.
In every case, they've been more than happy for me to send them a copy of TheOpenCD or Knoppix so they can either install Moz or use Linux at least for their online stuff.
The recent activities of the botnet barons and phishers have certainly caught the attention of the mainstream press though, which is great publicity.
Linux under attack, sez Symantec (Score:5, Interesting)
"We're seeing an attempt in exploiting Linux environment and as it becomes more widely deployed it will become more of a target," he said.
Oh really? Donovan being the Director of Symantec, this means his company is seeing exploits on Linux?
That's front page news. Who? Where? What vuln? Which distro?
Or do you mean "we think we will see"? That's not quite the same thing, Sym-boy. Careful with that FUD gun, will ya. You're gonna shoot your other foot too.
Then again, if you think of it, companies like Symantec are part of the vast cottage industry that popped up for the sole purpose of plugging the leaks of Windows. The last thing they need is more Linux boxes around. Hence the FUD.
virus scanning like using a condom with a hole (Score:3, Interesting)
a condom with a hole in it. I cannot even remember the number of owned machines I have fixed the last couple of months with a virus scanner installed and sitting behind a firewall. In nearly every case the machines are being exploited through the browser or preview in outlook. I run a virus scanner on a system now as a initial pass but then go to the process list to see how many bots are running on the machine collecting and sending data.
If enjoy sharing your credit card information with internet vandals keep using Windows and Internet Explorer.
Security Articles Increasingly Motivated By Greed (Score:3, Insightful)
No "Economic Gain" Here (Score:3, Insightful)
Self-Administration Needed (Score:3, Insightful)
This is clearly unrealistic. We already know that this expectation coupled with the obvious lack of systems administrators for lone PCs, has lead to a great many slashdotter being the de facto sysadm for their friends and family. Clearly this solution falls on its ass when faced with PC owners with no such tech head to call upon. These PCs are probobly doomed to become spam zombies or to take part in DDOS attacks.
It's 2004, not 1984. Most PCs will likely never even be looked at by someone who can admisister them. I'm not just talking about patching and updating virus scanners. What about simple tasks like defragging? Does anyone really think that Aunt Tilly will defrag her PC? What about firmware updates?
At this point PCs should support self administration and self diagnostic and repair. Before you laugh me out off the board, I know that feeble attempts at this have failed miserablely(Windows autoupdate, system restore). But in the age where four year olds, business students, lawyers and Aunt Tillies everywhere are using broadband connected PCs and haven't a clue how to keep them up and running, it's either MUCh better selfadm or you and I will have to become fulltime sysadms.
Re:Payoff (Score:3, Insightful)
Most things people do are for money. Sex too, but if you can hack, you're already precluded from the latter