Slashdot Log In
Web Browsers Under Siege From Organized Crime
Posted by
Zonk
on Tue Feb 12, 2008 01:23 PM
from the x-force-2007-sounds-like-an-awesome-movie dept.
from the x-force-2007-sounds-like-an-awesome-movie dept.
An anonymous reader writes "IBM has released the findings of the 2007 X-Force Security report, a group cataloging online-based threat since 1997. Their newest information details a disturbing rise in the sophistication of attacks by online criminals. According to IBM, hackers are now stealing the identities and controlling the computers of consumers at 'a rate never before seen on the Internet'. 'The study finds that a complex and sophisticated criminal economy has developed to capitalize on Web vulnerabilities. Underground brokers are delivering tools to aid in obfuscation, or camouflaging attacks on browsers, so cybercriminals can avoid detection by security software. In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007.'"
Related Stories
Submission: Web Browsers Under Siege From Organised Crime by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
80%...? (Score:2, Insightful)
Firefox? Opera? Safari? (Score:5, Insightful)
Re:Firefox? Opera? Safari? (Score:4, Interesting)
How is that a troll? He's stating the observation based on his experience.
I did read the article and can't tell, either. My experience coincides with yours. Funny articles are hesitant to spell out the distribution of vulnerabilities. I wonder if they get leaned on by Microsoft's legal department or one of their PR firms?
Just exactly how many of those vulnerabilities are Firefox running on Ubuntu? Or Safari? Or, as usual, is Windows and IE the most attractive attack vector?
Parent
Re:Firefox? Opera? Safari? (Score:5, Insightful)
Parent
Re:Firefox? Opera? Safari? (Score:5, Funny)
Parent
Re: (Score:3, Funny)
Re: (Score:3)
I'd like to see you have the nerve and belligerence to walk up to any of these people and say: "you're using IE so therefore you are wrong and stupid", when they are not actually at fault.
Putting aside the fact that I had been aiming for a Funny moderation instead of Insightful, this is one fine leap of logic you're suggesting, and some finely chosen words you're putting in my mouth.
While I did describe mere usage of IE as wrong and stupid, it would not do to assume I said IE users were wrong and stupid.
So please, suppress your righteous indignation.
Oh, BTW:
1. 30 - 50 year old couple with no technically competent friends or family (or kids) using a computer from Dell or a corner store. This is actually a pretty large fraction of 'Net users out there, and they use IE and windows through no fault of their own.
I should consider every usage of any device without proper level of competence wrong and stupid.
Just because people do not get
Re:Firefox? Opera? Safari? (Score:5, Interesting)
That is as far from the definition of a troll as can be imagined. Re-read the moderator guidelines about the difference between 'Flamebait', 'Troll', and 'Factually Incorrect'. Attitudes like yours make meta-moderation necessary.
On top of everything else, it's not necessarily even wrong. I can give you 'anecdotal' evidence based on servicing computers for a local user community of about 40,000 people. My observations haven't been formalised or codified in any way, so I can't make any claim to scientific observation, but I can tell you that what I see on a day-to-day basis is relevant and significant.
This is valid and useful information in my professional context. You're implication that anecdote is always based on feeling is, ironically, based on a hunch informed by your own bias.
If you're so bent on getting good data, by the way, you should know better than to blindly add up vulnerability announcement totals and call that analysis.
Parent
Re: (Score:3, Funny)
Re:Firefox? Opera? Safari? (Score:5, Funny)
Parent
Re: (Score:2, Redundant)
Got plugins? (Score:5, Insightful)
Parent
The minute that vulnerabilities were monitized... (Score:5, Interesting)
Welcome to the wild, wild net.
That's not the worst of it. (Score:5, Insightful)
The problem is that no matter how well YOU protect yourself, other agencies have your personal information in their databases.
What happens if your employer loses a laptop with your SSN, name, etc on it?
Eventually, the criminals are just going to start building a database with whatever information they can find.
Then they'll use that database to take out a second mortgage on your home, purchase a new car and open a few credit cards under your name.
You'll lose more money than you have. And you'll never have a chance to prevent it. Because all the information will be "leaked" from 3rd parties.
Parent
Re:That's not the worst of it. (Score:4, Insightful)
Side warning to the F/OSS community: That multitude of eyes may become even more important as we start to wonder, is the Godfather contributing? It doesn't even have to be in terms of direct backdoors, only has to be an exploitable bug which of course don't make the contributor look as bad.
Side warning to the closed source corporations: See above, biggest difference is your paying them too. Think you can hire that many eyes?
Side warning to businesses and individuals: Read the above, look around you, let the paranoia begin.
The internet maybe a highly efficient way of doing business, but it can be an extremely efficient way to steal too. Weigh the KNOWN risk factors, is it really worth it?
Organized crime is only the tip of the iceberg.
We may have to become stainless steel rats just to be free.
Parent
Re:That's not the worst of it. (Score:4, Insightful)
How do know that a low paid programmer at Microsoft hasn't been bribed by organized crime and if so how do you detect the code?
Parent
Re:That's not the worst of it. (Score:5, Funny)
I got that one covered. I just haven't paid several bills for a long while now. If someone tries to get credit with my credentials, all they will get is people laughing and pointing at them
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
I call BS on this one. I've done a couple of POS implementations for restaurants and all they all used WPA encryption on the devices and the access points were setup to only accept connections from a pre-defined list of MAC addresses. Ya ya, MAC addresses can be spoofed but it is going to take an attacker a long time to hit a restaurant wireless network. The majority of restaurants still swipe the card at the hard wired terminal anyway. The restaurant indus
Re: (Score:3, Informative)
If you are paranoid like me you will have already called one of three major credit companies (not the free score but Equifax, Experian, or TransUnion) and put a freeze on your credit every 90 days with a fraud alert. Or you can pay one of their subsidaries a monthly fee for any notifications via email or SMS of any changes or requests in your credit (yeah it kind of feels like I'm paying them to solve a problem that is their fault).
Re:The minute that vulnerabilities were monitized. (Score:2, Interesting)
I know I'm probably going to have to make another scan of my landlady's computer...she falls for half the stuff that comes through, even after my lectures on "DON'T CLICK IT"
Re:The minute that vulnerabilities were monitized. (Score:4, Insightful)
Parent
Re: (Score:2, Interesting)
Hell, if you're feeling ambitious, you could set up some kind of neighbourhood LAN and get folks to chip in towards a big fat pipe, if you can prove they'll have a safer connection...
Come to think of it...does anyone know of any successful examples of a "
Drop in vulnerabilities... really? (Score:5, Interesting)
Combined with the comment that camouflaging techniques are used in 80% - 100% of recorded attacks, I wonder if the number of attacks is really going up ( as it has been in the past 10 years ) but detection is getting worse.
Explains the odd attempted breakins.. (Score:5, Interesting)
Here's a sample:
ftp attempts for 5 hours straight:
Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - no such user 'Administrator'
Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - USER Administrator: no such user found from
Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - Maximum login attempts (3) exceeded
ssh attempts almost constant since last friday:
Feb 11 01:37:07 localhost sshd[13953]: pam_unix(sshd:auth): check pass; user unknown
Feb 11 01:37:07 localhost sshd[13953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.31.37.13
Feb 11 01:37:07 localhost sshd[13953]: pam_succeed_if(sshd:auth): error retrieving information about user ajith
When I catch them, the majority of the IP #'s match up to systems which have been rootkitted. The stream of odd login names always catches me off guard, sometimes in english, sometimes japanese or chinese. Does anyone know of someone that keeps track of these things, so I can send my logfiles to?
Re:Explains the odd attempted breakins.. (Score:5, Informative)
Parent
Re: (Score:3, Funny)
Sorry, my bad. Thought I was on my server...
Re:Explains the odd attempted breakins.. (Score:5, Informative)
It will automatically detect and block the attackers and optionally add them to a gobal block list.
Parent
Re:Explains the odd attempted breakins.. (Score:5, Informative)
Parent
Re: (Score:2)
Beware the"funny" moderation in Organized Crime... (Score:4, Funny)
I wonder what the profits look liike. (Score:3, Interesting)
Heck, spyware/adware, or some shady P2P programs could have something like this. Reminds me of what happened to http://www.shareaza.com/ [shareaza.com]. It's claimed by a group that be like this. That address used to be shareaza's main site, and it easy for many to not know to go to http://shareaza.sourceforge.net/ [sourceforge.net] for the new updates.
Re:I wonder what the profits look like. (Score:2)
original report (Score:3, Informative)
Oooo! The X-Force! (Score:2)
Organized crime, huh? When they hit your browser, does the screen just go black?
Re: (Score:2)
well it is called the "Black Market"...
Dat's a nice browser yous got (Score:5, Funny)
Lack of Security of any System on the 'Net (Score:3, Insightful)
5%, 25%, 50%? 90%? Are there estimates for the "rate never before seen" that users are having their personal information stolen?
And what personal information is it? To extend the old saying "If it is on the internet, it is public". Well, *all* information you store the computer that you access the internet suffers from this lack of security.
A truly secure user experience would be managing personal data on an unconnected system (or even a private network of systems) and then transferring data from there that needs to make it to the Internet via the Sneakernet [wikipedia.org]. This is how the Department of Defense guarantees the security of Secure Facilities, and it is (unfortunately) the only way to guarantee the security of your own personal information.
But for systems that are on the 'Net, using an OS that doesn't hide/obfuscate fundamental security models is a plus. For example, it is easier for me to shutdown outgoing ports/services on Linux [uic.edu] than on Windows [windowsecurity.com].
As far as browser exploits... one can only hope that developers close off the attack vectors faster than they open new ones.
I've been saying this for a while now (Score:4, Interesting)
There is only one solution: executable code must be embedded in hardware read-only media and must be reloaded after every session. [today reloading a virtual machine is a good approximation, but this method will succumb under sufficiently sophisticated attack; it really needs to be built into nonflashable rom]
Nobody wants to hear this. I'm not exacty sure why; a little thought should lead anyone with some knowledge of operating systems and hacking to the same conclusion.
Its just going to get worse, with botnets, blackmail and scammers gaining more and more power until we remove the ability of malignent code to survive.
Re: (Score:3)
New form of stick-up? (Score:5, Funny)
(Sorry - for humor I go for quantity, not quality.)
Kick Windows off the Internet (Score:3, Insightful)
Re: (Score:2)
Windows is the problem.
I'm certainly no MS fanboy, I don't consider your original post a Troll, and I won't even argue your 90% speculation. But I can't blame Windows's security for this. When you have 76% of the market share [wikipedia.org], it doesn't seem unreasonable that the blackhats will target you 90% of the time. So, unless their security is head-and-shoulders better than the competition, they will still have the most breaches.
Re: (Score:2)
Re: (Score:3)
Yet another car analogy, but it works here.
Stealing cars and exploiting computer exploits are completely different situations. Imagine a city where 76% of the population drove Hondas. The other 24% drive a variety of cars of roughly the same value. Each make of car has a different security system. Now, if you can figure out how to get around Honda's security system, 76% of the cars in the city are yours for the taking. If you figure out how to get around Buick's security system, you have your choice of the handful of Buicks driving around.
Desp
Re: (Score:3, Insightful)
You know... (Score:5, Funny)
If they're going to hose my Windows boxen and install spurious applications of dubious intent, I find that I prefer if they camouflage their attempts so as not to bother me with constant popups from the system tray telling me to install their spyware to get rid of spyware.
This does not surprise me at all... (Score:3, Informative)
Some people believe the largest botnets out there are ones built with the Storm Worm or other similar exploits. My bet would be that there are plenty larger out there, undetectable because they hide behind rootkits and don't do stupid stuff like turn the box into a spam cannon. And for people who think that the C&C (Command and Control) would be detected, think again: if a rootkit can conceal a file then it can also conceal a process, a named pipe, an interrupt handler, you name it.
... which is why it's a good idea to ... (Score:4, Informative)
How vulnerable am I? (Score:3)
Consider this hypothetical situation: I'm running Windows XP with no firewall and no antivirus. I'm on broadband and my ADSL modem/router does NAT with no port-forwarding rules set up. I'm fully patched and run out-of-the-box firefox. I don't run executables from untrusted sources, I understand how to treat email attachments, and I'm smart enough not to get caught by phishing.
How vulnerable am I? How likely is it that I will get compromised?
Does the answer change if I'm running fully-patched IE7?