Cybercrime More Lucrative Than Drugs 282
prostoalex writes "Yahoo is reporting that global cybercrime overtook global drug trafficking in terms of revenue this past year. In related news, only 4% of Internet users can flag 100% of phishing e-mails as fraudulent, and Americans filed 207,000 reports on cybercrime to FBI."
Curbing malware and cyberthreats (Score:3, Insightful)
When I started, the USENET application would inform me that my message would be spread across tens of thousands of computers at immeasurable cost as a subtle hint to keep things interesting, and Internet Chat required some basic knowledge of Makefiles and attention to documentation before you could run a client. Frankly, things became unmanageable at the point the Internet was made accessible to anybody with a web browser; anybody who's been around this long knows what I'm talking about.
It's a short hop to realizing that the problems we're experiencing with virii and worms are the same problem. Intimate knowledge of x86 assembly used to be a requirement -- along with a malcontent-type disposition -- in order to wreak the sort of havoc that today requires fifteen minutes and an Effective VBScript In Fifteen Minutes manual. Every document is now a program, and e-mail doubles as FTP.
Many experts believe we should raise the barrier of entry by requiring programmers to undergo education, certification, and maybe even an oath to do no harm as part of the certification process if going into a security field. It used to take years to do what kids today can do in months; additionally, a would-be programmer who spends a few months picking up Visual Basic or whatever has hardly learned the fundamentals of programming any more than someone who reads a manual about his DVD player has become a laser engineer. I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers (by means of pricing and with the cooperation of the open source community) and by separating macros or other executable content from documents.
It makes more sense than trying to go out and educate every user. Think about it; in what other field do we "educate" "users"? We don't try to educate people with electrical outlets and let any curious individual perform as a licensed electrician. We don't "educate" passengers and let anyone who cares be a bus driver give it a try. Why are things always so difficult when it comes to computers?
Dealers tell the media how much they make? (Score:4, Insightful)
Dunno 'bout the rest of you guys here, but I never told the police or the press how much profit I made back when I was a small time dealer (can't touch me, young offenders act!
If I didn't, you can be damn sure that big-time or organized criminals do not share these figures either.
Neither do the users. (How many crack-heads report the amount they spend on their habit?)
So what the hell is the premise on which these "statistics" have ever been based on?
I can think of a few ways to fudge up some statistics about people screwed outta their money on the net, but I can't see a way to truly gauge that either. Again, if I fell for the "send me a grand and I'll send you a million" I sure as hell wouldn't tell anyone I was that stupid.
Hence, I dub the entire original article as BS, just like the 'War on Drugs' and even the 'War on Spam'
Re:dotCrime Bubbles (Score:5, Insightful)
Petty crime has plenty of 'local' variables like where the police hang out, which places have alarms and electronics, et cetera, but most have similar principles; electronic crimes have different rootkits and different websites to fake and emails to send and addresses to harvest and spam filters to bypass, but again, most have similar principles. Unless you're manufacturing the (crowbar|rootkit/botnet) things won't change much.
Re:Curbing malware and cyberthreats (Score:3, Insightful)
However, I do agree that we have no reason to put executable code in documents.
Re:Legalize hacking! (Score:3, Insightful)
The test is bad (Score:5, Insightful)
Had a look at the test [mailfrontier.com] and this is not surprising. Basically, they just take a screenshot of the mail reader window, ripping out any info (headers, html source) that could be of any help. Not to mention that as long as you assume anything you get from your bank/ebay/paypal/... is *potentially* a phishing e-mail, you don't have to actually be able to tell the difference. Education should not be about recognizing phishing emails because phishers will always be ahead. However, if you *never* click on a link and always use bookmarks (to bank and all) you have, then there's nothing a phisher can do. Of course, education should also be for institutions like my bank which includes its website URL in emails they send me (they're encouraging their customers to learn bad habits).
Re:fishing survey is bullshit (Score:3, Insightful)
Re:4% is bogus (Score:3, Insightful)
Re:No new law needed (Score:4, Insightful)
Belief means placing trust or confidence in something. I don't believe (trust) that cybercrime exists beyond the basic property crimes we already have laws against.
Singapore (Score:1, Insightful)
4% and phishing test. (Score:3, Insightful)
-Rick
Don't be such an ass. (Score:5, Insightful)
> limiting access to compilers/assemblers (by means of pricing and with the cooperation of
> the open source community) and by separating macros or other executable content from
> documents.
[eg. the premise: artificially raise the cost of compilers and nastybad people will stop writing viruses, etc. just like gangsters in New York improvised zip guns when guns cost too much... oh, wait, that's a bad analogy... bad people just make do.]
You should also consider separating "clueless" from "malicious" in your thought process. HTH.
> Think about it; in what other field do we "educate" "users"?
Other than prenatal care, disaster response, home safety, poison control, vehicular operation, wildfire control, diabetes management, power tools, gun storage, and how to program your VCR? Can't think of any offhand...
> We don't try to educate people
> with electrical outlets and let any curious individual perform as a licensed electrician.
But we'll sell wire cutters and conduit to any moron at Home Depot, along with a Hole Hawg and a 3 foot masonry bit. Surprisingly, a license is not required to burn down your house as a DIY repairman, nor is it required to pack a thousand pounds of fertilizer, some gasoline, and some nails into the back of a van, detonate it, and cause much worse harm.
Cars are deadly weapons, as are guns; both require a license to operate, but in neither case does that eliminate fatalities caused thereby. (In fact, on the evening news last night, I noticed that a Class C licensed bus driver rolled over an embankment, killing 2 people and one fetus, injuring the other 39 people on the bus. More than likely, a smaller percentage of licensed commercial drivers do this than, say, unregulated Pakistani mountain bus jockeys, but I have no useful measure of the protective effect conferred by this certifying process.)
Bad people will still be bad people, and "the cooperation of the opensource community" is not something I think you can depend on for this venture. (cf. PGP and SSL export restrictions)
Stack protection, virtualization, perhaps legal penalties for willfully distributing software known to pose a risk to the users without their awareness or education (cf. the Theramed); maybe an overhaul of the communications system, and use of (NON-unicode) certificates required for financial communications. I don't know for certain, but I do believe that your rant about compilers holds little relevance to phishing at this point in time.
Full disclosure: I learned to program on an HP-80 and a Timex-Sinclair ZX-81. I was using Usenet before AOL 'broke' it. And I still think you're chasing the wrong idea.
Re:4% is bogus (Score:3, Insightful)
If they gain control of a large mail server or active router, they could easily and reliably associate thousands of account digits with the correct email addresses, and use that information to gain credibility. Email that's this important should be sent encrypted for the receiver and the signature verified against a certificate exchanged when the account or service was established.
Re:Oil (Score:4, Insightful)
Re:Curbing malware and cyberthreats (Score:3, Insightful)
So in order to have posting access you'd have to abandon your #638 account and get another one?
I wonder if Cmdr Taco has already reserved # 1,000,000 for himself to avoid being trapped in the 1-999 ghetto.
Re:4% is bogus (Score:2, Insightful)
Re:10% (Score:2, Insightful)
Re:4% is bogus (Score:5, Insightful)
Two totally different crimes (Score:5, Insightful)
If there wasn't a demand for drugs, there would be no drug trade. Conversely, the only reason to steal from others is always greed. Some might steal for fun *cough* winona ryder *cough*, but theft (in person, 3rd person, or via cybercrime) is almost always due to greed. Big difference there... One's there as a result of people wants, and demands. The other is largely parasitic, and exists solely to leech off people.
Personally, I'd rather see my government invest more of our tax dollars into protecting our identities, and investments, as opposed to busting generally harmless dope smokers, and their suppliers (In case you didn't know, marijuana smokers are the most commonly targeted drug demographic these days, and the majority of our tax dollars, go towards fighting marijuana, while proven "bad drugs", such as meth, ruin lives, and run rampant throughout the country).
The reason for all this is greed. The big companies almost write their own laws these days, and meanwhile more and more of our freedoms our lost, as our lawmakers focus on giving their funders (not constituents!) what they want. And surprisingly, things like Cybercrime continue to grow, and be largely ignored (Note, I'm talking real crimes, such as identity theft, phishing, and so on. Not downloading music and videos, which IMHO should be near the bottom of our list of priorities) .
Personally, I'd like to see a major change in how we handle crimes in this country: Elevate identity theft, and other life-altering crimes to the level they deserve, focus our energies and money on bettering our country, and removing our dependence on other countries for our very existance, and stop focusing on the average downloader as being the worst thing to hit the US since Pearl Harbor. Meanwhile, start fighting the real drug problems that are facing our country: Meth, Cocaine, Heroin, and so on, rather than going after the "low hanging fruit", marijaua users, which are largely chosen simply for the ease of busts, and the profit available to cops for doing so.
It's all about priorities, and right now our lawmakers top priorities are largely themselves, as evidenced by recent [cnn.com] events [cnn.com].
Re:Curbing malware and cyberthreats (Score:1, Insightful)
Frightening opinion you have there. (Score:2, Insightful)
Secondly, if we raised the barrier of entry to the internet to require programing certifications, we would not need to worry about the worms and virii, because anybody worth their certification would have far less of a likelyhood of having a problem with such things, and the virii would have much less shelter to propigate from.
Third, how are you going to make it that only licensed people are allowed to program? Seize the computer of anybody who tries to write a program? Make compilers and assemblers highly contraband and only allow liscensed individuals have them? Shut down internet based tutorials for programing languages because they are not officaly approved by the certification body, and we cant allow people to learn basic programming on their own? Fourth, what the hell good would educating bus passengers do? Educated computer users ARE better at avoiding worms and virii, are educated bus passengers gonna be better at preventing crashes? I would like to know how that works. Using an electrical outlet to plug in a electronic device is nowhere near what an electrician is supposed to train for, and knowing not to click on the "PUNCH TEH MONKEY AND WIN $999999999 $$$$$ DOLLLARS!!!!" flash ads, is nothing near coding.
Your post frightens me severly, and I sincerely hope that this is not a majority opinion.
Re:No new law needed (Score:2, Insightful)
Libertarians (in reality, cheap-labour conservatives) only want a government to protect them from their slaves.
Now, crawl back from that rock you came under.
Link doesn't support assertion. (Score:3, Insightful)
I took the test [mailfrontier.com] the linked-to article cited as the source of data for that 4% claim. I only scored 80%. Does that mean I flagged only 80% of phish attempts? No, it doesn't. I flagged 100% of the phishing attempts as exactly what they were.
I had two false-positives, which lowered my score. But false-positives are quite a bit safer than false-negatives. In each case, the 'legitimate' email linked to different domains than the origin; the one from Bank of America linked to bankofamerica1.com, and the one from CapitalOne linked to a really odd domain, bfi0.com. That second one is a *huge* red flag, regardless of the content of the email, you'd have to be very trusting or do some extra research in order to *not* flag it as a phishing attempt.
Only 4% of users might score a 100% on that quiz, but that's not at all the same thing as saying that only 4% of users can't flag all phishing scams as such.
Re:So, when I (Score:3, Insightful)
MDMA, MDA, TMA, DMT, LSD, Psilocybin, Mescaline, DOET, 2CB, THC, DOB and many many others - none of these substances produce a chemical dependency. Nor it is trivial to get OD'ed on those substances. Furthermore, harm of many psychedelics and empathogens (MDMA would be the most well-known example) is not proved despite extensive research. Makes you think when you compare them to alcohol and tobacco.
Now let's consider alcohol and tobacco. Overdosing on alcohol is very very common (something that you see every weekend if you go out). Another thing that alcohol is an integral part of our culture, so nobody freaks when they see an overdose. Physical dependency to alcohol is well documented and not something rare too.
Nicotine overdose is very rare indeed, at least when smoked. But if you try any other administration route, you'd find that it is quite easy to get OD'ed on it. I take it nothing needs to be said on addiction potential of nicotine.
The original motives for prohibition are sketchy. The benefits of marijuana, for example, were publicized before WW2, but still it got prohibited shortly after the war was over. According to one version, prohibition of coke, opium, marijuana and later psychedelics in 60s was used as a means of race and social oppression. I have no information backing up or discarding this version, but considering the racistic sentiments in the US in the first half of the 20th century, it is not something to completely discard.
GHB prohibition is interesting as well. Despite numerous scientific publications on medical use of GHB, it was placed in Schedule I. Quite an interesting coincidence is that GHB prohibition happened at the same time as new sleep-aid drugs hit the market in the US. Makes you think again.. Also it should be noted that no overdoses on GHB are documented in 80s despite the widespread use.
Those were just examples. If you take a closer look on the whole drug-prohibition policy, it hardly is beneficial for anyone except the state and companies which are in the drug-figthing business. Hopefully this helps.
PS: Amounts of coke in the original Coca Cola were miniscule and cocaine does not produce a physical dependency no matter how much you abuse it. Sugar and caffeine is probably more addictive than amounts of cocaine that were found in the original coke. You should know your subject better.