Web Browsers Under Siege From Organized Crime 168
An anonymous reader writes "IBM has released the findings of the 2007 X-Force Security report, a group cataloging online-based threat since 1997. Their newest information details a disturbing rise in the sophistication of attacks by online criminals. According to IBM, hackers are now stealing the identities and controlling the computers of consumers at 'a rate never before seen on the Internet'. 'The study finds that a complex and sophisticated criminal economy has developed to capitalize on Web vulnerabilities. Underground brokers are delivering tools to aid in obfuscation, or camouflaging attacks on browsers, so cybercriminals can avoid detection by security software. In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007.'"
80%...? (Score:2, Insightful)
Firefox? Opera? Safari? (Score:5, Insightful)
That's not the worst of it. (Score:5, Insightful)
The problem is that no matter how well YOU protect yourself, other agencies have your personal information in their databases.
What happens if your employer loses a laptop with your SSN, name, etc on it?
Eventually, the criminals are just going to start building a database with whatever information they can find.
Then they'll use that database to take out a second mortgage on your home, purchase a new car and open a few credit cards under your name.
You'll lose more money than you have. And you'll never have a chance to prevent it. Because all the information will be "leaked" from 3rd parties.
Lack of Security of any System on the 'Net (Score:3, Insightful)
5%, 25%, 50%? 90%? Are there estimates for the "rate never before seen" that users are having their personal information stolen?
And what personal information is it? To extend the old saying "If it is on the internet, it is public". Well, *all* information you store the computer that you access the internet suffers from this lack of security.
A truly secure user experience would be managing personal data on an unconnected system (or even a private network of systems) and then transferring data from there that needs to make it to the Internet via the Sneakernet [wikipedia.org]. This is how the Department of Defense guarantees the security of Secure Facilities, and it is (unfortunately) the only way to guarantee the security of your own personal information.
But for systems that are on the 'Net, using an OS that doesn't hide/obfuscate fundamental security models is a plus. For example, it is easier for me to shutdown outgoing ports/services on Linux [uic.edu] than on Windows [windowsecurity.com].
As far as browser exploits... one can only hope that developers close off the attack vectors faster than they open new ones.
Re:The minute that vulnerabilities were monitized. (Score:4, Insightful)
Kick Windows off the Internet (Score:3, Insightful)
Re:That's not the worst of it. (Score:4, Insightful)
Side warning to the F/OSS community: That multitude of eyes may become even more important as we start to wonder, is the Godfather contributing? It doesn't even have to be in terms of direct backdoors, only has to be an exploitable bug which of course don't make the contributor look as bad.
Side warning to the closed source corporations: See above, biggest difference is your paying them too. Think you can hire that many eyes?
Side warning to businesses and individuals: Read the above, look around you, let the paranoia begin.
The internet maybe a highly efficient way of doing business, but it can be an extremely efficient way to steal too. Weigh the KNOWN risk factors, is it really worth it?
Organized crime is only the tip of the iceberg.
We may have to become stainless steel rats just to be free.
Re:That's not the worst of it. (Score:3, Insightful)
Re:Kick Windows off the Internet (Score:3, Insightful)
The fact is that Windows' sieve-like architecture welcomes malware into the guts of the operating system, while hindering users at every turn, and tight integration with applications and server stacks guarantees that the most peripheral exploits will find a red carpet into the core of the operating system. This is not true of Unix-type operating systems, which are inherently far more secure. Windows' dominant market share ensures that the damage- billions of dollars wasted on extra bandwidth, "security" applications, abuse desks, fraud and identity theft, and so forth- is pandemic. Windows is impossible to secure. It will take a ground-up rewrite to fix it.
There are fundamental differences in culture- in the Unix world, or at least in the open source part of it (Linux, FreeBSD, OpenBSD, NetBSD, OpenSolaris), vulnerabilities are not denied or hidden, but are out in the open and dealt with. It's been proven over and over that openness = stronger security. Two good examples are OpenSSH and OpenSSL. Both are open source, both are used universally in all kinds of applications, such as secure remote sessions and Web applications. Their code is wide open and they are thoroughly documented. Anyone can study their inner workings. Are they successfully exploited? No.
This article is a good start for understanding the fundamental architectural differences: http://www.theregister.co.uk/security/security_report_windows_vs_linux/ [theregister.co.uk]
Got plugins? (Score:5, Insightful)
Re:That's not the worst of it. (Score:4, Insightful)
How do know that a low paid programmer at Microsoft hasn't been bribed by organized crime and if so how do you detect the code?
Re:Firefox? Opera? Safari? (Score:5, Insightful)
Re:That's not the worst of it. (Score:2, Insightful)
This is really important. There are a lot of people who argue that if you have nothing to hide, you don't need to worry about the government tracking your information. This argument tends to have the implicit assumption that the government has your best interests at heart and wouldn't [fill in your worst abuse here]. However, even if you believe this, clearly it is not true about criminals. It is becoming rapidly evident that no organization, including the government, can stop data leaks when arbitrary means to get it are used. Employees and systems are fooled, phished, socially engineered, stolen from, and mess up on a regular and frequent basis. If your information gets out there, it can be gotten.
And if all the information gathered from small leaks in many places were accumulated and mined in one nefarious database, run by someone whose main purpose was to screw over as many people as possible, it would be a huge danger. There would be no "unsubscribe", or "do not call" or FOIA requests that can help you, and no morals to control behavior. Information cannot be revoked.
They only way to defend yourself is to create as many obstacles as possible to collecting and coalescing the information in the first place. Even people you trust can accidentally lose control of the information.
This is the best argument yet for why it *does* matter that you minimize what information is known about you, no matter who it is or for what purpose, no matter how benign it may seem.
Re:Firefox? Opera? Safari? (Score:2, Insightful)
I should say that using IE is wrong and stupid enough.