Forgot your password?
typodupeerror
Security United States

US Responsible For the Majority of Cyber Attacks 205

Posted by CmdrTaco
from the we're-number-one-we're-number-one dept.
Amber G5 writes "SecureWorks published the locations of the computers from which the greatest number of cyber attacks were attempted against its clients in 2008. The United States topped the list with 20.6 million attempted attacks originating from computers within the country, and China ran second with 7.7 million attempted attacks emanating from computers within its borders. This was followed by Brazil with over 166,987 attempted attacks, South Korea with 162,289, Poland with 153,205, Japan with 142,346, Russia with 130,572, Taiwan with 124,997, Germany with 110,493, and Canada with 107,483."
This discussion has been archived. No new comments can be posted.

US Responsible For the Majority of Cyber Attacks

Comments Filter:
  • Yeah! (Score:5, Funny)

    by Spazztastic (814296) <spazztastic@@@gmail...com> on Tuesday September 23, 2008 @12:32PM (#25123619)
    Those bastards hacked my Yahoo mail!
  • Within the U.S. (Score:4, Insightful)

    by Ethanol-fueled (1125189) * on Tuesday September 23, 2008 @12:35PM (#25123665) Homepage Journal
    The majority of cyber-attacks(controlled by their Chinese and Russian overlords) originate within the U.S.
    • Re:Within the U.S. (Score:5, Insightful)

      by Otter (3800) on Tuesday September 23, 2008 @12:48PM (#25123913) Journal
      Also, these numbers are limited to attacks against the clients of a US-based firm, and are probably skewed accordingly.
      • by kesuki (321456)

        i think the bad summary http://entertainment.slashdot.org/article.pl?sid=08/09/23/2052200 [slashdot.org] here about users just automatically clicking 'ok' to get rid of popups... might have something to do with 'where' attacks come from.

        notice how low japan is on the list, while china is up high? perhaps the Japanese are superior at correctly closing out popups that install malware, while americans 'just click ok' and give hackers the platform to launch attacks from.

    • by Anonymous Coward on Tuesday September 23, 2008 @12:49PM (#25123941)

      We should fight them over there so we don't have to fight them over here!

      We could also just send Sarah Palin over to Russia and ask them nicely to stop. After all, she can see it from her house, she already said she would cross a sovereign nations' borders without permission if necessary, and apparently she's ready to engage on foreign policy and relations.

    • Sure it's impossible to know if the computer is some script kiddie or a hacked PC owned by a Russian college student - and subsequently it's impossible to come up with figures on who actually is responsible for the attack.

      However, this does tell you which networks are used the most by hackers (or script kiddies, depending on how you define attacks) which is still very useful information.
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      The majority of cyber-attacks(controlled by their Chinese and Russian overlords) originate within the U.S.

      Do you have any legitimate source to back this statement?

      • He clearly thinks his countrymen are too stupid to be the brains behind these attacks, and are only capable being mindless sheep who allow thier computers to get owned.

        He must really hate America.
    • by pembo13 (770295)
      citation needed
  • Riiiiiight (Score:5, Insightful)

    by $RANDOMLUSER (804576) on Tuesday September 23, 2008 @12:35PM (#25123673)
    So

    port scan == attempted attack

    Sounds plausible.

    • by Goaway (82658)

      Do you honestly think anything but the tiniest fraction of port scans are not malicious?

      • by Hatta (162192)

        100% of port scans I initiate are not malicious.

        • by Goaway (82658)

          And?

          • by Hatta (162192)

            And, absent any data to the contrary, I'd assume most people out there are like me. The vast majority of people don't run malicious port scans. The small fraction that do, probably do more port scans than the average person. So on the one hand you have a big number of people running a small number of port scans, and on the other hand you have a small number of people running a large number of port scans. I have no reason to believe off hand that one side is disproportionately larger than the other side.

            • by Goaway (82658)

              Except, you know, that honest people don't run port scans on random machines that aren't theirs.

              And you're severely underestimating just how widespread and automated exploit scanning is among the criminals. It's not like they're sitting around running nmap by hand.

              • Except, you know, that honest people don't run port scans on random machines that aren't theirs.
                It's great that you say this like it's true. It proves to me that we need to educate.

                • by Goaway (82658)

                  Educate people that somehow the the port scans that hit them every day might, once in a thousand tries, not be malicious?

              • by Hatta (162192)

                Except, you know, that honest people don't run port scans on random machines that aren't theirs.

                Why not?

            • The vast majority of people don't run port scans at all, so you've managed to disprove your own theory.
      • Is it illegal to knock on each persons door going down the street?

        Its your computers choice if you answer, is it not?

      • by arth1 (260657)

        Do you honestly think anything but the tiniest fraction of port scans are not malicious?

        I get lots of scans for open proxies logged on my firewalls and routers. While these may be malicious, I am willing to entertain the idea that a lot of them are from netizens whose local providers block access to "objectionable" materials. I would not call that malicious.

        There are also accesses that are blocked that are clearly benign, but there is nowhere to send the request. Common examples include ident traffic, wh

        • by Goaway (82658)

          While these may be malicious, I am willing to entertain the idea that a lot of them are from netizens whose local providers block access to "objectionable" materials.

          Yeah, no, that'd be pretty naive right there.

      • I've been in I.T. and Internet Technology for 15 or so years, and remember when "port scanning" even started appearing. It's no more malicious than me walking by your car to see if the door-lock buttons are up on your car doors. Sure, we all know what the reason for it is, but there's nothing illegal about it. Ultimately, it could be someone admiring the window tinting. (or in scanning, someone seeing what a good organization uses as it's forward-facing firewall architecture with an nmap.)

    • With 20.6 MILLION data points, these are laughable results at best.

      Define "attack". Then go define "originate".

      If "attack" comes back as "unknown intentions" and "originate" comes back as source IP Address, all we can say for certain is that the Internet is no safe place in 2008.

      But we already knew that.
  • Ummm, duh? (Score:3, Insightful)

    by R2.0 (532027) on Tuesday September 23, 2008 @12:35PM (#25123675)

    Formula:
    #zombies=#computers * X%

    I mean, isn't it that obvious?

    • Re: (Score:3, Insightful)

      Not really - the Canadian figures should be around 3.4 million and the German around 8 million if that were the case. (This is using the Linux Counter [li.org] for rough numbers of computers. Canada has 17% of the US values, Germany 40%.)

      ...

      Besides, any formula involving zombies needs to include some mention of number and location of malls, and at least passing mention of braaaaainzzz.

    • by Goaway (82658)

      No, it's not. Local computer culture plays a big role in how easy it is to infect personal computers and servers.

  • redirection (Score:5, Insightful)

    by Anonymous Coward on Tuesday September 23, 2008 @12:35PM (#25123677)

    Of course, hackers always use their home ip, and never bounce off of compromised clients in other countries.

    • Re:redirection (Score:4, Informative)

      by db32 (862117) on Tuesday September 23, 2008 @12:37PM (#25123733) Journal
      Good job on reading the article. You know, the part where every other paragraph other than what was cut for the summary points this out and how to defend against this very thing.
      • by yoinkityboinkity (957937) on Tuesday September 23, 2008 @01:14PM (#25124345)
        We're supposed to read the article?
      • Actually... (Score:5, Interesting)

        by CorporateSuit (1319461) on Tuesday September 23, 2008 @01:17PM (#25124393)

        Good job on reading the article. You know, the part where every other paragraph other than what was cut for the summary points this out and how to defend against this very thing.

        You know, they never draw that conclusion in the article. They just say that some attacks originating from a given country may be initially controlled from a different country. They don't go into ip masking/spoofing or any of that... Why would they want to expose the limits to their services when this article was written in an attempt to sell something?

        • Re: (Score:3, Informative)

          by Zironic (1112127)

          Unless you're performing a DoS isn't IP spoofing very counterproductive since you cant get a response?

          • by PitaBred (632671)

            Or you just send "start" commands to your bots. Who needs a response? Let them do the hard work and expose themselves.

          • Re:Actually... (Score:4, Informative)

            by SgtAaron (181674) <aaron@coinet.com> on Tuesday September 23, 2008 @03:53PM (#25127187)

            Unless you're performing a DoS isn't IP spoofing very counterproductive since you cant get a response?

            Usually, yes. But some things can be accomplished, like the Windows Messaging spamming coming into UDP ports 1026-1028, nearly every second of every day it's coming into our network, trying to pop-up messages onto Windows users' computers. The messages tell them their computers are infected and they need to go and download something to fix it. Well, you can guess what will happen if they do :) Oh, they are being sent with spoofed addresses appearing to come from Shaw Cable.

            From our cisco's access-list counters, which was just reset yesterday:

            deny udp any any range 1026 1028 (8692 matches)

            We've a reflexive access list that will allow UDP incoming on those ports if originated inside the network.

            Lots of traffic comes from the reserved IP blocks, too. As well as spoofed local IP addresses. All sorts of nastiness.

            deny ip 10.0.0.0 0.255.255.255 any (4232 matches)
            deny ip 172.16.0.0 0.15.255.255 any (603 matches)
            deny ip 192.168.0.0 0.0.255.255 any (1540 matches)

            -Aaron

      • by lymond01 (314120)

        Good job on reading the article.

        Article? You mean there's more to read than just what's on Slashdot?

        This explains...a lot. Wow. I guess I've got a lot of reading to catch up on. Uh...see ya...

      • by CSMatt (1175471)

        You have violated one of the most sacred of rules on Slashdot: never reading the articles.

        Turn in your UID. Now.

        • by db32 (862117)
          Clearly you are new here. There are a number of castes here.

          Grammar Nazis
          Spelling Nazis
          Trolls
          First Posters
          Meme Propogators (underpands gnome jokes, **AA jokes, grits, portman, the list goes on forever)
          UID Groups (turn in your UID jokes, you are new here jokes, UID snobbery, etc)
          Summary Reactors
          and then finally, in primary opposition to the Summary Reactors the RTFAA. Read the F'ing Article Association.

          Many people are members of multple castes. There are also other castes that present from time
          • Many people are members of multple castes. There are also other castes that present from time to time.

            So you're saying Slashdot supports social mobility? I'm tired of slumming with the trolls. I'm read to start moving up to the middle-class spelling/grammar nazis. One day, I hope to move all the way up to meme propagators (not "propogators" -- hey I'm moving up already!).

            • by db32 (862117)
              I suspect it is more related to multiple personality than it is social mobility. Damned spelling nazi...
  • 20.6 million (Score:3, Interesting)

    by morgan_greywolf (835522) on Tuesday September 23, 2008 @12:36PM (#25123687) Homepage Journal

    And out of how many computers connected to the Internet? I'm willing to bet China's "per machina" rate is higher.

    • by Sj0 (472011)

      Why would China use a latin-based metric? :P

    • by Rary (566291)

      And out of how many computers connected to the Internet? I'm willing to bet China's "per machina" rate is higher.

      Since China actually has more internet-connected computers than the US, I'll take that bet.

    • Like others pointed out, China has more computers, so their per-PC rate is lower.
  • Leaving their broadband-connected computers 24-7!

    • Re: (Score:3, Funny)

      by JeanBaptiste (537955)

      well I'm a windows user that leaves my broadband connected computer up 24-7, and I guarantee none of my boxes are causing the attacks. Except for when I'm the one doing the attacking. Er, uhm, nevermind...

      • Re: (Score:2, Insightful)

        I run Windows XP under VirtualBox on an Ubuntu Linux machine that is connected 24x7. What does that make me?

        • by WK2 (1072560)

          Damn Windows Lusers! Leaving their broadband-connected computers 24-7!

          I run Windows XP under VirtualBox on an Ubuntu Linux machine that is connected 24x7. What does that make me?

          A smart ass.

        • by c6gunner (950153)

          Bill Gates?

  • Woot! (Score:5, Funny)

    by SatanicPuppy (611928) * <`Satanicpuppy' `at' `gmail.com'> on Tuesday September 23, 2008 @12:37PM (#25123717) Journal

    We're #1!
    We're #1!

    I'm sure the bulk of it is just that we have more computers. I'd have thought Japan would have been higher though, if that were the primary factor, so maybe not.

    • Japan's population is less than half that of the US. They'd have to average over 2x the number of computer that can pull of an attack than the US, and I highly doubt that's the case.
    • Re: (Score:2, Interesting)

      by aykroyd (82171)

      According to Akamai's quarterly "State of the Internet" report, Japan and the U.S. account for "over 50% of observed [attack] traffic in total."

      You can see the executive summary and download the report here [akamai.com].

      Full Disclosure: I work for Akamai.

    • We're #1! I'm sure the bulk of it is just that we have more computers.

      I highly doubt that. Germany (to take just one example) has a population of about 80 million, which is roughly a quarter of the U.S. Even if we assume that the rate of computers/person is only half of the U.S. (which is definitely not the case) Germany should originate about 1/8 (12.5%), while the actual number seems to be around 0.5%.

  • by Zymergy (803632) * on Tuesday September 23, 2008 @12:37PM (#25123727)
    A list of their "Clients" might be useful as well as interesting while taking their numbers and the source of the "cyber attacks" into consideration...
    It might be that as the US is the greatest English-speaking population with disposable income, the US may be a better target and thus is targeted from within the itself more often??
  • Number One! (Score:5, Funny)

    by ireallylovelinux (589360) <brianherman@bria n j h e r man.com> on Tuesday September 23, 2008 @12:39PM (#25123743) Homepage
    I guess on the internet axis of evil we are number One!
  • by BountyX (1227176) on Tuesday September 23, 2008 @12:40PM (#25123765)
    Many of the attacks originating from China are actually from the US as well. Many US hackers find it easy to compromise chinese machines and use those machines for whatever they need. I'm willing to bet a hand full of Chinese attacks are actually originating from the US as hackers seek to use easily compromised machines that are unlikly to work with the US (politically) if the US asks for connection info from an ISP. As a result, a lot of US originated hack trails stop in china.
    • by Missing_dc (1074809) on Tuesday September 23, 2008 @12:46PM (#25123887)

      On the flip side of that would be the large # of botnets that are foreignly controlled, which is where most of TFA's attacks probably originated.

      Also take into account the # of computers running unattended (and likely infected)in the US vs the rest of the world.

      So, do we try to cut off the monster's hands or its head?

  • by Phizzle (1109923) on Tuesday September 23, 2008 @12:43PM (#25123823) Homepage
    All those AOL users who leave their boxes up 24/7 are infected with cooties that use their machines to haxx0r the rest of the world and steel their megabites, oh n0s!
  • At first when someone pointed out to me, that Canada, my home country had the least amount of attacks, he spun it to me in a sad manner. "Aww we have the least amount of hackers :(" To which I responded "No no young padawan. We have the least amount of hackers who were traced" GO CANADA!! Milk in a bag FTW
    • by c6gunner (950153)

      At first when someone pointed out to me, that Canada, my home country had the least amount of attacks, he spun it to me in a sad manner. "Aww we have the least amount of hackers :(" To which I responded "No no young padawan. We have the least amount of hackers who were traced"

      Agreed. When I was a teen (growing up in Canada), I used to dabble in the dark arts. I can guarantee that no "attacks" ever originated from my IP. Of course, if anyone had been paying attention, they may have noticed 2,500 computers

  • Soooo.... (Score:5, Insightful)

    by Sta7ic (819090) on Tuesday September 23, 2008 @12:52PM (#25123985)
    ...can we lump the MediaSentry/SafeNet "investigations" in the numbers for these attacks?
    • by jd (1658)
      MediaSentry/SafeNet employees are a mix of Borg, T1000s and Daleks. This makes attacks by such groups (Cyber^2) Attacks. As the *AA are run by Cybermen and Cylons, if you trace back to them, the attacks become Cyber Cubes, which sounds like a really neat game machine for alien marauders.
  • Come on, this is the first bit of upbeat news on the tech sector that the US has had in a while.

    The banks might be tanking.

    The Hell-desk might be going over seas

    But when it comes to Cybercrime the US still leads the way as the Gambinos of the internet.

    USA - A OK... come on you know you want to shout it.

    China might have a state backed machine, but that is no match for the free market capitalism of corruption and crime that can support a much larger and more effective cybercrime base.

    So don't doubt it and say

  • I bet this does not take into account the use of proxy servers.

  • by quarmar (125648)

    2 out of 3 US hackers choose SecureWorks clients. Remember, discerning hackers choose SecureWorks.

  • ...has so many people with computers, and too much free time?
  • by nick_davison (217681) on Tuesday September 23, 2008 @01:43PM (#25124863)

    You'll notice pretty much any survey of crime shows:

    Violent Crimes per 100,000
    Serious Sexual Assaults per 100,000
    Murders per 100,000
    etc.

    They don't just say, "Crimes" because...

    Any smart person would choose somewhere with a billion people and 10,000 crimes over a million people with 1,000 crimes. That's why per capita is critical.

    Any smart person would also likely choose somewhere with 10,000 littering offences and 1 murder over somewhere with 1000 murders.

    It only takes two massive cyber attacks against the entire infrastructure of Georgia and Estonia to make Russia (assuming you don't accept their denials) far more offensive on a global scale than a million spam botnets.

    Now which is worse? The country that spams millions of times or the country that cripples the infrastructure of any small nation that dares oppose it? Still care about pure numbers without caring what the numbers actually record?

    I'm not claiming the U.S.'s vast numbers of offenses are purely the equivalent of littering, nor that they never do anything worse... Simply that big but meaningless because it's not clarified number A vs. big but meaningless because it's not clarified number B is still... meaningless.

    • Re: (Score:2, Funny)

      by Explodicle (818405)

      Any smart person would also likely choose somewhere with 10,000 littering offences and 1 murder over somewhere with 1000 murders.

      That second place just sounds like it has some healthy anti-littering vigilantism.

  • No surprises there

It was kinda like stuffing the wrong card in a computer, when you're stickin' those artificial stimulants in your arm. -- Dion, noted computer scientist

Working...