Cybercrime Is a Franchise Model That Scales 100
Presto Vivace notes a report from the RSA conference on the cybercrime economy, and it's not an optimistic one. Part of the problem is that in many places cybercrime pays much better than legitimate work, including security research. "As the panelists explained, a single spam message might be tied to as many as 10 separate organizations and perhaps five suppliers. Every task in the criminal economy has become a separate specialty. Some people sell e-mail lists, others sell lists of compromised IP addresses, there are sellers of credit card numbers, and those who sell access to bot nets. Then there are those who handle product fulfillment for spammers, and those who specialize in laundering money."
Office Space clearly had an impact (Score:5, Funny)
Re:Office Space clearly had an impact (Score:5, Insightful)
The hard part is getting it out of the country of origin, without it being linked to you as having "left" from you.
Re: (Score:2)
Corporate purchases are watched pretty carefully, especially offshore stuff. They're actually really easy to track weird spending habits. How often do companies spring up out of nowhere, and suddenly start having hundred thousand dollar offshore contracts every few months (or a hundred thousand spread out over a year, still suspicious).
Re: (Score:2)
Re: (Score:1)
Ironically, some of the best ways to launder money are for services. Drug dealers will often set up as some sort of unregulated service (computer repair is popular) and when they make a house call for "service" they sell the drugs, and the money is documented as clean income for that particular service. However, that's laundering money before
Re: (Score:2)
You mean like these folks did [wgal.com]?
Re: (Score:1)
Unless the casino is in on it. You lose a lot of cash there, you don't need to report it. They then contract out to a company you own.
Not much of that left in Vegas these days, though.
Re: (Score:3, Funny)
Re: (Score:2)
Ha ha ha, that's funny, and whee ae the mods at?
Re: (Score:2)
Once you have a million dollars, you have to bring that money back INTO the US to buy that house and car, and with no legal income, that is what raises a red flag with the IRS, and the FEDS, who monitor all money transactions over $5,000 now (used to be 10k before 911). You can still make the money, but you can't spend it.
The traditional way is to open a "legit" biz with high
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I don't think that big. (Score:2)
Personally, I'd want my ill-gotten gains to be sufficiently small that no one would notice. I have a life and a job. If I had some criminal enterprise on the side, I'd want it to be just big enough to keep me with a couple of grand in my pockets all the time. Then I could buy pretty much anything I wanted any old time without being noticed. A new target pistol? A night on the town? Expensive car repairs? A new flat-panel? A new m
Cut of the source (Score:4, Insightful)
Re:Cut of the source (Score:5, Insightful)
The ultimate responsibility for what happens on someone's computer is theirs. There's a lot of hatred for Microsoft floating around here, and for good reason, but holding them responsible because people can't protect their computers in the most rudimentary ways is wrong. It also opens the doors for holding any software responsible for any hacking that occurs on them, even if the user could have prevented it with negligible effort. Considering the state of security in the software industry, that would destroy pretty much every company in existence and set us back 10-20 years.
Re: (Score:2)
Microsoft never claimed to be completely secure? Probably all the sale speech for all Microsoft products (since windows 95 or before) includes some kind of claim regarding security (usually in the form of "this is safe, anything else is not") And probably the security experts aren't the main customer base of Windows, normal people only know that it says that
Re: (Score:2)
Great, so there'd be almost no cybercrime!
Re: (Score:2)
Absolutely ridiculous. I've heard this before, and I think it makes as much sense as holding the door manufacturer responsible for home break ins.
It's more like holding a lock-maker responsible if their locks are faulty.
The ultimate responsibility for what happens on someone's computer is theirs. There's a lot of hatred for Microsoft floating around here, and for good reason, but holding them responsible because people can't protect their computers in the most rudimentary ways is wrong.
It should
Re: (Score:2)
Hyperbole notwithstanding, anyone can make a door and reasonably assess the security of a door themselves. Not everyone can make an operating system and reasonably assess the security of an operating system.
Confusing a door, which any idiot can make in an afternoon
Re:Cut of the source (Score:4, Interesting)
Re: (Score:3, Interesting)
Not all, but most definitely are:
- Unpatched Windows XP (and below) PC's
- patched but already infected Windows PC's
- patched but rootkitted Windows PC's
- patched Windows PC's just infected this week with a zero-day exploit.
So the rest of the botnets would be shared webservers running insecure PHP bulletin boards, and servers running unpatched MS SQL, but these are a tiny fraction.
As you can see, Microsoft's greed is largely responsible for most of
Re: (Score:2)
Re: (Score:2)
It has already happened, and not only with distros, but with Apache and the Linux Kernel as well. What happens? Simple. It's quickly discovered, and then patched within a day
Re: (Score:2)
So what? It's the same problem you have with Microsoft stuff. The patches come out quick enough, it's just that people don't patch their systems or keep them up to date and that's how they get infected.
Re: (Score:3, Funny)
If you want to actually execute it, you have to:
1 - save it to disk
2 - change its permissions
3 - then (and only then) execute it.
It is preferable to force a command line session (terminal window) for step 2, with a "difficult" sequence. Say.. chmod +x CutePuppies.exe. And it should show up on the desktop either...
No "is this allowed?" dialog. No "please enter your password" dialog. Just.. don't.. execute.. it.
I would even go so far as to for
Re: (Score:2)
What fantasy land do you live in? http://www.symantec.com/avcenter/attack_sigs/s22902.html [symantec.com]
http://www.securityfocus.com/news/11511 [securityfocus.com] Concerning the Flash Vuln
http://www.securityfocus.com/news/11512 [securityfocus.com] How fully patched Vista box owned due to the flash vuln, with little to no user interaction.
When an attack exploits a weakness in something running on the system then in essence CutePuppies.exe may not run without interaction, but CutePuppie
Re: (Score:2)
And my mother always said that (Score:5, Funny)
BRB, watching to see if the kettle boils.
Re: (Score:2)
Re: (Score:2)
For those who don't get it, Randall, the guy on the left, writes XKCD, and the guy on the right is me (check out the name badge, infidels).
Off course (Score:2)
There are after all established concepts of taxes, payday loans and patents that pretty much amount to the same thing.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And the recent Fed rescue of investment banks. Making money by taking it from people wins any day of the week.
FED didn't rescue investment banks. That's just how the news got reported to make the story more sensational. They arranged for a merger to take place and gave a loan on which the FED will actually make money. Taxpayers are in no way involved. Taxpayers pay their money into the US Treasury. FED lends money out of thin air -- not out of the treasury. Yes, "out of thin air". It says the money exists and by the virtue of that fact it comes to exist. And when the loan is repaid, the money ceases to exis
Is pay really the reason? (Score:5, Insightful)
Crime almost always "pays better" than so-called legitimate work (is crime really considered a profession?) Well I guess you could say it is a part of the problem, but the OTHER part of the problem is the risk of getting caught is too low. It is a risk/reward model. There are other factors in play here too, for example people's morality. Even if there were little risk and great reward, some people have a moral system that would still prohibit them from undertaking a life of crime.
Re:Is pay really the reason? (Score:4, Insightful)
Re:Is pay really the reason? (Score:5, Insightful)
Re: (Score:2)
So who decides who is a crook and who is not?
We The People.
In the perfect world, we would have a working democracy and organizations like RIAA would be legally disbanded and their money redistributed to their victims (such as artists) or used for worthwhile social programs. Unfortunately, we have a two-party system that stacked the rules to prevent election of grass-root candidates. Truly courageous people should join an uprising to restore working democracy. But in the meantime, stealing some money out of the system to weaken it's power can also be
Re: (Score:2)
1. Stealing from the "rich", (theoretically).
2. Giving to the "poor", (theoretically).
3. Discerened by the angry mob.
4. Done on the basis that people have a moral right to what other people earn.
Sounds a lot like Communism to me, and we all know how well that worked out.
Re: (Score:2)
Obliviously men with small penises or low libido and women with small breasts.
Re: (Score:2)
Mine: An individual or corporate entity that lies, cheats, and swindles for their own gain. Not just to the detriment of "society", but an individual as well.
Based on my definition it seems his list hits the nail on the head. Microsoft is already a convicted monopolist. RIAA has gotten quite a few slaps in court for trying shifty tactics. Dick Cheney, enough has been proffered on this forum abo
Re: (Score:2)
Re: (Score:2)
Re: (Score:1, Troll)
Yes, even then. By feeding their populace, you'll be freeing the warlords from having to concern themselves with, you know, governing the country. From providing the food, to education, to building and maintaining roads, all the way up to the monetary policy... You are likely one of the voices in the chorus condemning Bush for spending too much on Iraq "instead of helping social programs". Now imagine, if some ub
Re: (Score:2)
Clearly we lack the mechanism to set consistent rules in "fair, non-authoritarian fashion by a group process".
Robin Hood Rich/Poor Dichotomy (Score:2)
Re: (Score:3, Interesting)
>>> Can they save any for a rainy day, or would that make them no longer poor and ineligible for the next payout to the poor from Robin Hood?
If you're a medieval peasant (probably a serf) given enough money to buy a sack of flour you won't go hungry for a few weeks. You'll still be in need, with more money you could buy vegetables, more still you
Re: (Score:2)
In fact knowing a lot of this makes you a lot of money consulting people and companies wanting to do such a thing.
Re: (Score:2)
Crime really is a profession. The "criminal world" is in reality just the free market at work. There are services that people want performed and there are those who perform the service. Like a lot of laws, most of the computer trespass laws are there to protect stupid/uneducated people from themselves. They are there to protect those people from "being taken advantage of" by others. Of course in
Product Fulfillment? (Score:1)
Wait, those spam messages are actually selling something? I always just thought that it was a ruse to get your CC info.
Re: (Score:3, Informative)
I don't get it... (Score:2)
Re: (Score:1, Funny)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
The real mechanism at work is capturing credit card data.
That's the thing, though... if all they're after is credit card info, why bother with product fulfillment? That's what TFA referred to as one of the parties involved, so there's got to be more to it than just that. And wouldn't credit card companies figure out the statistics pretty quickly if a particular customer of theirs has a really high percentage of credit card numbers that end up being used fraudulently?
That makes me think that those stealing card numbers and/or personal data aren't bothering with p
Re: (Score:1)
Addicts, usually.
When Chris "Rizler" Smith was convicted and sentenced to 30 years in prison for his numerous crimes (among them, pharmacy spamming and money laundering,) court transcripts showed that he routinely spammed known repeat addicts of controlled substances. This was his prime target market.
Not everybody is purchasing their meds from criminal spam operations. But people who have
WTF? (Score:1, Funny)
Re: (Score:1)
The Cybercrime Economy
Posted by Thomas Claburn, Apr 9, 2008 08:33 PM
Dot-coms daunted by the financial downturn would be well advised to look to the cybercrime economy.
Cybercriminals "have very sound business models," said Joe St Sauver, manager of Internet2 Security Programs through the University of Oregon at an RSA Conference panel on Wednesday, "better than many corporate business plans I routinely see."
The
Re: (Score:2)
And they're taking advantage of the victim's greed. His desire to participate in the scam. I mean, they typically do this under the pretense of laundering money, so the victims aren't exactly blameless in many of these scams.
The question is, should we then protect the victims? People who were so wil
Economies of scale (Score:3, Informative)
The problem: FBI Baltimore (Score:4, Interesting)
We need the FBI Baltimore office [fbi.gov] taken out of the business of distributing child porn and put on this problem. After ten years of work, they've arrested over 6,000 people.
How many computer criminals have they arrested? The Department of Justice doesn't seem to provide useful statistics [cybercrime.gov], but it looks like the number per year is in the 10-100 range.
This is backwards, given the relative size of the problems.
Part of the problem is that the FBI has a measurement bias against white-collar crime. See the FBI Crime Statistics [fbi.gov] page. Violent crimes are counted if they are reported; white collar crimes are only counted if there's an arrest.
Re: (Score:2)
Inciting crime? (Score:2)
Not sure how much it will scale before reaching some kind of saturation point. There are some numbers that cut in some way the amount of players in the field (like 50% of all internet spam coming from just one botnet, or malware removing other kind of malwar
And we STILL don't have a LEGAL definition of spam (Score:2)
The best we have from a judge — just quoted in a different article-submission [slashdot.org] is:
Awesome, judge, let's leave the judging to the demos... "Community standards", anyone?
Heck, according to my Firefox (2.0.0.13, thank you very much) spell-checker, the very word "spammer" does not even exist — much less legally defined. (Well, the word "firefox" does not exist e
Not just cyber (Score:3, Interesting)
In fact, society should be damned glad that most slashdotters are honest and have conscienses (no that's not spelled right, so jail me) because if most of us were dishonest we could do one hell of a lot of damage!
Some times I wish I could be dishonest, I'd be a rich man. But it's just not in my nature.
Not in your nature? Sure it is, but... (Score:2, Insightful)
CASE STUDY: Matt Dillon
My brother own's a bar frequented by Matt Dillion, the mult-millionaire, super-naturally gorgeous, very famous actor. And he's never seen anyone so utterly terrible at picking up girls. Why? Because he's never *had* to be good at chatting up girls, he's been a movie star since he hit puberty. If he'd needed to learn how to chat up girls, he'd have learned.
You're bad at being dishonest for th
Re: (Score:2)
Tami (AKA "Lucy Furr", she's in some of my journals) is one of those. Of course, her whole family is dishonest (and monied) from what I hear.
There's another woman I know (also in the journals), Casey, who's a crack whore despite being born into money. You just never know.
Re: (Score:2)
Re: (Score:2)
I have two kids, Linda has 15 counting the one that died. She beats me at the genetic olympics. She just got out of prison 2 months ago.
Another Part of The Problem (Score:3, Insightful)
Another part of the problem is that our cyber enforcement budget leans heavily toward pornography, gambling, and copyright.
Yet another part is that corporations and politicians are unwilling to kill their fatted calf that is "legitimate" UCE.
Remember that ancient business adage (Score:2)
In this case...online. Don't forget to get an easy to remember
Credit the Inherent Decentralization (Score:1)
Makes me glad the author of t
I stopped being optimistic about security long ago (Score:2)
Those gigs were rarely happy ones. I came to the conclusion that there is no adequate technical solution to the security problem. Arguing that any given platform (Mac OS X, L
This is capitalism at work! (Score:1)
Our politicians don't get any spam. (The ones, that is, who actually own a computer.) Cybercrime is not their problem. Let the market figure out a solution.
"Yeah!"
IP addresses of compromised machines (Score:2)
[1] List may contain some non-compromised machines