Slashdot Mirror
Fighting Online Extortion
prostoalex writes "Information Week talks about those mornings, when an owner of an online business receives an e-mail message with his customer accounts and other personal information quoted, and extortionist asking for certain amount of money to be transferred to a foreign bank. Although 70% of the businesses surveyed for the article claim they never had to deal with extortion on the Internet, the article claims those small businesses who think they are not interesting for extortionists, are in for a surprise."
Bravo!
* * *
There are plenty of ways of preventing DDOS attacks, most of which, unfortunately, call for SKILLED network operators.
This extortion isnt like conventional extortions where in you get your thing back when you pay.
The extortionist obviously would have made copied of the data, and would hav given to so many of his friends.....If someones gonna pay,would he be paying to every one of the mails asking for the same data he had paid?
LOL
Sorry, but I think the website owner has already lost the battle - Unless the extortionist get caught - provided the duplicated data doesnt isnt with anyone!
Why does yahoo do this
That only works when both sides are always reasonable.
The higher the technology, the sharper that two-edged sword.
I have a small ecommerce site and this ocurred to me one time.
I received an email with my personal data and asking me to contact him.
I contacted host service and investigate for possible bugs and raw logs, but I never reply. Finally I think they get my data from whois services.
How does the Slashdot Effect happen given that no slashdotters ever RTFA?
There are analogies with the telcos enabling dial out frauds by sticking it to the customer. If the telcos and banks were responsible, they'd be real careful who they gave other people's money to.
Like most media "news" stories.....
eat shiat and bark at the moon
I'm sure the first thing the authorities (or anybody even) would do is check out who has the highest motive for starting an extortion scheme like that. If it's well known that these 2 people have issues with the company, the first thing any competent investigator would do is question them first. This is not to say that the damage wouldn't have already been done at this point, but it should at least be some comfort that they would most likely be caught and made an example of.
That is the way to go. Yes, security is a good start but it is impossible to completely become immune to attacks.
Therefore I say to spend the resources on insurance and simply ignore the threats and attacks. The extortionist get nothing and may waste his power on absolutely nothing, running a serious risk of getting caught - all for nothing.
The company has their assets insured and lose nothing.
In a few days all the extortionists go back to breaking legs for the local loanshark. There they at least get something for their efforts.
It's a lot like terror - it only works (for the terrorists) if they get something out of their efforts. Saying no to them and hitting them back just as hard will make them think twice. They get nothing but trouble out of their efforts and this will - in the long run - make them change their MO and possibly go back to their farms or whatever their dayjob used to be.
Oh, and the other thing I forgot to mention about the summary is that the story isn't even about stealing customer data and using it for extortion. The story is about threatening random sites with DDoSing if they don't pay. Very different scenarios since it's far more difficult to protect against the later. Once again, good job submitter.
Is it really the extortionists driving the companies out of buisness, or is it that the companies played fast and loose with OUR personal data and now they are worried about the lawsuits?
They figure the lawsuits and lost sales from this leaked information would cost X amount of money so they're willing to pay less than X to stop the leak. Maybe they should have kept the sensitive information safer in the first place.
This is a result of either incompetence or knowingly cutting corners. (or just plain using Microsoft software. which is both.)
Liberty.
Last I heard, Hustler magazine spent over one million dollars per year just on legal expenses, and generally they do not violate the law. This is probably an extreme example, but I imagine that lots of porn business spend above average amounts on legal expenses just because of the nature of their business. Anything that draws attention to you could very well increase that ...
Contact the FBI or some other from of crime investigation unit. Change all the accounts if possible. Also you should make a bunch of fake accounts before hand (As well as tightening up your computer security, and for god sake Hire an independent consultant to run security audits on your network and your code as well if possible)
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Yeah, but most companies are run by idiots. Seriously. They think nothing of dropping $100,000 on ISO9660 consultants, $100,000 on "efficiency experts", etc, etc.
When your revenue is several tens of million a year (for a mid sized company), 100,000 looks cheap, even if it is something that could be handled a lot cheaper.
One thing I've noticed, people are resistant to change generally. But if that change comes from highly overpaid consultants, people are more willing to change the way they do things. Of course that doesn't much address the problem of stagnant employees and managers.
I've had enough abrasive sigs. Kittens are cute and fuzzy.
We had a team come in to examine our NOC. The first thing they wanted when they came in was valid IPs and subnet listings. In front of my boss, I told them to get stuffed. If they want to do a test, let them come. But I'm not giving them any help at all.
In any event, they charged a lot and found little. In the outbrief, they made even the smallest problems seem huge. I guess they may have had a point.
IMHO, the team that came to see us charged a lot and did not really acomplish anything.
I'd rather you do it wrong, than for me to have to do it at all.