Slashdot Mirror
Security Attacks Increasingly Motivated By Greed
earthstar writes "E-commerce has emerged as the "single most targeted industry" according to the latest Internet Security Threat Report from security software provider Symantec, with hackers now appearing to be motivated by economic gain rather than notoriety.
"We're seeing an increase in profit-motivated attacks," says Vincent Weafer, senior director of Symantec's virus research team. Also in
Information week"
It was discovered recently, that majority of activities of humans are driven by economic gain ...
This is the equivalent of the pinhead bosses for attackers. The creative ones lead the way and did something interesting (though morally problematic) by working out attack strategies. Now the PHB-equivalents come in and focus solely on lining their pockets. Yawn.
Hacking (despite what the movies tell you) has more often than not had a profit motive. From people screwing around with banks, to corps trying to get info on their competitors ect...
It seems now though more and more of the stupid amateurs are trying to get in on the Hacking for Fun & Profit gig.
people have two legs! seriously, why was this posted? really, does taco have nothing better to post? quizzes about staplers and aol policies. YAWN! man, this site's goin downhill
Apparently Symantec's current marketing strategy wasn't working, so now they have to use profit-related scare tactics. "Vested interest" anyone?
"Companies using e-commerce also retain a lot of data about customers, account numbers and personal information, and a lot of smaller businesses conducting transactions online don't put the money into security, so they become easy targets," said Donovan.
According to Donovan, many small businesses still do not have an "appropriate level of security".
The larger problem is that many small business do not have an appropriate level of *clues* about security.
Small business owners that are not tech-savvy are no better off than the average Joe Six-Pack that gets on the internet. Most unfortunately wouldn't know what it means to update your anti-virus/malware/spyware signatures, much less do it. By the time they do finally call for tech support their network and much of their IT assets, have been 0wn3d.
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
Well, any investigation will probably be a lot faster and more thorough if there's money involved than if someone just gets root access and leaves.
;)
Most things people do are for money. Sex too, but if you can hack, you're already precluded from the latter
.
"We have seen a pretty rapid shift in the style of threats by hackers as they focus more on key-logging and phishing scams for financial gain," he said.
Oh really? Is Symantec able to quantify an increase in the number of "hackers seeking financial gain" that would qualify the headline of the article? I don't see any stats.
"Companies using e-commerce also retain a lot of data about customers, account numbers and personal information, and a lot of smaller businesses conducting transactions online don't put the money into security, so they become easy targets," said Donovan.
Oh. So businesses should give money to Symantec, right?I mean are these people like convience store robbers or jewel thieves? Convience store robbers are thieves of opportunity, they just see a place that seems vunerable and hit it. Do the attackers just release exploits out into the wild(or just use other peoples exploits) and see what sticks?
Or are they more along the lines of jewel thieves, carefully staking out their victim and carefully planning their heist. My guess is that they are more like the former than the latter, but the study doesn't really say much.
Monstar L
is that this is purely about money. And yet it is IIS and MSIE that are targeted, not Apache and *nix. I guess that must be becuase IIS has the vast majority of the market and therefor the money folks go for the larger number of machines.
I prefer the "u" in honour as it seems to be missing these days.
Five years ago, if you were l33t (= had a few technical skills you could show off), you could work for a .com and get big bucks just for showing up. Now that most .coms are .deads, getting money for technical skills is harder.
It makes sense that as legit jobs are harder to get, some people, especially those who got addicted to the easy money, will look for non legit work.
-- Support a free market in the field of government
Greed, for lack of a better word, is good. Greed is right. Greed works. Greed clarifies and cuts through and captures the essence of evolutionary spirit. Greed in all of its forms, greed for caffein, for FLOPS, for frags, knowledge has marked the upward surge of mankind. And greed, you mark my words, will not only save OSS, but that other malfunctioning corporation called Microsoft.
This has been the way of things since the beginning of time. For each accomplishment that results from hard work, inventiveness, and bonds of trust there is a group of free loading dirt bags that will exploit it's weaknesses for selfish gain.
E-Commerce is big enough now to attract the attention of criminals. I suppose that's an expected milestone for E-Commerce. The cowboy days of fast progress in an arena of trust and goodwill are over.
Symantec is releasing daily reports, apparently motivated by economic gain.
I'll turn into a supernova and burn up everything. Well I'll turn into a black little hole and you'll turn into string.
Curiosity... the gateway drug?
I get at least one purchase made by a stolen card every week, and in some instances I've been able to trace the owner of the card details.
In every single case, they've told a tale of how their PC got trojaned a few weeks back and they had to get it cleaned up. They're always quite shocked to learn of the real effects of what happened. Up until then, they just see it as an inconvenience and something you just have to put up with once in a while, like unblocking the kitchen sink.
Sometimes though, they review their credit card statements and find other small purchases that they're overlooked, then realise that they had been screwed little by little over a long period.
In every case, they've been more than happy for me to send them a copy of TheOpenCD or Knoppix so they can either install Moz or use Linux at least for their online stuff.
The recent activities of the botnet barons and phishers have certainly caught the attention of the mainstream press though, which is great publicity.
Like tinyurl, but one letter less! http://qurl.co.uk/
You're point is well taken and I am not going to challenge it, but I think I know why the mainstream media would make a big deal out of an insipid story like this. It involves the perception of hackers as highly motivated by notoriety, a perception that the hacking community brings upon itself.
Many hackers try to justify their activities (to judges, the media, their parents) by suggesting that:
-They weren't going to harm anything, just see if they could do whatever it was they were attempting.
-They were doing a service by exposing vulnerabilities.
-They were just joyriding.
I think that these justifications have never sat well with established technophobes, thus we have spurious articles like these trying to paint all hackers with the same brush.
Of course Symantec is going to put out reports stating that attacks of some sort are on the rise. Its what they do. But as others have posted here, I dont see any stats. Most of the time these things are all marketing bs - I mean say that the total percentage of haxx0r crime has really dropped, but that the profit motivated atttacks have risen (even though the total crime has dropped!) - which will Symantec report to you? They will never say that Haxx0ring has declined. Will that make them money?
---
My sig was stolen - the insurance company replaced it with this one.
earthstar writes "Fear among pc users has emerged as the "single most targeted industry" according to the latest opinions from IT users with news releases by security software provider Symantec now appearing to be motivated by economic gain rather than information. "We're seeing an increase in profit-motivated attacks," says Area man. Also in Information week"
How about them there Evil Terrororists?
Hide your messages in spam with steganography and broadcast them. This way, traffic-flow-based techniques won't work.
By this premise, the DHS has a valid and critical reason to go after spam and zombies.
The living have better things to do than to continue hating the dead.
So the guy tries to change the use, get over it.
Analogies don't equal equalities, they are merely somewhat analogous.
It's wrong to use a phrase like "economic gain" to describe the money stolen through criminal actions like fraud and extortion. People who do this are destroyers of economic value, not creators of it.
The problem with computer security, with windows PCs in paticular, is that the OS administration is still designed with the expectation that the PC resides on a token ring network with no net connection, or one that goes through a Unix mainframe. Currently all operating systems seem to expect a sysadm to be a phone call away in order to be updated, patched and administered.
This is clearly unrealistic. We already know that this expectation coupled with the obvious lack of systems administrators for lone PCs, has lead to a great many slashdotter being the de facto sysadm for their friends and family. Clearly this solution falls on its ass when faced with PC owners with no such tech head to call upon. These PCs are probobly doomed to become spam zombies or to take part in DDOS attacks.
It's 2004, not 1984. Most PCs will likely never even be looked at by someone who can admisister them. I'm not just talking about patching and updating virus scanners. What about simple tasks like defragging? Does anyone really think that Aunt Tilly will defrag her PC? What about firmware updates?
At this point PCs should support self administration and self diagnostic and repair. Before you laugh me out off the board, I know that feeble attempts at this have failed miserablely(Windows autoupdate, system restore). But in the age where four year olds, business students, lawyers and Aunt Tillies everywhere are using broadband connected PCs and haven't a clue how to keep them up and running, it's either MUCh better selfadm or you and I will have to become fulltime sysadms.
May the Maths Be with you!