Cyber Crime Hits Big Time This Year

An anonymous reader writes to point out the Washington Post's analysis of this year's spike in junk email and online attacks, such as botnets and worms. Image-embedded spam emails made up an amazing percentage of all messages sent in the months of October and November, and something like four million bots are actively adding to that total. These botnets are also increasingly connected to organized crime, as are 'independent' hacker groups. The article goes on for three pages, and doesn't have a lot of hope that 2007 will look a whole lot better. From the article: "Experts worry that businesses will be slow to switch to the [Windows Vista]. And even if consumers rush to upgrade exiting machines or purchase new ones that include Vista, Microsoft will continue to battle security holes in legacy versions of Microsoft Office, which are expected to remain in widespread use for the next 5-10 years."

Comments

Anti-virus needs a new direction.

[khasim]

From TFA:

Some software security vendors suspect that a new Trojan horse program that surfaced last month, dubbed "Rustock.B" by some anti-virus companies, may serve as the template for malware attacks going forward. The program morphs itself slightly each time it installs on a new machine in an effort to evade anti-virus software. In addition, it hides in the deepest recesses of the Windows operating system, creates invisible copies of itself, and refuses to work under common malware analysis tools in an attempt to defy identification and analysis by security researchers.

Yet, with a boot CD on Linux, I can inventory everything on the local hard drive and quarantine any suspect files. Yes, including loadable modules for the kernel.

Why aren't we seeing that for Windows? Running an anti-virus app on the system itself is useless if the system can be compromised at a more privileged level than the app is running at.

Not to mention that the users are notorious for NOT keeping their anti-virus apps updated.

And ISP's really should be looking at blocking or actively monitoring outbound connections to port 25. Come on! It's not that difficult.

Re:Anti-virus needs a new direction.

[The Living Fractal]

I just wonder why these people who are so good at compromising Windows' security don't go legal and start writing anti-virus software. They obviously know all the tricks. Seems theirs would be the best AV software in the world and they could sell it and make loads of cash legally. Why, I wonder, does this not happen?

TLF

One e-mail address to rule them all.. One e-mail..

[The Living Fractal]

Seriously. I have like 5 email accounts, and I doubt that's a lot compared to some people who use e-mail more than me. Three of which I will drop at a moments notice. The other two I consider untouchable. They are whitelisted. You want to get to my good ones? You gotta go through the other three. Then, and only then, will you get to my inner e-mail sanctum.

So bots and spam and worms and identity phishers don't get to me. Part of the reason is that I simply don't pay attention to e-mails from unsolicited sources. That's half the reason cyber crime works at all: people are idiots when it comes to computers. Odds are you know someone who sees a pop-up disguised to look like an authentic Windows message box and clicks on the buttons thinking they are actually talking to Windows and not some porn-site-based phisher and thief. Odds are you know someone who thinks those e-mails are from someone with an actual product instead of a phishing scam, like a second chance offer from www.ebay.cra.cz or something similar.

These criminals are simply separating stupid people and their money. I know, I know, it's a harsh perspective. You know somebody who got nailed so you want to mod me down because I called your friend stupid. Well, hopefully they learned. The saying goes, fool me once, shame on you, fool me twice, shame on me. It's true.

TLF

Neuter the zombies

[WoTG]

I think that 2007 is the year we'll see action from ISPs to proactively neuter zombies on their network. It's been several years of DDOS's now and the technology to compile which IPs have been hacked is available. All we need is some incentive to push ISPs to look after their own network. Maybe make a public list of the worst ISPs for sending SPAM?

Detecting Click Fraud

[broward]

A series of entries on my discovery of click fraud, how I detected it.
I'm planning to work it into a Defcon 15 submission.

http://www.realmeme.com/roller/page/realmeme/Weblo g?catname=%2FClickFraud

Re:Detecting Click Fraud

[whoever57]

Your comments on click fraud are interesting. My own company's website saw hits that were very odd from google adwords clicks. I searched the weblogs looking for IP addresses that had a referrer that indicated an adwords click, but only downloaded one or two files. Given that the front page is composed of many files, it is not typicalof a readl browser to only download one or two files.

Many of these referrers tracked back to websites that had no discernable connection to our products -- in fact some were merely link farms or "search engines" running at domains that the former owner had allowed to expire.

Re:One e-mail address to rule them all.. One e-mai

[bky1701]

"Are you a competent attorney? Tax accountant? Automotive Mechanic? Manufacturing supervisor? Medical doctor?

What would you think if professionals in these various areas figured you were a moron because you did a stupid in their field of expertise?"

These are not cases of being a moron because you don't know how to do something, it's because you ignore that you are not smart enough to do them. A lot of people get their cars fixed for them, hire lawyers, have people do their taxes, etc... How many people forward their emails to people to make sure they are legit? None. People who don't know how to drive but drive anyway and crash the car have only themselves to blame, this case is the same.

Emails are too easy to get, if it was harder; cases of this would drop by a LOT, because people who didn't know how to use emails wouldn't be using them. Not like that's going to happen, or if it would even be a good thing, but it does say people should avoid messing with things they can't comprehend.

Anti-botnet botnet?

[bucky0]

Now, I know someone already tried to write an anti-botnet botnet for code red, but couldn't someone start hijacking computers that would monitor honeypot spam addresses for spam, then by reading the headers, see what exploited machines were spewing spam, then hack into them, patching the security holes and shutting off the spam trojans?

Of course, with as much money as there is in hacking type stuff, I'd be afraid of the enemies I'd be making.