Slashdot Mirror
Web Browsers Under Siege From Organized Crime
An anonymous reader writes "IBM has released the findings of the 2007 X-Force Security report, a group cataloging online-based threat since 1997. Their newest information details a disturbing rise in the sophistication of attacks by online criminals. According to IBM, hackers are now stealing the identities and controlling the computers of consumers at 'a rate never before seen on the Internet'. 'The study finds that a complex and sophisticated criminal economy has developed to capitalize on Web vulnerabilities. Underground brokers are delivering tools to aid in obfuscation, or camouflaging attacks on browsers, so cybercriminals can avoid detection by security software. In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007.'"
Are they saying that antispyware software misses 80% of the spyware?
Okay, I admint I have not (yet) read the article, but experience tells me that 80% likely involves IE at 90 percent or better.
Ignorance is curable, stupid is forever.
It seems to me that the moment that organized crime found a way to make money off security vulnerabilities (Spam, ID theft, Ransomware, etc...) the writing was pretty much on the wall (though I'm still trying to figure out what it says). It kind of reminds me of William Gibson's cyberspace: a free-for-all, hostile environment where it was pretty much up to individual users / corporations / governments / whatever to protect themselves through whatever means necessary.
Welcome to the wild, wild net.
The Digital Sorceress
Combined with the comment that camouflaging techniques are used in 80% - 100% of recorded attacks, I wonder if the number of attacks is really going up ( as it has been in the past 10 years ) but detection is getting worse.
A Human Right
Over the past 4 weeks I've noticed a rash of almost hourly attempted breakins to our servers.
::ffff:82.186.102.42 [::ffff:82.186.102.42] to ::ffff:192.168.10.26:21
Here's a sample:
ftp attempts for 5 hours straight:
Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - no such user 'Administrator'
Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - USER Administrator: no such user found from
Feb 12 10:27:02 localhost proftpd[24841]: localhost.localdomain (::ffff:82.186.102.42[::ffff:82.186.102.42]) - Maximum login attempts (3) exceeded
ssh attempts almost constant since last friday:
Feb 11 01:37:07 localhost sshd[13953]: pam_unix(sshd:auth): check pass; user unknown
Feb 11 01:37:07 localhost sshd[13953]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=192.31.37.13
Feb 11 01:37:07 localhost sshd[13953]: pam_succeed_if(sshd:auth): error retrieving information about user ajith
When I catch them, the majority of the IP #'s match up to systems which have been rootkitted. The stream of odd login names always catches me off guard, sometimes in english, sometimes japanese or chinese. Does anyone know of someone that keeps track of these things, so I can send my logfiles to?
Karma Whoring for Fun and Profit.
...It begs the question "how am I funny to you?"
You were critically hit for no damage. The bruise will look nice, and maybe the scars will make good party talk.
We've seen what kinda of profits spam brings in. I wonder how profitable this is.
Heck, spyware/adware, or some shady P2P programs could have something like this. Reminds me of what happened to http://www.shareaza.com/. It's claimed by a group that be like this. That address used to be shareaza's main site, and it easy for many to not know to go to http://shareaza.sourceforge.net/ for the new updates.
Here is the link to the source : http://www.iss.net/x-force_report_images/2008/index.html/
The problem is that no matter how well YOU protect yourself, other agencies have your personal information in their databases.
What happens if your employer loses a laptop with your SSN, name, etc on it?
Eventually, the criminals are just going to start building a database with whatever information they can find.
Then they'll use that database to take out a second mortgage on your home, purchase a new car and open a few credit cards under your name.
You'll lose more money than you have. And you'll never have a chance to prevent it. Because all the information will be "leaked" from 3rd parties.
Be a shame if sumfin' were to happen to it, like.
Kinda leads to interesting thoughts...perhaps it may behoove certain of us to act as "night watchmen" for our various neighbourhoods, in the interest of keeping that sort of thing away from our systems.
:-/
I know I'm probably going to have to make another scan of my landlady's computer...she falls for half the stuff that comes through, even after my lectures on "DON'T CLICK IT"
In Xanadu did Kubla Khan
A stately pleasure dome decree
5%, 25%, 50%? 90%? Are there estimates for the "rate never before seen" that users are having their personal information stolen?
And what personal information is it? To extend the old saying "If it is on the internet, it is public". Well, *all* information you store the computer that you access the internet suffers from this lack of security.
A truly secure user experience would be managing personal data on an unconnected system (or even a private network of systems) and then transferring data from there that needs to make it to the Internet via the Sneakernet. This is how the Department of Defense guarantees the security of Secure Facilities, and it is (unfortunately) the only way to guarantee the security of your own personal information.
But for systems that are on the 'Net, using an OS that doesn't hide/obfuscate fundamental security models is a plus. For example, it is easier for me to shutdown outgoing ports/services on Linux than on Windows.
As far as browser exploits... one can only hope that developers close off the attack vectors faster than they open new ones.
Support the 30 Hour Work Week!!!
I've been saying this for years now: antivirus and firewalls cannot protect from sophisticated attacks.
There is only one solution: executable code must be embedded in hardware read-only media and must be reloaded after every session. [today reloading a virtual machine is a good approximation, but this method will succumb under sufficiently sophisticated attack; it really needs to be built into nonflashable rom]
Nobody wants to hear this. I'm not exacty sure why; a little thought should lead anyone with some knowledge of operating systems and hacking to the same conclusion.
Its just going to get worse, with botnets, blackmail and scammers gaining more and more power until we remove the ability of malignent code to survive.
Hand me your cache!
(Sorry - for humor I go for quantity, not quality.)
He's getting rather old, but he's a good mouse.
I did read the actual report, all 56 pages of it. As usual, Windows' total lack of security guarantees that any random blackhat with a minimum of skill can exploit it. Go ahead and mod me Troll again, you lameass Microsoft-fanboi moderators, but it won't change what the report says- Windows is the problem.
we will end no whine before its time
"In 2006, only a small percentage of attackers employed camouflaging techniques, but this number soared to 80 percent during the first half of 2007."
If they're going to hose my Windows boxen and install spurious applications of dubious intent, I find that I prefer if they camouflage their attempts so as not to bother me with constant popups from the system tray telling me to install their spyware to get rid of spyware.
Well, start small, anyway. The bank can afford to make itself secure, but if every computer in the neighbourhood is sending out Russian viagra ads, your bandwidth will suffer--so doing some basic cleaning and firewalling will benefit you bandwidthwise.
;-p
Hell, if you're feeling ambitious, you could set up some kind of neighbourhood LAN and get folks to chip in towards a big fat pipe, if you can prove they'll have a safer connection...
Come to think of it...does anyone know of any successful examples of a "co-op" pseudo-ISP like that that already exists?
In Xanadu did Kubla Khan
A stately pleasure dome decree
...after all, it was only a matter of time once rootkit source code was published for anyone to grab. From that time onwards, true stealth malware was possible to create without needing to be a security researcher. Combine the ease of integrating someone else's rootkit code into a payload with a vigorous open market for Windows vulnerability information ($25,000 gets you a brand new zero-day exploit) and you reach the situation we have today.
Some people believe the largest botnets out there are ones built with the Storm Worm or other similar exploits. My bet would be that there are plenty larger out there, undetectable because they hide behind rootkits and don't do stupid stuff like turn the box into a spam cannon. And for people who think that the C&C (Command and Control) would be detected, think again: if a rootkit can conceal a file then it can also conceal a process, a named pipe, an interrupt handler, you name it.
The web is not just HTML at this point. Both QuickTime and RealPlayer have had notable exploits in the past few months. Acrobat and Flash have had major security holes as well. Just relying on the fact that you're using Firefox doesn't mean that you're not vulnerable.
How many ROM slots am I supposed to have on my desktop machine? Three, maybe four? So, let's see, I can listen to music, browse the web, have a chat program open, and if I've got a sweet computer, I can also use my calculator application! If I can find all the cartridges on my desk!
Software updates (er, hardware updates?) can now only be obtained conveniently at your nearest MicroCenter or Fry's. F/OSS software^Whardware^Wsecure-read-only-executable updates can be easily obtained by mailing a SAS, padded envelope to the appropriate developer (who now needs a commercial source of ROMs, and a machine to print them, along with the time to do so), who will happily mail you back your ROM just as soon as he or she gets around to it, for a small fee to cover the cost of the media (oops, I guess it's just OSS now!). Old copies of softw^Whardwa^Wwhatever can be conveniently recycled at almost no cost to the user by returning them to the developer.
Do embedded video players count as "executable code"? Congratulations, YouTube is now NetFlix. Welcome back, text-only Web pages. Goodbye, everything that makes the Web useful and interesting.
And you don't understand why nobody thinks it's a good idea?
... secure your web browser. Many browsers are not secure out of the box, which puts you at risk of attack.
Consider this hypothetical situation: I'm running Windows XP with no firewall and no antivirus. I'm on broadband and my ADSL modem/router does NAT with no port-forwarding rules set up. I'm fully patched and run out-of-the-box firefox. I don't run executables from untrusted sources, I understand how to treat email attachments, and I'm smart enough not to get caught by phishing.
How vulnerable am I? How likely is it that I will get compromised?
Does the answer change if I'm running fully-patched IE7?
Repton.
They say that only an experienced wizard can do the tengu shuffle.