Google Says Spam, Virus Attacks to Get More Clever

eweekhickins writes "Google's Postini team says new attacks will take the form of sneaky viruses that will blend with spam, leveraging specific current events, such as the Super Bowl or the Summer Olympic Games. Better yet, virus attacks will target executives at companies whose intellectual property is deemed valuable on the black market. A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC."

Comments

And you know

[WindBourne]

that these will be successful. So many suckers, so little time.

Re:And you know

[Brian Gordon]

I'm thinking the suckers are the ones paying these guys to wildly speculate about things everyone suspects..

You don't say?

[Rob T Firefly]

Damn, my entire security plan really depended on them suddenly getting really really stupid. If the scammers suddenly forgot how to send email, switch on a computer, or breathe air my life would be so much easier.

Crims get more entrepreneurial

[EmbeddedJanitor]

Who's suprised that the crims get more clever about the way they craft their attacks? As it gets harder to fool people with fake Viagra ads and bank phishing and other lower hanging fruit, it makes sense to start putting more effort into targeting the bigger prizes. More effort sure, but better prizes too.

Crims have always been good at adapting and exploiting conditions. The Mafia really got their power due to exploiting the prohibition. Cable thieves in South Africa are using rolling blackout schedules to plan their cable thefts.

As more business services are done online it makes sense to phish for more than some lame paypal accounts.

Well, which is it?

[mcmonkey]

A lot of these attacks will masquerade as legitimate business agencies, such as the Internal Revenue Service, the Better Business Bureau and the SEC.

Will these attacks masquerade as legitimate business agencies, or as agencies such the Internal Revenue Service, the Better Business Bureau, and the SEC?

ASCII art

[Nimey]

I've been getting a few spams lately that are ASCII art advertising for "viagra". Fairly clever way of getting past the filters, anyway.

YAWN

[samos69]

This is a sales pitch, there's nothing new in that article. Google is just fishing for more business for postini...

Good idea, however...

[querist]

The underlying concept of your idea is good.

However, I can see a few issues that would impact the rate of adoption and the overall utility of your approach (assuming, for the sake of simplicity, that the cryptographic aspects are implemented in a truly secure manner, the crypto itself is strong, etc. I fully realize that this is like the proveribial "frictionless surface" and the proverbial "ideal conductor" used in science books. I'm just trying to cover the big points here, OK?):

1. It will not happen until Verisign (for example) decide that there is enough of a market that they can make a decent profit.

2. It will either price small businesses out of the market (given Verisign's prices, this is likely) or it the price will be such that small businesses can afford it and then so can the spammers. Before you start claiming that is why there is a vetting process, I would suggest that hurdles low enough for small "mom-and-pop" businesses to jump will be low enough for a determined spammer.

3. Either we need a "Root CA" mechanism like other certificates (again, profit and "are you sure you can trust this") or the whole "web of trust" thing from PGP. The web of trust would be difficult in that it would make legit messages appear fake until you can determine it. Also, how would "Joe Sixpack" know the difference between a legit cert for the IRS and a faked one?

Your idea is good. Unfortunately, the current environment is not ready for it. I hope we will see the day when it will work.