AT&T Tech Support 360
- Related Stories
-
Why we still invite data breaches
October 29, 2007 - Related Blogs
-
FBI's Operation Bot Roast II nets additional indictments, sentences
November 29, 2007 -
Massive Web attack gains momentum
June 18, 2007
The evidence is out there. Price lists discovered on the black market reveal that criminals are willing to pay $5,000 for a financial report, $500 for a credit card with PIN, and $150 for a driver's license ID.
With do-it-yourself malicious software packages available for $200, cybercriminals need neither deep pockets nor programming skills to compromise a Web site or steal sensitive financial data from an infected PC. Indeed, Finjan's security research confirms that crimeware toolkits have become cybercriminals' favorite weapon. The new business model is criminal-2-criminal (C2C)--attackers selling malicious code and stolen data to other criminal elements that profit from it.
Most government offices, financial institutions, and large enterprises deploy signature-based antivirus tools and a network firewall to protect highly sensitive and private data. The fact is that cybercriminals know this, and they use new antiforensic techniques specifically designed to bypass these traditional security solutions.
The MPack crimeware toolkit, which infected more than 500,000 users in June 2007, illustrates this point. Even several weeks after intensive media coverage, the crimeware downloaded by the MPack toolkit was still not detected by the majority of leading security products.
One particularly devious Trojan installed by the MPack toolkit steals bank account information (such as user name, password, credit card number, Social Security number, ATM, PIN). The Trojan silently waits on the victim's PC until he/she accesses an online banking site, then it springs into action, harvesting the sensitive information. The user's online experience is identical to that of his/her own bank, and the stolen data is sent to the criminal's server over an encrypted SSL connection.
According to Gartner, the Internet (and Internet applications) will be fertile territory for malware infections in the corporate world. Due to the proliferation of Web-based malicious code, safeguarding sensitive data from targeted crimeware attacks is not simple anymore. Creating signatures for every exploit of dozens of toolkits requires huge resources and in most cases is ineffective.
The cybercrime equation is simple: the longer the crimeware remains undetected, the higher the profit for the attackers.
Therefore, cybercriminals compromise legitimate Web sites to infect victim PCs, using dynamic payloads and obfuscation techniques and constantly changing hosting locations to evade detection. The result is that URL filtering, reputation services, and signature-based solutions are limited against this new evasive attack genre.
Innovative solutions to address these threats are available, and should be implemented in a layered manner on top of organizations' existing security infrastructure. However, until this happens on a wide scale, individuals should realize that their data may not be as safe as they think.
In the Web 1.0 scenario, even if your PC got infected by spyware, many solutions were able to detect and block the spyware when it "phoned home," or tried to connect to the malicious server.
In Web 2.0 and beyond, a stealthy Trojan on your PC will no longer need to send its stolen data to a malicious host server in the Third World. Rather, the Trojan will upload data to a MySpace page or another "trusted" Web 2.0 site that will not be blacklisted by URL filtering or reputation-based solutions. Once the data is downloaded from these sites, it is deleted. In essence, hackers could turn these sites into "safe harbors" for storing their stolen data.
The way to stop such a scenario is to understand exactly what is happening in the network. The financial damage from a security breach can cost millions of dollars. As C2C grows, corporate and government users will realize that their digital assets are increasingly at risk.
Biography
Yuval Ben-Itzhak is chief technology officer at Finjan, a leader in secure Web gateway products. He was recently chosen by Computerworld as one of "40 innovative IT people to watch under the age of 40" for 2007.
See more CNET content tagged:
cybercriminal,
Finjan Software Inc.,
trojan horse,
signature,
attacker
The most serious security breaches of personally sensitive information--credit cards, bank account numbers and stuff like that--all resulted from physical access to the data.