Feeds

Viruses, phishing, and trojans for profit

Malware is big money

Protecting against web application threats using SSL

Phishing fraud in aggregate

Phishing fraud has also proven itself to be enormously profitable in aggregate. In just a few years, "phishing" has become a household name for stealing banking details from hapless victims over the internet. There's a sucker born every minute, and they all use email nowadays – thanks to our woefully insecure e-mail system, people get lured to a fake site. What might be surprising is how quickly a phisher can turn a profit and convert that "virtual money" into real cash.

At Virus Bulletin this year, Guillaume Lovet from Fortinet gave an interesting presentation about "dirty money on the wires: the business models of cyber criminals" where he detailed the often complex set of arrangements behind the Big Population risk. His accompanying paper was published in the proceedings of the 16th Virus Bulletin International Conference.

From younger workers doing technical grunt work to older folks doing the money laundering and interacting with organised crime, the illicit business model runs the full gamut of criminal activity. Most interesting to me was Lovet's discussion of the intense profitability around phishing – after he presented a typical phishing business model, he compared its profitability to the manufacture and sale of heroin.

More incredibly, he argued that electronic phishing scams might just be even more profitable than selling drugs. The exact numbers and the drug analogy can be disputed, of course. But based on the short time needed and the large payoff I'd say there's probably less risk of getting caught doing phishing (as opposed to selling drugs) as well. Lovet found that a typical phishing profit might range from $2,500 to $25,000 - not bad for a day's work.

Looking at the groups behind the theft gives a keen insight to the business of cyber crime. Low risk, high profit, and it's unlikely that the criminals will get caught. No wonder phishing has exploded in just a few years. More than that, it's unlikely that the victims will even know something was wrong with their Windows computer until their identity, banking, or credit card details are compromised and used. That $499 PC purchased mail-order for your aunt isn't looking so attractive any more, is it?

That's pretty much where we are today. The only problem with Lovet's analysis, as I could see, is around getting hard numbers and actual case studies – but understand that the very nature of the crime means that this sort of data is likely only held by the FBI, Interpol, and other national police agencies. And for every crime ring they crack, there are countless more that go unpunished.

Big money from the Little Guy

It's pretty common to find viruses or trojans now that encrypt a user's hard drive and then demand a ransom to give the data back. This is a somewhat targeted attack focusing on individuals, the Little Guy, and is small potatoes for the most part (unless you're one of the victims). Where it gets interesting is with the upturn in targeted trojans that seek out individual companies and then try one do one thing very, very well.

Targeted trojan attacks are just as one might expect: software that is very focused on stealing from individual companies in a stealthy manner. The people behind these trojans are criminal hackers going after some very specific types of data from within just one target: a large bank, a military installation, a Fortune 500 company or a government office. They craft a customised trojan horse – or purchase one – that avoids detection from anti-virus software. Then they try to lure at least one person from the target organization to install it, and voila. Reconnaissance begins. The trojan could be sent via e-mail, but that seems unlikely because it's so obvious. Even accounting people today know not to click on unknown attachments in email.

But what about a blended attack, a malicious Word or Excel document sent in email with a zero-day exploit? Or it could be as simple as sending the victim a link to a web page with a zero-day exploit for Internet Explorer, easily infecting the machine and prompting the download and installation of a malicious trojan. Step one is complete.

These are threats that are very difficult to detect, because by their nature they almost always avoid the signature-based detection models used by anti-virus software – no signature will have been created yet because none of the AV companies would have seen this exact trojan signature before. Some types of heuristics in various AV software can still identity unknown trojans, but the results are not always consistent or reliable. The point of this discussion is that sometimes the Little Guy, the individual or isolated company, is not so little after all.

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.