Feeds

Viruses, phishing, and trojans for profit

Malware is big money

Securing Web Applications Made Simple and Scalable

Phishing fraud in aggregate

Phishing fraud has also proven itself to be enormously profitable in aggregate. In just a few years, "phishing" has become a household name for stealing banking details from hapless victims over the internet. There's a sucker born every minute, and they all use email nowadays – thanks to our woefully insecure e-mail system, people get lured to a fake site. What might be surprising is how quickly a phisher can turn a profit and convert that "virtual money" into real cash.

At Virus Bulletin this year, Guillaume Lovet from Fortinet gave an interesting presentation about "dirty money on the wires: the business models of cyber criminals" where he detailed the often complex set of arrangements behind the Big Population risk. His accompanying paper was published in the proceedings of the 16th Virus Bulletin International Conference.

From younger workers doing technical grunt work to older folks doing the money laundering and interacting with organised crime, the illicit business model runs the full gamut of criminal activity. Most interesting to me was Lovet's discussion of the intense profitability around phishing – after he presented a typical phishing business model, he compared its profitability to the manufacture and sale of heroin.

More incredibly, he argued that electronic phishing scams might just be even more profitable than selling drugs. The exact numbers and the drug analogy can be disputed, of course. But based on the short time needed and the large payoff I'd say there's probably less risk of getting caught doing phishing (as opposed to selling drugs) as well. Lovet found that a typical phishing profit might range from $2,500 to $25,000 - not bad for a day's work.

Looking at the groups behind the theft gives a keen insight to the business of cyber crime. Low risk, high profit, and it's unlikely that the criminals will get caught. No wonder phishing has exploded in just a few years. More than that, it's unlikely that the victims will even know something was wrong with their Windows computer until their identity, banking, or credit card details are compromised and used. That $499 PC purchased mail-order for your aunt isn't looking so attractive any more, is it?

That's pretty much where we are today. The only problem with Lovet's analysis, as I could see, is around getting hard numbers and actual case studies – but understand that the very nature of the crime means that this sort of data is likely only held by the FBI, Interpol, and other national police agencies. And for every crime ring they crack, there are countless more that go unpunished.

Big money from the Little Guy

It's pretty common to find viruses or trojans now that encrypt a user's hard drive and then demand a ransom to give the data back. This is a somewhat targeted attack focusing on individuals, the Little Guy, and is small potatoes for the most part (unless you're one of the victims). Where it gets interesting is with the upturn in targeted trojans that seek out individual companies and then try one do one thing very, very well.

Targeted trojan attacks are just as one might expect: software that is very focused on stealing from individual companies in a stealthy manner. The people behind these trojans are criminal hackers going after some very specific types of data from within just one target: a large bank, a military installation, a Fortune 500 company or a government office. They craft a customised trojan horse – or purchase one – that avoids detection from anti-virus software. Then they try to lure at least one person from the target organization to install it, and voila. Reconnaissance begins. The trojan could be sent via e-mail, but that seems unlikely because it's so obvious. Even accounting people today know not to click on unknown attachments in email.

But what about a blended attack, a malicious Word or Excel document sent in email with a zero-day exploit? Or it could be as simple as sending the victim a link to a web page with a zero-day exploit for Internet Explorer, easily infecting the machine and prompting the download and installation of a malicious trojan. Step one is complete.

These are threats that are very difficult to detect, because by their nature they almost always avoid the signature-based detection models used by anti-virus software – no signature will have been created yet because none of the AV companies would have seen this exact trojan signature before. Some types of heuristics in various AV software can still identity unknown trojans, but the results are not always consistent or reliable. The point of this discussion is that sometimes the Little Guy, the individual or isolated company, is not so little after all.

Mobile application security vulnerability report

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.