Feeds

Security maven sics 'special ops' on botnet gangs

League of net justice

Beginner's guide to SSL certificates

RSA Sometimes fighting botnets, spam, and other online crime is like raking leaves on a windy day. Bag one operation and almost overnight there are a half-dozen more that take its place.

It's a story that's all too familiar to Joe Stewart, director with SecureWorks' Counter Threat unit. Now, he's proposing members of the security industry borrow a new page.

"Right now, we've got a very scattered approach," he said during an interview at the RSA security conference in San Francisco. "We're looking more at attacks than attackers. As we jump around from attack to attack, we're not really having a long term impact."

Stewart is suggesting a series of small "special ops" groups that work to make cybercrime less profitable by disrupting a gang's business. The special ops teams would work to thwart ongoing attacks by getting known criminals disconnected from the internet quickly and more effectively distributing new malware signatures so exploits can be detected faster.

The approach in many ways emphasizes the economics that's at the heart of most computer crime. At their core, criminal gangs are business enterprises that take risk, reward, and effort into consideration when deciding whether to pursue new attacks. The idea is to create a grassroots movement that increases the risk and effort and reduces the rewards.

Stewart envisions the special tactics as an interim strategy that will tide the law-abiding world over until it can pass a global treaty that would hold each country responsible for the cybercrime perpetrated inside its borders. CERTs, or computer emergency readiness teams, in each nation would be empowered to deal with computer abuse by, among other things, having the legal authority to disconnect people who are using the internet to spread malware or carry out other crime.

Of course, there are some potential land mines in such an approach. As we've pointed out before, self-appointed white-hat netizens who take it upon themselves to disconnect certain parties from the internet with no due process is always a concern. Stewart also worries that the treaty could be monopolized by the RIAA, MPAA, or other intellectual property groups. This seems like a reasonable concern.

But as we learned last year when an internet host by the name of McColo was shut down, a little industry cooperation can go a long way. Almost overnight, spam volumes were cut in half, thanks to the actions of the service providers that were upstream from McColo.

No, there's no one known to be actively working on making this pie-in-the-sky vision a reality, and yes, its specifics are still undefined. But amid the steady rise in cybercrime, it's an idea worth pondering. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.