Cyber Crime-The evolving cyber crime economy

Sources of cyber crime will turn into increasingly organized and profit-driven during the years ahead. 

Gunter Ollmann, chief security strategist for IBM Net Security Systems describes today’s (and tomorrow’s) cyber criminals
as “an international conglomerate of professionally trained authors motivated by high profit.”
You can buy, lease, subscribe and even pay-as-you-go to pay for the newest malware kits, that are much more
sophisticated than their predecessors. “Malware transitioned to the criminal world just over 3 years ago,”
said Ollmann. 

“The new sophisticated malware-for-sale features encrypted command and control channels, builtin Web services for hosting phishing content, man-in-the browser proxy engines for identity theft, as well as drive scanners for capturing sellable details like email addresses and credit card details.”
Ollmann reports that many malware kits are supported by product guarantees and program level agreements.
A few malware developers are even offering multiple language “customer support” so that you can achieve a wider audience of criminals. 

New Web-based attack platforms have been designed in tandem so that social engineering and end-user action are no longer required for exploitation.
All of these trends are expected to evolve further in the coming year.
The managed program process basically extends the functionality of the malware purchase. 1 malicious managed service design revolves around breaking CAPTCHAs (Completely Automated Public Turing test to tell Computers
and Humans Apart).

 CAPTCHAs are applied to prevent brute-force attacks and fraudulent account creation on Web websites and need end users to correctly enter a string of characters and login data prior to entry is granted. 

As CAPTCHA systems {were|had been|have been} continuously broken by attackers and then subsequently strengthened against compromise, the cyber crime MSPs saw a business opportunity.

“The managed program operators offer cheap human labor to battle via CAPTCHAs,” stated Ollmann.
"These predominantly Russian-operated entities provide pay scales starting at $1 per 1,000 CAPTCHAs broken, and provide an extensible API structure for easy integration into malware. This combined method will continue in the future.”

Ollmann divides the cyber criminal industry into three tiers:
• Low-level criminals who use kits to create the specific malware required for their targeted crimes.
• Skilled developers and collectives of technical experts doing new components to embed within their commercial malware creation kits.
• Top-tier managed program providers that wrap new services around malware kits to increase propagation and enable organized fraud on a global scale, feeding gains back into existing money laundering chains.
   He warns of the tough road ahead inside battle against malware

Other Articles-

http://the-survey.blogspot.com/2011/09/cyber-crimethreats-to-voip-and-mobile.html
http://the-survey.blogspot.com/2011/08/cyber-threats-report-emerging-threats.html
http://the-survey.blogspot.com/2011/08/cyber-threats-report-2009emerging_26.html
http://the-survey.blogspot.com/2011/08/cyber-threats-report-2009emerging.html
http://the-survey.blogspot.com/2011/08/emerging-threats-forall-data.html

Read more »

Posted in: cyber attacks,cyber bullying articles,cyber crime economy,cyber crime survey,cyber threats

Cyber Threats report :Emerging threats for…all data-driven![cyber warfare]

Emerging threats for…all data-driven!

Cyber Warfare

Security experts consulted by GTISC believe cyber warfare will accompany conventional military interaction more often inside the many years ahead. They expect it's going to also play a much more shadowy role in attempts by antagonist nations to subvert the U.S. economy and infrastructure.

Consider the cyber attacks that occurred between Russia and Georgia earlier this year like a type for military

cyber engagements in 2009 and beyond. 

Don Jackson, director of threat intelligence for SecureWorks, compiled the right after research to implicate direct Russian government involvement in cyber attacks against Georgia:

Physical and cyber attack targets and timing align:

• Logs of DDoS targeted visitors and changes in network routing indicate that Russian cyber warfare operations coincided virtually exactly in the final “all clear” for Russian Air Force attacks sometime between 0600 and 0700 on August 9, 2008.

• Both cyber attack targets (media outlets and local government communication systems) and air force targets were located within inside Georgian city of Gori.

• The exact timing of cyber attacks against new classes of targets in Gori and Russian Air Force attacks indicated coordination among known hacking groups and military operators.

Source of Russian cyber attacks against Georgia:

• The vast majority of Georgian Web traffic is routed throughTurkey and Russia. As of August 10, 2008, visitors routed through Turkey was almost completely blocked, and IP traffic through Russia (via Azerbaijan) was slow and efficiently unusable.

• Russian government-run Rostelecom conducted most of the routing changes that blocked site visitors to

Georgian IP address space.

• The Moscow-based COMSTAR network also cooperated with government  demands to follow suit, as did other network operators that control routing from your ostensibly neutral Moscow Internet Exchange (MSK-IX).

• DDoS and cache poisoning attempts targeting DNS servers for major Georgian networks were also launched during the state-operated Rostelecom and Moscow-based COMSTAR networks. 

These attempts used the same tools, tactics and target lists as attacks from portions of Turkish networks controlled by former associates of the Russian Organization Network (RBN).

The associates are believed to have connections to local St. Petersburg government, the former powerbase of Putin and those people now in charge of the FSB state security organization.

Attack types:

• Along with DDoS attacks against Georgian media outlets and federal government Internet sites, researchers observed:

— Route hijacking

— Brute force server compromise

— Information theft

— Multi-factor DDoS attacking network and computer software layers

— Defacement and hosting of fake Georgian Web pages containing misinformation and propaganda.

Some DDoS attacks, route hijacking, and system intrusions originated from sources not previously

affiliated with identified hacking groups and appear to have been coordinated inside a manner that would allow attackers to disable or intercept Georgian government communications according to Russian military and intelligence objectives.

Jon Ramsey, chief technology officer for SecureWorks attributes increasing cyber warfare exercising to the following:

• The low cost to launch cyber attacks compared with physical attacks

• The lack of cyber defenses

• The “plausible deniability” the internet affords

• The lack of “cyber rules of engagement” in conflicts among country states

George Heron, founder of BlueFin Security and former chief scientist for McAfee believes cyber warfare will play a significant role in between China and the U.S. “Cyber threats originating from China are incredibly real and growing,” said Heron.
“Other evidence supports this, just like the majority of bot masters being traced back to China, along with malware along with other disruptive threats.”

Heron pointed towards U.S. transportation system infrastructure, the telecommunications system, nuclear energy plant communications, the water provide IT infrastructure and other entities as prime cyber targets of enemy nations.

“We now know that it only takes infiltrating the DNS operator vulnerability to subvert an entire DNS sector,”

Heron continued. “Cyber warfare efforts could eat this approach to exploit vulnerable servers and gateways

controlling the power grid or water/dam flow control.”

Howard A. Schmidt, a GTISC professor of practice agrees.

“Our essential infrastructure systems are fundamentally dependent on the internet and IP-based technology,

and there are interdependencies between them that our enemies will seek to exploit,” stated Schmidt.

“Cyber warfare completely evens the playing field as developing nations and large countries with a formidable military presence can both launch both equally dangerous attacks more than the Web.”

The U.S. federal government is already bracing for the inevitability of cyber warfare and hosted the second annual Cyber Storm activity in March 2008—involving nine states, four foreign governments, 18 federal agencies and 40 individual firms in a weeklong cyber attack scenario3.

“Cyber Storm II is really a successful example of public and private partnership to identify cyber warfare threats and plan powerful countermeasures,” said Heron.
“We need more information sharing and additional collaboration like this to defend our national interests against an onslaught of cyber terrorism.”

Schmidt advocates a three-step method to bolstering U.S. cyber defenses:

• Identify the Internet-enabled systems we depend on and the interdependencies between them.

• Develop a comprehensive plan to protect those systems, such as  roles and responsibilities, vulnerability identification and remediation, threat mitigation and response.

• Model facts security for your future as software improvements, network enhancements and new  echnologies like mobile communications accomplish traction.



“The future threat goes beyond what we think of as cyber-espionage and intellectual property theft,
although that certainly remains a factor,” said Heron. “I think we’re going to see more technologically savvy,
state-sponsored attacks to the IT systems that support foundational services here in the U.S.”
George Heron - Founder, BlueFin Security
See Also:
Cyber Crime:Threats to VoIP and Mobile Convergence...

• Cyber Threats report :Emerging threats for…all dat...
• Cyber Threats report 2009:Emerging threats for…all...
• Cyber Threats report 2009:Emerging 

Read more »

Posted in: cyber attacks,cyber bullying articles,cyber crime survey,cyber crime surveybotnets,cyber crime threats,cyber threats,Cyber Warfare,cyberbully,featured

Emerging threats for…all data-driven!:Malware

Emerging threats for…all data-driven!

Data will continue to become the principal motive behind future cyber crime—whether targeting conventional fixed computing or cellular applications.
According to security expert George Heron, “It’s all within the data,”

whether botnets, malware, blended threats, cellular threats or cyber warfare attacks. And Heron expects data

to drive cyber attacks for many years to come. The details motive is woven through all 5 emerging threat categories,

beginning with malware-

                                                                          Malware

Ryan Naraine, security evangelist for Kaspersky, believes that malware delivery—the very first step in generating a bot—will turn into much more insidious by taking advantage of poorly configured Web sites, social networking sites and false domains.

“We are projecting a 10-fold increase in malware objects detected in 2008,”    stated Naraine.
“This is ‘hockey-stick’ growth driven by identity theft and data-focused cyber crime.”

Naraine expects criminal senders to use far better social engineering techniques to cloak malcode in what appears to become legitimate email with acceptable Net links.

For example:

A Facebook message sent from 1 friend to another includes a link to a YouTube video of interest to the recipient. The recipient clicks over a link supposedly sent by his/her friend, and then sees a prompt to install the latest version of Flash Player to be able to watch the video clip.
The user clicks to install the update, but actually installs a piece of malware on the machine, effectively involving the pc inside a botnet.

As cyber criminals move beyond mass-distribution style phishing scams, they're learning how to localize and personalize their attacks for far better penetration. 

Social networking sites like MySpace, Facebook and others will likely be applied as delivery mechanisms for getting unsuspecting users to a malicious Website link in order to deliver malware.

During the coming year, GTISC along with other security experts also expect a lot more targeted spear-phishing vehicles to install malware and/or steal data.
For example:

Attackers may target clients of a local credit union with a spoofed email referencing a local news story of

interest. Once clients click the bogus link inside the email, the malware is installed and can log keystrokes and mine other individual information| to be sent back to a malicious bot master or cyber criminal.

Naraine cited computing mono-cultures and slow or non-existent desktop computer software patching as fueling the malware/botnet crisis. “When you've almost 100 percent of users standardized on the single application, it approaches that a single issue of security failure can bring about infection of an entire computing ecosystem,” stated Naraine.

Naraine’s research implies that some of the largest botnets are comprised of corporate machines. “It takes

the average business2 to 3 months to apply a Windows patch across all devices, so malware and botnets

will continue to take in advantage of identified vulnerabilities within business environments.”

On the bright side,several software program vendors are now shipping auto-patch/update ability with every new software release.


Firefox, Adobe and Apple all do this And Naraine believes that Microsoft operating system security has improved with each successive release. The auto-update features support both corporate and consumer end users stay up to date with patches—which eliminates a lot of “low-hanging fruit” |for ones cyber crime community.



A total of 28940 different malicious and potentially unwanted programs were detected on users’ computers
in August. That is an increase of more than 8,000 on July's figures and points to a significant increase in the
number of in-the-wild threats.
                                                                                  http://www.kaspersky.com/news?id=207575678
“We are so conditioned to click on links, and the bad guys know this,” said Naraine. “The email lures, the
enticements and the personalization of malware attacks are getting much better. Social engineering attacks
on social networks are beginning to explode and will only get worse.”
                                                            Ryan Naraine - Security Evangelist, Kaspersky Lab, Americas

Read more »

Posted in: cyber crime survey,cyber crime threats,cyber threats,Emerging threats for malware,malware survey,malware threats,threats of malware