Cybercrime, it’s not just for big businesses anymore.
Every computer is a target.
It was a busy week in news about Internet security. It is hard to sometimes make sense of any given bit of news as a security threat to yourself but the recent article in the Wall Street Journal should make every business sit up and take notice.
“‘Ransomware’ a Growing Threat to Small Businesses” is interesting because it points to a threat that everyone understands. A criminal gains access to your business data and encrypts it so it is unusable unless you pay for the software to unlock it. Blackmail? Extortion? Datanapping? Whatever... it is old school no matter what you call it.
It is not just companies either. Sometimes these threats target individuals by presenting a “you have a virus” message that will not go away until you buy the “software” that will dismiss the warning — effectively locking you out of your computer.
In either case, the cost is not all that large to solve the problem. In the Wall Street Journal article the victim was being asked for only $400 to get access to their data. In the case of the “virus warning scam” it might be as cheap as $39.95 (they still want to keep the illusion of retail pricing).
These ransoms are indicative of how “scale” works on the World Wide Web. All numbers on the Internet are staggeringly large, so it does not take many successful exploits to make very good money.
But how would this happen to me?
This brings me to two other news items from last week. I saw both at Ars Technica.
First, “Faked Flash-based ads on HuffPo, other sites downloaded extortionware” gives you a good idea of how you face threats everyday. Most people do not realize that media websites are delivering content, ads and trackers from dozens of domains when a page loads. Criminals learn how to exploit this.
The threat will never look suspicious, modern cyber criminals have learned well from the marketing world.
The Huffington Post advertisement—a fraudulent Hugo Boss ad which also appeared on other major legitimate sites (including the real estate site Zillow.com)—was spread through DoubleClick via the ad network AdButler. … hundreds of legitimate websites end up displaying ads that could infect visitors with Cryptowall or other malware without detection.
But it is not all fun and ransom.
It is not likely that you have ever seen any of the above problems, but that does not mean you have avoided security problems. Another exploit is to take hidden control of your computer to use for other crimes. Criminals do this by infecting millions of computers with software that allows a central computer to operate the infected computers en masse. These are called “botnets”, or, a network of computer robots.
With a botnet your computer joins other infected machines to attack other computers or businesses. One simple use it to bring down a company website with what is called a DDOS attack (look it up). There are lots of uses for a botnet, many of these are built just to sell as a “service” to other criminals. (You do realize, of course, there is a marketplace for all these tools.)
This is the subject of the second article I saw on Ars Technica. “Botnet that enslaved 770,000 PCs worldwide comes crashing down” is somewhat of a success story where one of these botnets was shut down. The success was that it was shut down, unfortunately the culprits were not apprehended.
The important point I want to make here is that you and I need to be vigilant. We are frequently the “attack vectors” for these criminals.
Botnet operators used a variety of methods to infect targets, including exploiting known vulnerabilities in software such as Oracle Java, Adobe Flash, and Microsoft Silverlight. ... Other methods included sending spam and other forms of social engineering.
Sound familiar? We often do not even know we got hit.
What can we do as individuals?
First, do not make it easy for criminals, update your computer as soon as updates are available. I know it is a pain, but it is just part of the “hygiene” you must perform in your digital life.
You may live in a neighborhood where you do not need to lock your doors, but that neighborhood does not exist on the Internet.
You need to take active role in your protection. The threat is greater than Microsoft, Apple and Google combined. The criminals are clever and there are lots of them. I hope to write soon about ways you can better defend yourself and others.