Organized cybercrime is alive and well. Criminals are invading cyberspace, utilizing its anonymity, widespread reach and disjointed law enforcement status to further their illicit moneymaking schemes. Security practitioners need to be aware of this activity and understand what they need to defend against.
The motive
For cybercriminals, it all comes down to the bottom line. Attackers threaten organizations with denial-of-service floods unless the companies fork over $20,000 to $50,000. Such extortion attempts, once focused on offshore gambling and porn sites, have recently moved up-scale, targeting small- and medium-sized e-commerce sites, including cash-rich financial services companies associated with investments and credit card processing. Flooding such sites hits the bottom line dramatically and quickly, making them a tempting target for attackers.
Other cybercrime attacks focus on stealing sensitive information from employee and consumer computers, including account numbers, credit card numbers and passwords for critical applications. With this sensitive information, attackers can assume the identity of consumers, fraudulently purchase high-ticket consumer electronic devices and ship them overseas for resale at a handsome profit. Using the cash available from these attacks, bad guys have created an organized cybercrime industry, channeling some of their ill-gotten gain back into research and development to create more powerful malware for more insidious attacks.
The technique
Many of these criminal schemes, especially denial-of-service extortion and the pillaging of personal financial information for credit card fraud, involve bots, semi-autonomous agents surreptitiously installed on victims' computers for remote control en masse. Groups of bot-controlled machines under the command of a single attacker are called botnets. With a botnet of ten-thousand to one-million controlled systems, an attacker can benefit from huge economies of scale. In a flood, a botnet can let an attacker generate Gigabits per second of traffic, gumming up even the hardiest of Internet sites. Using keystroke logging and screen scraping functionality on a botnet of thousands of machines, an attacker can pillage sensitive information from consumers and employees alike.
Your defense
To prevent your organization from becoming a victim of a botnet-generated denial-of-service attack, keep your ISP's emergency contact number on hand. Don't rely on the regular phone number for billing or the abuse e-mail address for critical emergencies like a packet flood. You need a hotline number that you can call for instant help if a flood ensues.
Going further, some ISPs have deployed automated sensor networks to detect and instantly throttle the traffic patterns associated with denial-of-service floods. Several vendors, including Arbor Networks, Mazu Networks and Cisco Systems, are marketing such flood-control technologies. Ask your ISP what kind of technologies they are using to detect and thwart such floods. If they don't answer, suggest that they investigate such technologies to help protect their most important customer, you.
Next, help prevent bots from being installed on your organization's computers. An organization failing to exercise due diligence in securing its computers could be held legally liable for identity theft attacks against its employees. To lower the chance of bot infiltration, thoroughly deploy antivirus and antispyware tools, and keep them updated on a daily basis. Antivirus tools typically have rudimentary antispyware capabilities, but this functionality pales in comparison with a full-blown antispyware tool. Thus, make sure you maximize your advantage by deploying both technologies. And, given that attackers have a chance to make more money the longer that a bot is installed, the bad guys release frequent updates of their bot code, necessitating daily updates to antivirus and antispyware signatures.
Furthermore, many bots are successfully deployed because of unpatched system vulnerabilities, especially client-side vulnerabilities in browsers. Make sure you rapidly test and apply the latest patches in your environment. When new vulnerabilities are discovered, for which there is not yet a patch, consider the work arounds offered by vendors.
About the author
Ed Skoudis is a founder and senior security consultant with Intelguardians, a Washington, DC-based information security consulting firm. His expertise includes hacker attacks and defenses, the information security industry and computer privacy issues. In addition to Counter Hack Reloaded, Ed is also the author of Malware: Fighting Malicious Code. He was also awarded 2004, 2005 and 2006 Microsoft MVP awards for Windows Server Security, and is an alumnus of the Honeynet Project. As an expert on SearchSecurity, Ed answers your questions relating to threats.
