
Joe Telafici, vice president of operations for McAfee's Avert Labs said: - «It was a year which saw the effective extinction of young hackers who wrote viruses and other malicious programs for fun. Now, Windows malware was all about money."
Some attacks, such as phishing runs, were clearly about stealing cash from victims either from a credit card or bank account. But, he said, many others that looked more innocuous were done with money in mind. For instance, he said, trojans placed in banner ads that try to hijack a home PC were all about getting hold of resources that can be rented out for a fee to spammers or other net-based criminals. "There's a real eco-system built around this," he said.
Paul Henry, vice president of technology evangelism at Secure Computing said the tool of choice for many hi-tech criminals was the botnet - a collection of hijacked home PCs.
"They are at a point now where they are creating smaller botnets from larger ones." - He said.
2007 saw news break about one of the biggest botnets ever created. The network got its name from spam e-mails sent in January that capitalized on interest in a series of severe European storms to infect a large number of Windows PCs. Successive spam campaigns added to the numbers of machines in the Storm botnet and, though estimates vary, many believe it was made up of more than 1 million machines.
A ready market for the buying and selling of time on a botnet and the tools needed to put it to good use had sprung up, said Mr Henry: "Commercial exploitation has brought the real value of these tools to the vast majority."
One of the most widely known tools was the MPack kit which was created by a Russian hacker gang. Anyone buying it got included in the price a year of technical support that updated them with the latest vulnerabilities so it could be used time and again for attacks. But, said Mr Telafici, this had created problems for some makers of malicious software – “One kit developer recently threw in the towel because they could no longer get the margins they used to. Instead they opened up the source and gave it away. There were just too many players in that space, it's too crowded."
Novel threats - this busy market was driving innovation, said Simon Heron, managing director of Network Box.
Some of those that used to send huge numbers of phishing e-mails were now indulging in "spear phishing" which brought together lots of bits of data to make the messages they send look much more convincing. Mr Heron said he had seen campaigns targeted at a few hundred people such as the senior managers in a large firm: "It's just fascinating seeing that this is happening."
"The bad guys are becoming more sophisticated and that means its becoming more difficult to stay safe," he said.
Summing up Paul Henry from Secure Computing said 2007 was the year that hi-tech crime became firmly established and entrenched.
"I see no end to this," he said, "until we effectively reduce the value of personal information to the point where for the hackers it is useless."
0 comments :
Post a Comment