Sound far-fetched?

Think service contracts, personalisation, and upgrades.  It’s all there. Suppliers of malware have become quite sophisticated in their offerings. Their motivation? Think one simple word: profits.

Malware suppliers have adopted many of the same business practices used by leading software providers.  But they are going one step further.   By embracing their competitors, malware suppliers are becoming more like a consortium in their ability to strategically deliver customised offerings, to tap into synergies, and, significantly, to share market intelligence.

Large enterprises may continue to be the most visible of the victims of cyber crime, but they are no longer its main focus.  Small to medium-sized firms provide much more viable targets.  But how do malware suppliers find the right targets?

One thing is for sure: they are not reinventing the wheel.

Malware suppliers are borrowing market research concepts and turning them into tools that can gather relevant information about potential targets.  Armed with treasures such as browser version, operating system software, IP address, and level of security patch, malware writers have a ready end-user profile at hand.

The Internet Security Systems X-Force team at IBM, headed by Gunter Ollman has been actively researching the methods used by cyber criminals.  In a recent Info World article, Ollman states that the most sophisticated of these cyber criminals are trading information such as IP addresses to ensure that their latest work is not discovered.

Though they may not have face-to-face meetings or send e-mail correspondence, these cyber criminals have other means of communicating with each other.  Whether through chat rooms or bulletin boards, they collaborate in ways that help extend the reach of their malicious code.

There is strength in numbers.

As recently reported in Info World, McAfee’s latest research report shows that criminals are connecting in greater volume than ever before.  Dave Marcus, a security research manager at McAfee’s Avert Labs believes that the criminals are doing a better job at communicating than the security industry itself.

Countries like Russia and China, which do not participate in worldwide groups that fight malware use, have become hotbeds for cyber criminals.   With no shortage of outlets for the distribution of their malicious code, their activity is expected to flourish in 2007.

VoIP systems are expected to see an increased volume of threats, as are mobile devices like smart-phones.  Threats in the form of phishing attacks, spyware, and mobile spam will become more commonplace.

What’s an end-user to do?  Natalie Lambert, of Forrester Research, recommends using a multi-layer approach to safeguard yourself.  Having a single security measure, such as an anti-virus program, is no longer enough and can’t protect against specific, targeted attacks, the type that are becoming de rigueur for sophisticated malware suppliers.

Cyber Security Bill Targets Botnets
Cyber Security Enhancement Act seeks criminal penalties for botnet attacks used to aid identity theft, enial-of-service attacks, and the spread of spam and spyware.
Tuesday, May 15, 2007 9:00 AM PDT

A tech trade group and a leading cybersecurity vendor applauded new legislation introduced in the U.S. Congress that would broaden penalties for cybercrime, including first-time penalties for botnet attacks.

The Cyber Security Enhancement Act, introduced Monday, would create for the first time criminal penalties for botnet attacks often used to aid identity theft, denial-of-service attacks and the spread of spam and spyware. Botnets are groups of compromised computers that hackers can control remotely.

The bill, introduced by Representatives Adam Schiff, a California Democrat, and Steve Chabot, an Ohio Republican, would also allow prosecutors to pursue racketeering charges against cybercriminal groups, would expand sentencing guidelines for cybercrime by allowing the forfeiture of property used to commit the crime, and would add US$30 million a year to the budgets of federal agencies fighting cybercrime.

The Business Software Alliance (BSA), a trade group, and Symantec Corp., a security vendor, both offered support for the legislation. BSA and other tech trade groups have pushed Congress to pass tougher cybersecurity legislation, and BSA said its member company CEOs will push for passage of the bill when they meet in Washington, D.C., in June.

"For too long. cyber criminals have taken advantage of legal blind spots and an under-resourced law enforcement community to brazenly threaten online confidence and security," BSA President and CEO Robert Holleyman said in a statement. "This legislation will give law enforcement updated and improved tools to combat what has become a growing, organized criminal enterprise."

Symantec, in a statement, cheered the cosponsors effort to target botnets. The sophistication of cybercrimes, particularly botnets, "far outstrips the laws on the books," said John Thompson, the company's chairman and CEO. The bill shows Congress is "truly serious" about combating cybercrime, he added.

The bill would also broaden the definition of electronic data theft related to interstate or foreign communication, and expand the cyber extortion statute.

Google Warns of Web Malware
The sheer volume of malware being hosted on websites was revealed through a Google study based on a year-long scan of over 4.5 million sites. “The Ghost in the Browser” study reports that one in 10 web pages are laced with malicious code. Of the sites the Google research team analyzed, 450,000 were capable of launching drive-by-downloads to install malicious code, like spyware and Trojans, onto users’ computers. Another 700,000 web pages were found to contain code that could compromise PCs.
 

Google searches web's dark side

Malicious programs are installed by visits to a booby-trapped site
One in 10 web pages scrutinised by search giant Google contained malicious code that could infect a user's PC.
Researchers from the firm surveyed billions of sites, subjecting 4.5 million pages to "in-depth analysis".

About 450,000 were capable of launching so-called "drive-by downloads", sites that install malicious code, such as spyware, without a user's knowledge.

A further 700,000 pages were thought to contain code that could compromise a user's computer, the team report.

To address the problem, the researchers say the company has "started an effort to identify all web pages on the internet that could be malicious".

Phantom sites

Drive-by downloads are an increasingly common way to infect a computer or steal sensitive information.

They usually consist of malicious programs that automatically install when a potential victim visits a booby-trapped website.

"To entice users to install malware, adversaries employ social engineering," wrote Google researcher Niels Provos and his colleagues in a paper titled The Ghost In The Browser.

Finding all the web-based infection vectors is a significant challenge and requires almost complete knowledge of the web

Google researchers
Hi-tech crime unit


Avoiding attacks

"The user is presented with links that promise access to 'interesting' pages with explicit pornographic content, copyrighted software or media. A common example are sites that display thumbnails to adult videos."

The vast majority exploit vulnerabilities in Microsoft's Internet Explorer browser to install themselves.

Some downloads, such as those that alter bookmarks, install unwanted toolbars or change the start page of a browser, are an annoyance. But increasingly, criminals are using drive-bys to install keyloggers that steal login and password information.

Other pieces of malicious code hijack a computer turning it into a "bot", a remotely controlled PC.

Drive-by downloads represent a shift away from traditional methods of infecting a computer, such as spam and email attachments.

Attack plan

As well as characterising the scale of the problem on the net, the Google study analysed the main methods by which criminals inject malicious code on to innocent web pages.

Spam e-mails are a common way to infect a computer

It found that the code was often contained in those parts of the website not designed or controlled by the website owner, such as banner adverts and widgets.

Widgets are small programs that may, for example, display a calendar on a webpage or a web traffic counter. These are often downloaded from third-party sites.

The rise of web 2.0 and user-generated content gave criminals other channels, or vectors, of attack, it found.

For example, postings in blogs and forums that contain links to images or other content could unwittingly infect a user.

The study also found that gangs were able to hijack web servers, effectively taking over and infecting all of the web pages hosted on the computer.

In a test, the researchers' computer was infected with 50 different pieces of malware by visiting a web page hosted on a hijacked server.

The firm is now in the process of mapping the malware threat.

Google, part of the StopBadware coalition, already warns users if they are about to visit a potentially harmful website, displaying a message that reads "this site may harm your computer" next to the search results.

"Marking pages with a label allows users to avoid exposure to such sites and results in fewer users being infected," the researchers wrote.

However, the task will not be easy, they say.

"Finding all the web-based infection vectors is a significant challenge and requires almost complete knowledge of the web as a whole," they wrote.