The days of viruses and spam are over. Welcome to the terrifying world of identity theft and phishing scams, run by organized criminals who prey on uneducated PC users. In an exclusive interview, a government insider says antivirus software is useless.
Digital Journal — Don’t trust anyone. Cover your tracks. Never talk to strangers. Sure, it sounds like advice you’d give to a five-year-old kid, but it’s also worthwhile suggestions for PC users oblivious to cyber criminals lurking in the virtual shadows. According to security experts, today’s online attacks are not coming from playful kids with a penchant for mischief; the most destructive scams are now deployed by organized crime, giving rise to powerful threats North America can’t stop anytime soon.
“Your anti-virus software can’t help you.” It’s a terrifying statement, but also a much-needed reality slap courtesy of a computer security expert deeply involved in malicious attacks perpetrated by organized criminals. Gary Miliefsky is a founding member of the U.S. Department of Homeland Security and chief technology officer of network security firm NetClarity. In an exclusive interview with DigitalJournal.com, Miliefsky exposes just how serious a threat malware has become to the public. And he’s sorry to say that your supposedly updated anti-virus programs aren’t the best line of defence.
“Malware writers are attacking your computer like they never have before,” says Miliefsky. “Plain viruses are declining, and new attacks are taking advantage of a hole in an operating system or browser to plant Trojan viruses. And this kind of malware can render your Symantec software useless — you might see the Symantec logo but the program is dead.”
Malware is an umbrella term to describe a variety of hostile and intrusive program codes, and can include Trojans, programs that appear to perform one function in order to hide a malicious one. Also, phishing scams redirect traffic to fake websites to collect personal information for identity theft purposes. There’s no shortage of malware sub-genres, and no stopping the overflow: Around 125 to 175 new unique pieces of malware are written every day, Dave Marcus, of McAfee Avert Labs in Santa Clara, Calif., said recently.
Even more worrisome is a report from Russian antivirus company Kaspersky Labs —they say criminals are behind 90 per cent of global malicious code. “It’s getting more serious because many attacks are being developed by professionals,” the company says. “It’s not such good news because they have brains, and they are getting more experienced.”
The business of online identity theft has ballooned enormously: malware is an $8 billion (US) industry, according to the FBI. The statistic is an underlying reason unemployed hackers get swayed to organized crime with the lure of tax-free income and easy targets. “Think about a poor hacker in Russia with the skill level of a rocket scientist,” Miliefsky says. “If he has to put bread on the table, he’s going to take the job that gives him instant money, whether it’s legit or not.”
Malware has ballooned to an $8 billion (US) industry, according to the FBI, giving rise to unemployed genius hackers looking for easy money
The Browser Blues
What’s one of the most vulnerable areas on your PC for malware to sneak through? Browsers can be exploited easily, despite the promises of tech companies who praise new security features peppering the latest versions.
“We’re at a point where we need to be proactive and get educated,” says Miliefsky. He suggests diving deep into a browser’s backend, making sure no unnecessary add-ons pollute the program. He also points out how Explorer tends to install browser help objects (or BHOs) that can do more damage than good. Some can be useful, like the Google Toolbar, but some are snuck in through spyware. Miliefsky recommends using a tool called BHODemon (downloadable here) to find malicious add-ons and exterminate them.
Netizens also have to be vigilant about the pages they visit, says Bill Margeson, president of CBL Data Recovery Technologies. “You might be viewing a picture of Pamela Anderson, but underneath it is tons of ugly stuff invisible to you,” he notes.
Margeson points to one popular Windows hole: the ports. “This is a hacker’s real back door,” he says. By shutting off the firewall ports not in use, a savvy Webbie essentially blocks one method of access for wily hackers. It might not be foolproof, but it’s a lot smarter than relying on anti-virus software to corral attackers.
The War on Cyber Terrorism
As much as cyber-crime has won media attention, so has its bigger meaner cousin, cyber-terrorism. Miliefsky differentiates between the two by calling cyber-terrorism an e-attack meant to disrupt a city’s core infrastructure. It’s not as much about stealing identities as it is about “aiming two trains on a railway track at each other.”
As an insider in the Homeland Security Department, Miliefsky knows first-hand how the U.S. is combating this new form of terrorism. “We have cutting-edge technologies and we’re on top of what the enemy is doing,” he says cryptically, without offering any concrete examples. “But we’re human, so there’s the fear that someone will go on their lunch break and then an attack will be launched that cripples a critical system.”
It’s a scenario already affecting poorly prepared nations. Last week, Estonia suffered a barrage of cyber-attacks when its government decided to remove a war memorial to the Red Army from a square in the capital. Russian anger spilled into protest both on the streets and on the Web — remotely-controlled hijacked computers disabled websites of Estonian government ministries, politicians, banks and newspapers.
Estonia blamed the attack on Russia, and if their claim is correct, it would be the first cyber attack of one sovereign state on another. No matter the motive, the proof is in the Error 404 messages: cyber warfare is a new front in fracturing a nation beyond the usual weapons, and it’s a battlefield increasingly difficult to police. Defence ministries are familiar with protecting railways, airports, coastal lines and air space, but they’re less accustomed to surveying the vast landscape of the Internet. Since cyber-terrorism is being used more and more by traditional terrorist groups, it should be an ongoing area of interest for authorities. Whether we like it or not, cyber-terrorism will also be increasingly touching our lives, even if it acts as an online panopticon.
Is Your Cellphone Safe?
Up to now, PCs have been the primary target for e-criminals. But the future holds many scary possibilities, primarily the potential threat of cellphone malware: The launch of Apple’s iPhone in late June could spell disaster for early adopters, some experts predict.
The iPhone uses Apple’s OS X as a platform, and if predictions are true, the new innovative phone could capture 1 per cent of the cellphone market, or 10 million users. “If things work according to plan, by the end of 2008 we’ll see a mobile platform large enough to make it a worthwhile target for malware and cyber criminals,” writes Adrian Kingsley-Hughes on ZDnet. “Just because Apple has had a good security track record with OS X doesn’t guarantee that the iPhone will be as lucky.” He believes Apple is rushing the phone to market with a platform every hacker will be hungry to target. And malware on a cellphone could instigate another criminal opportunity very few wireless carriers are prepared for.
“The iPhone will get attention from perpetrators in its novelty phase,” Margeson predicts, “but since Apple is so security-conscious, it shouldn’t be an issue for long.”
Another salvo of bad news comes from a specialist at McAfee: In the last year, attackers have created spyware that can steal all data from the phone, enable call monitors, and pinpont the phone owner’s location.
If there’s going to be any headway into combating the spread of cyber crime and online terrorism, it’s going to have to come from the government level. Giving online experts the chance to find criminals and curb malware attacks is an idea every country should be pursuing. The two big superpowers in this area are the Joint Task-Force Global Network Operations (United States), which is responsible with fighting cyber terrorism, and the Centre for Protection of the National Infrastructure (United Kingdom).
But PC protection ultimately ends up as your responsibility. It’s not enough to rely on anti-virus software to harden a PC’s defence against online attacks. As experts are clamouring to tell us, hackers are always one step ahead of the latest software release. Close your ports, get software to add layers of protection and take time to read about the latest attacks so you can be vigilant against vigilantes.
Gary Miliefsky of NetClarity will be speaking on malware at the Infosecurity 2007 Conference in Toronto, Canada, on June 13, 9:30 a.m. For more info, go to www.infosecuritycanada.com
