Organized Crime Hackers Are The True Threat To American Infrastructure
At its peak, the utility's back-end computers that run its customer database were flooded with 5.7m spurious packets of data a second, bringing all legitimate transactions to a standstill. On the second day of the attack, the utility called in Prolexic Technologies. Based in Florida, Prolexic maintains "scrubbing centres" around America, Europe and Asia to suck up such malevolent deluges. The attack on the utility was identified as originating within the United States.
Make no mistake, the attackers were not pranksters bent on causing mischief. Nor was the attack a simple "smash and grab" aimed at stealing a few passwords. The kind of perpetrators involved were hardened criminals who use rented "botnets" to extort money from their victims, or to steal intellectual property, industrial secrets and marketing plans for sale to rivals at home and abroad.
This is big business now organised crime has access to automated exploit-kits and cloud-based software services that are every bit as sophisticated as (some say even more so than) those used by Fortune 500 companies. No longer do criminals need their own tame programmers. They can rent all the crimeware services they need to infiltrate a target's computer network invisibly, and remain undetected for months or years while siphoning off secrets for sale.
How many firms pay the ransom or buy the phony "remedial solutions" to get their businesses back up and running is anyone's guess. Various figures circulate for the cost of doing business with cyber-criminals. Symantec, a large security-software provider famous for its Norton Antivirus products, estimates that global cyber-crime costs victims $110 billion a year in remediation and lost business as well as ransom payments.
That is probably a reasonable guess (other security-software firms put the figure far higher). Shawn Henry, a former assistant director of the Federal Bureau of Investigation, told Congress recently about how one company had all its data on a ten-year, $1 billion research programme copied by hackers in a single night.
While it may make headlines, fears that attacks by the People's Liberation Army and other Chinese hackers could wreak havoc on America's critical infrastructure-especially, its oil and gas pipelines, electricity and water supplies, wireless networks, air-traffic control systems, even its missile defences-are overblown. The Chinese have far too much at stake to risk such provocation.
What China's cyber-crooks are focused on plain and simple is theft. They are out to steal all the industrial secrets they can from America's high-tech firms-especially those with advanced "fracking" technology for extracting natural gas and tight oil from shales and rocks deep underground. By all accounts, the authorities in Beijing are concerned that an energy-independent America could shift the global balance of power in a significant way.
In a sense, though, the victims of such attacks have only themselves to blame. Many organisations have a false sense of security, complacency even, as a result of having invested heavily in security tools in the past. Yet "non-agile" defences like passwords, firewalls and antivirus software, as well as intrusion-detection and prevention systems have become less than effective now attackers have started using encryption and other tricks to evade them, notes Deloitte & Touche, a management consultancy.
Most websites keep usernames and passwords in master files that are "hashed" with software which encrypts both the username and the password together, so no one can see the plain-text version of either. When someone attempts to log in, the website automatically encrypts both the username and password entered. It then determines whether the hash matches the one stored in the site's user database. If not, a well-designed site will freeze the account after a limited number of unsuccessful attempts to gain access.
That is why most cyber-criminals go "spear-phishing" instead. This involves targeting a low-level individual in an organisation using an e-mail scam that fools the hapless individual into visiting a tainted website. Once there, a malicious tag (called an "iframe") in the HTML code responsible for the page's appearance is injected into the visitor's browser. The inserted malware can be a virus, a Trojan or, most likely, a key-logger. This watches for the user's log on and password, and reports the keystrokes back to the attackers. It is then only a short step to stealing secrets from the victim's employer.
Having gained access to the target network, attackers usually run the standard application for accessing databases known as SQL (Structured Query Language). A query is sent to the database masquerading as an innocent request for information, but is really a malicious command designed to reveal confidential data, such as credit-card names and numbers. Literally millions of databases that reside behind websites have been compromised by SQL-injection.
But that is only the half of it. Over the past five years, web attackers have combined forces with botnet operators, who rent their armies of zombie computers to shady organisations responsible for spam, fraud and other nefarious activities. As Mary Landesman, a noted cyber-crime writer, has observed, organised crime has embraced the cloud with a vengeance, and begun delivering "malware as a service" through these powerful distributed networks of infected computers.
Meanwhile, two particularly nasty pieces of crimeware have emerged from the hacking underworld. One is an exploit kit known as Blackhole, which invisibly redirects someone visiting a legitimate website to a compromised site where malware can be loaded. Meanwhile, the victim never knows his browser has left the legitimate site. Cyber-criminals can rent access to Blackhole software by the day or lease a Blackhole server for periods of three months to a year at a time. Today, it accounts for about a third of all detected threats, says Sophos, a data-security firm based in Britain.
The other piece of crimeware to be aware of is a rootkit called ZeroAccess. Like all rootkits, ZeroAccess is capable of hiding its presence from all normal methods of detection, while maintaining privileged access to a computer's inner workings. Because it is effectively invisible to security software, cyber-criminals use it for secretly installing other malware, including Blackhole. With its invisibility cloak, ZeroAccess lets attackers exploit a compromised network for months or even years on end.
There is no doubt that cyber-crime is on the increase. One reason is simply that the internet was conceived without any form of security in mind. Another is that social media like Facebook and Twitter have made it insanely easy to gather information about a person or a business-and thereby build persuasive scams that exploit human weaknesses to penetrate a network's outer perimeter.
What is to be done? In a recent blog, Tyler Durden of Kaspersky Lab, a computer-security company with headquarters in Moscow and branches around the world, says that essentially it is a matter of impressing people, at a personal level, about the seriousness of the threat. "It's not about IPs, firewalls, ports and protocols any more... Building secure perimeters and adding corporate policies and certificates is great, but [such things] are starting to become useless."
The trouble is people use their own devices-smartphones, tablets and laptops-for corporate as well as private tasks. They also use their social-media accounts and cloud services like Dropbox to send and receive important data. As far as company policies are concerned, the computer-security situation is out of control. Today is a paradise for attackers, says Mr Durden.
The good news is that the threat of cyber-crime is being seen increasingly as a business opportunity. There are more venture start-ups in data security today than at any time in recent decades. Meanwhile, governments have begun to take the problem seriously.
As Mr Durden notes, everyone at the recent RSA 2013, the computer-security world's annual shindig, was talking about Barack Obama's executive order-"in a good way". In his state-of-the-union address last month, the president decreed that America's cyber-defences should be strengthened by the increasing of information sharing, and the development of standards to protect the country's national security, its jobs and its people's privacy. The security industry waits to learn how these fine words translate into action. So, presumably, do the cyber-criminals.
Click here to subscribe to The Economist
