The underworld and online economy

PUNE: NOVEMBER 2008, a hacker is driving around Pune's streets in a car wired with a laptop, a GPS device and a wardriving software. He navigates around IT parks, multiplexes, markets, residential condos and busy streets. His intent - catching wireless signals and then recording details like MAC address, name of network, longitude, latitude and signal strengths.

None of the Wi-Fi users smell him around as he comfortably gathers their details in a few hours drive.

December 2007, a Massachusetts-based top US retailer finds its computers hacked for information related to its customers' credit card, debit card, check and return transactions. Data gets stolen from 45.7 million cards. Hackers access over 40 million accounts.

June 2008, Georgia, this time a country, faces a hard multi-prolonged distributed DOS (Denial of Service) attack as its president's website comes under the bull eye with a web-based Command and Control Server.

Governments, and countries, have to wake up and smell the coffee when their day is brought to a grinding halt by hackers who simply use compromised hosts in France and Sweden and deface about 300 web sites were hosted on the same ISP.

Year 2008. Goods worth $276 million get hawked in the new underworld of online economy.

Welcome to the new crime dungeons.

The third case simply iterates the similar attacks faced by countries like Estonia and Lithuania that held the complete country Internet infrastructure to ransom. More than 300 private and official sites get hit by what you call as proxy servers. This includes hit Web sites from the government and private sector, like the Baltic state's securities commission and ruling Social Democratic Party, a car dealership and a grocery chain.

The second case is the notorious retail theft case of the 2,500 discount store strong US retail chain T J Maxx. The hacking covered transactions beginning in January 2003 and ending November 23 and the hackers not only covered the US stores in the heist but also those in the UK and Ireland.

What happened with T J Maxx larceny simply follows other incidents preceding it, be it the theft on 108 DSW shoe stores or the Polo Ralph Lauren POS burglary that compromised the credit card data of as many as 180,000 people.

The first instance, for a change, is that of a bona fide hacking expert. The person wardriving in Pune was ClubHack's founder Rohit Srivastwa, who undertook the mission with the help of Pune Police and hence a cop by his side while he surveyed the status of wireless security in the city.

The findings were quite a jolt. Fifty per cent of the city's networks are open enough with no need of skill to be broken into while 31 per cent would take nothing more than 15 minutes to be hacked.

The motives have changed

It's no more just the kick factor. It's now about financial moolah.

And that's why, while yesteryear cyber criminals used to boastfully announce themselves, it's hard to trace the same breed of criminals.

"It's not so big-bang. The stealth has become harder to trace now," admits Ghosh from Symantec. The financial undercurrent is visible as we see India taking more than 100 Phishing attacks in its banks in last one year or in about 200 websites with compromised domains, as indicated by CERT.

The attacks have grown more tactical and business-oriented. If CERT (Computer Emergency Response Team) stats show 15760 sites attacked this year, I would still call it the tip of the iceberg," argues Bala Girisaballa, VP and Head of product and marketing, iViz Security.

"It's just five per cent of the glimpse. The rest 95 per cent of companies either don't know their vulnerabilities or would not reveal so due to credibility and image issues."

As Srivastwa observes, the motivations of criminals have changed from civil attacks to financial to even political.

"With political attacks, there is no case of any direct competition. They just want to show how stupid and vulnerable our top chairs are. People have really started exploiting the unawareness zone. It's time we take stock of our loopholes well," he says.

"At one of the IT conferences I attended, the top Minister himself admitted that his sites are challengeable. When it comes to Government and semi-Government related areas, it's not just the awareness that lacks but also the inner force. I am really worried with examples like NIC, which by the way, did a vulnerability assessment of the hosts, servers."

But these checks have to move beyond the formality factor and people with knowledge, and some basic exposure to technology are required now, so that it's not easy to fool them, he warns.

The industry has reached an inflection point where more new malicious programs are being created than good programs, says Vincent Weafer, vice president, Symantec Security Response.

"Today most malware is written by attackers who are financially motivated as opposed to teens trying to gain notoriety. Attackers have shifted away from mass distribution of a small number of threats to micro distribution of millions of distinct threats. They could get worse. We could easily see millions/tens of millions of unique threats per year."

And hence...

The fact that even in a city like Pune so many Wi-Fi users are blissfully unaware of their open windows and doors with WEP (Wired Equivalent Protection) in vogue still, even though it has been found to have been broken into several years back, is something that's surely making the Devil's task easy.

Dr.Kaustubh Phanse, wireless architect from Airtight Networks cites Wi-fi risks and Rogue access points alone as a global phenomenon. "Be it a 45 million credit card theft or a country-wide Denial of service, your own vulnerabilities are the new access points for criminals."

It's not hard to guess the DNA of the new villains. Can we still read the writing on the wall and get smarter?