Cybercrime

Anonymous, LulzSec, and the Option of Internet Security

As hacking groups such as Anonymous and LulzSec continue to make headlines, many of us in the Information Security field can only sit back and shake our heads. The large number of successful system breaches, web site defacements, and the publication of confidential data is not at all surprising, and for the most part was only a matter of time. more

New Research Reveals 56% Rise in Cost of Cybercrime

New research indicates cyberattacks increasingly plague businesses and government organizations, resulting in significant financial impact, despite widespread awareness. Conducted by the Ponemon Institute, the Second Annual Cost of Cyber Crime Study revealed that the median annualized cost of cybercrime incurred by a benchmark sample of organizations was $5.9 million per year, with a range of $1.5 million to $36.5 million each year per organization. This represents an increase of 56 percent from the median cost reported in the inaugural study published in July 2010. more

Cybercrime Losses Overestimated, Say Researchers

Cybercrime losses may be erroneously overestimated as most information available on cybercrime losses are derived from surveys, argue two researchers in a recent paper titled, "Sex, Lies and Cybercrime Surveys". Dinei Florencio and Cormac Herley from Microsoft Research examine some of the difficulties of forming an accurate cybercrime estimate by survey. more

US, India Sign Cybersecurity Agreement

The United States and India signed a Memorandum of Understanding (MOU) today to promote closer cooperation and the timely exchange of information between the organizations of their respective governments responsible for cybersecurity, according to U.S. Department of Homeland Security. "The MOU was signed in New Delhi by Jane Holl Lute, Deputy Secretary for the U.S. Department of Homeland Security (DHS) and R. Chandrashekhar, Secretary, India Department of Information Technology." more

Pentagon Reveals Largest Ever Loss of Defense Data in Cyberattack

The Associated Press published an article today that the Pentagon revealed that earlier this year, they suffered one of its largest ever loss of sensitive data to a foreign government by a cyberattack. ... It's hard to say what's right and what's wrong. On the one hand, the Secretary of Defense says that the cyberwar is very real. On the other hand, the cyberczar Howard Schmidt said that there is no cyberwar and instead government needs to focus its efforts to fight online crime and espionage... more

Aged Security Flaw Renews Open/Closed-Source Debate

The recent announcement of a 13-year old security flaw found in an Open Source security library has renewed the debate between open source and closed source software. The library, crypt_blowfish, allows for fast two-way password encryption. The flaw introduces the potential for passwords to be easily compromised and affects PHP and a number of Linux distributions that include the crypt_blowfish library. more

Researchers Use Social Graphs to Detect Spammers, Attackers

A project named S-GPS or Spammer Global Positioning System, by Microsoft researchers uses spammer identification rather than spam identification to identify zombie-based spammers. more

At the Start of the NL IGF

At the annual Dutch "delegation" dinner at the Internet Governance Forum (IGF) in Vilnius, Lithuania, I voiced that it may be a good idea to start a Dutch IGF. This followed a discussion in which we discussed the possibilities of involving more people and organisations from the Netherlands in Internet governance. The, now, Ministry of Economic Affairs, Agriculture and Innovation followed this thought and made it possible for the ECP/EPN foundation to start the NL IGF. more

Research Detects Spammers Using Fake URL-Shortening Services

New research has uncovered evidence of spammers establishing their own fake URL-shortening services for the first time. According to the latest MessageLabs Intelligence report, shortened links created on these fake URL-shortening sites are not included directly in spam messages; instead, the spam emails contain shortened URLs created on legitimate URL-shortening sites. "Rather than leading directly to the spammer's final Web site, these links actually point to a shortened URL on the spammer's fake URL-shortening Web site, which in turn redirects to the spammer's final Web site." more

Interpol Joining ICANN’s Governmental Advisory Committee as an Observer

Kevin Murphy reporting in DomainIncite: "Interpol plans to apply to join ICANN's Governmental Advisory Committee as an observer, according to ICANN. The news came in a press release this evening, detailing a meeting between ICANN president Rod Beckstrom and Interpol secretary general Ronald Noble. The meeting 'focused on Internet security governance and enhancing common means for preventing and addressing Internet crime'." more

Microsoft Data Suggests 1 Out of Every 14 Downloads is Malware

Microsoft Program Manager, Jeb Haber, reports in a blog post that from browser data collected on user downloads, 1 out of every 14 programs downloaded is later confirmed as malware. Haber says: "Consumers need information to make better decisions. That said, IE9 adds another layer of defense against socially engineered attacks that now looks at the application being downloaded -- this is in addition to the URL-based protection described above. This new layer of protection is called SmartScreen Application Reputation." more

The Crimeware Infection Lifecycle

The distribution and installation of malicious and unauthorized software has evolved consistently throughout the 21st Century. The evolutionary path from annoying viruses, to destructive malware and on to financially driven crimeware, is well documented and can even be conveniently traced via the parallel evolution of technologies that were designed to counter each new aspect of the then contemporary threat. more

Understanding the Modern DDoS Threat

The breadth of cyber threats that an organization must engage with and combat seemingly change on a daily basis. Each new technology, vulnerability or exploit vector results in a new threat that must be protected against. Meanwhile some forms of attack never appear to age -- they remain a threat to business continuity despite years of advances in defensive strategy. One particularly insidious and never-ending threat is that of the Distributed Denial of Service (DDoS) attack. more

Canada Becoming the New Cybercrime Hub, Quickly Replacing China, Eastern Europe

A recently conducted analysis of Canada's cyber security risk profile by Websense has detected trends indicating Canada is becoming the new launchpad for cybercriminals. Sr. Manager, Security Research at Websense in a blog post writes: "Cybercriminals are on the move again. And, this time, Canada is the prime target. IP addresses in China and Eastern Europe are highly scrutinized and undergoing intense evaluation. So hackers are on a quest to move their networks to countries, like Canada, that have better cyber reputations." more

Responsibilities of the DNS: “Oh YES you will!”, “Oh NO you will not!”

What is the responsibility of the DNS? Should the DNS be responsible for policing traffic across its infrastructure? Should the blocking and blacklisting of names or throttling of query packets be the responsibility of the DNS? From experience I know my opening paragraph has started passionate debates in more than one section of this globe. We at CommunityDNS have found ourselves right in the middle of such heated debates. "Oh YES you will!", "Oh NO you will not!" more