Economic Crisis May Be Boon For Cybercriminals

Economic Crisis May Be Boon For Cybercriminals
Kelly Jackson Higgins
Oct 28, 2008

http://www.darkreading.com/security/attacks/
showArticle.jhtml?articleID=211601123

How the global financial crisis is affecting organized cybercrime

One industry sector is actually happy about the current state of the global economy: cybercriminals.

Organized cybercrime has already begun capitalizing on the global financial crisis, cybercrime experts say, with targeted phishing attacks on customers whose banks have folded, and attacks that scam consumers who may be shopping less online, but are now spending more time at home. With fewer business and consumer targets available, the bad guys are redirecting their efforts to adapt to the market. For example, credit cards are out; debit cards are in.

One attack used Citigroup's attempted takeover of Wachovia as a premise for stealing Wachovia customers' credentials. (Wells Fargo eventually outbid Citigroup for Wachovia). "There's been a surge in phishing, telling customers that due to the new takeover, they need new credentials," says Ori Eisen, founder and chief innovation officer for 41st Parameter. If the victim hands over his old credentials to "set" his new ones, it's game over for his bank account information.

Socially engineered attacks are typically a lucrative ploy by seasoned attackers. The FBI is seeing more spear phishing aimed at businesses that were hit hard by the economic downturn. The attackers lure them with promises of financial assistance, for instance, and some even pretend to be subpoenas from the Justice Department. One attack via e-mail urged bidders who had lost out on a government contract to resubmit their bids and, thus, spill sensitive contact and other information.

Other researchers have cited a direct correlation between the stock market's nosedive and an increase in cybercrime activity. And phony antivirus popups warning that your "system may be infected so you'd better run this scan" preyed on fears, he says.

Meanwhile, law enforcement and cybercrime experts say more malicious Web sites posing as economic or financial advisory services will start to emerge in this jittery financial climate.

That means a reverse in the trend from the past few months of cybercriminals' silently infecting legitimate sites. "Expect to see malicious sites crop up that are geared to information-stealing, malware-dropping, pharming, and phishing rather than compromising legitimate site," he says.

And just as street crime increases in times of financial stress, more novice attackers and script kiddies are likely to perform an online version of shoplifting and bank robbery. "You're going to see more quick-hit script kiddies, like street crime," DiMino says.

It's simple enough for these amateur hackers to get into the business -- there's plenty of off-the-shelf software that automates phishing. All it takes is a Web server. "We know [when] it's an amateur because they are leaving their servers completely open and unprotected," Yuval Ben-Itzhak says.

The insider threat, too, will likely also intensify as layoffs spread in the corporate world. "You're going to see insider attacks and less direct hacks," Shadowserver's DiMino says. "There will be more of an attempt to infiltrate from inside, with botnets and SQL injection."

With potentially fewer overall enterprise targets, cybercrime organizations could end up fighting over turf. "In general, cybercrime is nothing more than a new form of organized crime," the FBI's Mott says. "You may see more online cybercrime 'violence.' DDoS attacks may go up."