Forgot your password?
typodupeerror
Crime Security Your Rights Online

The Cybercrime Wave That Wasn't 85

Posted by samzenpus
from the online-boogeyman dept.
retroworks writes "Dinei Florencio and Cormac Herley write that cybercrime depleted gullible and unprotected users, producing diminishing returns (over-phishing). They argue that the statistics on the extent of losses from cybercrime are flawed because there is never an under-estimation reported. Do they underestimate the number of suckers gaining internet access born every minute? Or has cybercrime become the 'shark attack' that gets reported more often than it occurs?"
This discussion has been archived. No new comments can be posted.

The Cybercrime Wave That Wasn't

Comments Filter:
  • Flavour of the month (Score:5, Informative)

    by AmiMoJo (196126) <mojo@NOspAm.world3.net> on Monday April 16, 2012 @07:12AM (#39699125) Homepage

    Ever notice how when there is a notorious crime reported suddenly lots of other similar crimes start happening? Well, they don't suddenly start, they were happening before, just not being reported. It isn't over or under reporting in the sense that our stats are wrong, only in the sense that the mass media does a shit job of conveying factual information to the public.

    Defences are improving, people are getting more savvy. Obviously crime levels will go down. Back in 2002 XP didn't even have its firewall enabled by default. Everyone hated Vista for being locked down and hurling UAC prompts at the screen all the time, but it definitely worked.

    • Two issues:

      1 : the crimes were reported, as fraud, identity theft, etc ... just not categorised as Cyber Crime ...

      2: People do more on-line now and so the crime that does happen costs them real money, not just inconvenience and so gets reported

      Vista was rubbish at security, Microsoft finally woke up to the don't run as root model, then implemented it in a very visible way that annoyed the user into not reading the prompts ... so they accepted everything (including the scumware..)

      Win7 seems

      • by RulerOf (975607)

        Win7 seems to have implemented it in the right way, ask when it's important, once, so it's unusual to see a prompt and so people actually read it ...

        With Windows 7, I concur that Microsoft did do it right, but it's not that it asks any less frequently per se, it's just that certain things are automatically elevated without a UAC prompt. There were some nifty little tricks that abused that at first, because rundll32.exe was one of the auto-elevated applications.

        What was really obnoxious about UAC in Vista (that lead me to turn it off) was that even running MMC, by itself, would cause a prompt. This was annoying as all hell when you were launching it t

      • by AmiMoJo (196126)

        Microsoft finally woke up to the don't run as root model, then implemented it in a very visible way that annoyed the user into not reading the prompts ... so they accepted everything (including the scumware..)

        It was, unfortunately, necessary.

        Back in the XP days legit software did a lot of bad things. Writing to the registry, shitting all over the filesystem, changing OS settings, installing drivers, making itself start at boot time and so forth. Microsoft could have just broken all that but then people would have been pissed off that none of their software worked. Instead they came up with UAC that annoyed the user in the hope that application developers would change their habits and try to avoid generating them

  • I think every generation will get more computer savvy, making it harder for 2-bit phishers or lazy hackers to cause any real damage.
    • How do you phish with only 2 bits? That must be a miracle of coding.

    • Depends on your definition of "computer savvy" - as we get more layers of UI people will generally have less and less of an idea what's going on, just look at how many people equate "windows" and "computer". People will hopefully become more resistant to social engineering approaches like phishing, but the use of a computer is almost coincidental, these types of scams have been going on since the telegraph system and probably before. Gullible people will always fall for something.
  • by SJHillman (1966756) on Monday April 16, 2012 @07:12AM (#39699131)

    Let's continue using the phishing analogy

    Fly-phishing: Phishing involving air travel
    Saltwater Phishing - Phishing from overseas
    Weekend Phishing - A leisure time activity that's used more as an excuse to drink beer than to scam people
    Phishing Boat - A scammer's base of operations located on a vessel in international waters
    Phishing Rod - Viagra scams
    Phishing Line - Like a pick-up line, but for money instead of sex.

    • by Canazza (1428553)

      No no no, Viagra Scams are Phishing Tackle.

      • by RulerOf (975607)
        So then is a phishing scam involving trousers called a Tackle Box?
        • Re: (Score:2, Funny)

          by Anonymous Coward

          So then is a phishing scam involving trousers called a Tackle Box?

          no you wont see Tackle Box phishing scams until Viagra for women.

    • Somehow I see this taking a sidestep into trolling(as in fishing trolling, not "trolling is a art" trolling).

    • Trawl Phishing: Sending phishing emails in bulk without targetting, in the hope someone will be dumb enough. The classic approach, as opposed to spear phishing.
    • by Inda (580031)
      Wow. With all those methods I could probably catch a Phish this big:

      | - - - - - - - - - - |

      Lameness filter encountered. Post aborted!
      Filter error: Please use fewer 'junk' characters

      Slashdot lameness, if that's really a really real word, should be la la la space filler.

      Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nunc eu dolor arcu. Mauris vestibulum venenatis dui. Nullam eu neque dui, et vulputate neque. Mauris dictum, ipsum vel suscipit bibendum, augue lorem semper sem, eu tempus justo magna at
    • Don't forget "Phishing License" - State sponsored phishing for gov't or corporate secrets.
  • UNPOSSIBLE! (Score:2, Insightful)

    by Anonymous Coward

    Cybercrime is the new terrorisim! The new war on drugs!

    Something we can 'fight' forever and spread alot of money around. (most of it to ourselves and business partners)

    Why do you hate america? Do you wan't the evil cyberterrorist criminals to steal your identity and rape your dog?

  • by Formorian (1111751) on Monday April 16, 2012 @07:22AM (#39699171)

    I work in a place that gets many calls related to phishing scams. You would not believe how many people argue with you on the legitness of the letter, they just don't understand why the money hasn't come to them yet. I don't believe in the past 5 years I've been here, the volume has decreased. Hasn't increased either, it tends to be steady every year.

    My own parents were hit with a rental scam (even though I had told them always ask me first about anything fishy). It was hey we'll sign contract, here's money order, oh crap we sent you too much, can you send the difference back. Lost $500, but learned a lesson and changed how they do rental agreements as a result.

    So 1 fish is out of the sea, but unfortunately with billions of people on the planet, there are plenty suckers out there. Also, many of these scams appeal to the get rich quick mentality of people. I mean how come other scams can keep working unless people have this need that "maybe this is the time this works and I can stop working or afford ".

    To people thinking that every generation will get more computer savvy and this will go away, i tend to disagree. Just because a generation is tech savvy doesn't mean they won't fall for the temptation to make money quick, even if it does sound too good to be true.

    Anyway, just my 2 cents.

    • by SJHillman (1966756) on Monday April 16, 2012 @07:31AM (#39699213)

      If you think it's bad for the victims, think of the poor princes in Africa who can't find anyone to believe them when they want to traffic large sums of money into an offshore account?

    • by Hatta (162192)

      Individual phishing events are the least of ones worries these days. Even if you're able to completely avoid fraud yourself, you're likely to have your account detailes exposed in a breach of a credit card processor.

      • Prepaid credit cards only, mate. $5 at Walgreens/CVS.

        You can load enough cash to buy a car, and once it's empty there's no point in worrying - nothing gets charged unless you put the cash into the account first.

        • by heypete (60671) <pete@heypete.com> on Monday April 16, 2012 @08:52AM (#39699747) Homepage

          Or I could just use my regular credit card, which gives me various perks (cash back, airline miles, etc.) with no service fees (unlikely the prepaid ones).

          In the unlikely event that my card is misused I simply call the bank, dispute the charges, and get a new card in the mail. This has happened to me once or twice over the years (bad guy acquired card info without my knowledge) and I've spent less than 30 minutes total dealing with the fallout from such events.

          Sure, I shouldn't have to deal with it at all in an ideal world, but dealing with the aftermath of credit card fraud is pretty much a non-issue from the side of the customer.

          • by u38cg (607297)
            Well, until you get a CIFAS listing or equivalent. Then you're innocent but your life becomes very difficult.
      • How often do these data breaches actually result in fraud?

        Every few months, there seems to be another story about how a hacker has stolen millions of credit card numbers, but you hear few stories about victims of these attacks. You think there should be a large class action lawsuit or something in the news.

        It just seems like most of the time, security consultants are exaggerating these stories to sell their products.

        • There was a slashdot report recently about the average taking from a stolen card number in a recent breach being about $20. This probably makes sense. If you put three $7 transactions on a card over a six month period then most people will probably just ignore them and assume that they were things that they simply forgot about. Some people will complain, and the bank will just reverse the charge and make the merchant (you) eat the loss (not really a loss, because you didn't really provide a product in re

    • legitness

      Completely off-topic, but the word you're looking for is "legitimacy". I'm no grammar nazi, and I'm not trying to troll or put you down either; You seem quite literate. I just wouldn't like to think that you'd put such a non-word into a term paper / official document by mistake.

      • Hadn't had my caffeine yet. Normally I can't stand people misspelling words (even in MMO's), but don't say anything, just a pet peeve. When I noticed it, was already submitted and no edit button.

    • for Telephone scams one big trick is to have
      http://www.gpo.gov/fdsys/pkg/CFR-2011-title47-vol3/xml/CFR-2011-title47-vol3-sec64-1200.xml [gpo.gov]
      printed out and ready to read from during the call
      very good odds that if they even think you know the law they will hang up quickly.

      and yes in the US 47CFR64.1200 is THE LAW period FULL STOP

    • by Mitreya (579078)

      It was hey we'll sign contract, here's money order, oh crap we sent you too much, can you send the difference back. Lost $500,

      I think banks should be held responsible for that one.
      I never got the money order to see, but from what I understand banks deposit the money order and credit it (not like a check that gets verified first) and then, 2 weeks later, the money is yanked from your account, because money order is fake.
      If you bring cash, bank will test it. If you deposit a check, it will get confirmed before money is available. Why are money orders different??

  • by residieu (577863) on Monday April 16, 2012 @07:45AM (#39699287)
    So we need to fix the surveys! If you get asked about how much you lost to cybercrime, claim to be a cybercriminal and give negative numbers. "I made $2 million in my Nigerian Prince scam. Would you help me smuggle money out of my country before my usurper cousin recovers it?"
  • Still a problem (Score:5, Interesting)

    by alaffin (585965) on Monday April 16, 2012 @07:51AM (#39699307) Journal

    Over reported? Possibly. Is it still a problem that is a long way from being solved? Yes.

    Just last week the university that I work at suffered a significant phishing attack that compromised a large number of email accounts (we don't have a complete count yet - the phisher turned around and used those accounts to send out spam and he didn't use all of them at one time). How did it work? Well, it wasn't very sophisticated - a dupe of our webmail login page (at a different URL) and an email that said "dear {university} account user...blah...account being locked...blah...go to this page {link to copy of page with fugly URL}...blah" from a Yahoo address. And the students (arguably an intelligent bunch, and most young enough to know how computers and phishers work) drank the kool-aid, clicked on the link and, in the end, made quite a mess.

    I've actually been in the room when people have said "hey, this Nigerian prince thing looks like a good idea" . I've spoke with people who let a phone caller from "Microsoft" take control of their PC. And it comes from both sides. I've received legitimate emails from my bank that l could've sworn up and down were from a spammer (unsolicited, from someone I've never met, from a branch that I don't go to, poorly formatted and offering me a free credit card) but which were upon further review (checked the email address and the phone number provided in the email with the bank's fraud division) were legit. That irks me the most because it just encourages people to accept stuff that doesn't pass the smell test.

    The more press this kind of thing gets the better. I'm not saying it should take headlines and mindspace from other, worthy causes but the fact is that people - including me - are stupid. If you don't hit us over the head every once in awhile to remind us why we ought not to do this than we probably will.

    • by betterunixthanunix (980855) on Monday April 16, 2012 @08:27AM (#39699559)
      It is not just that we are a long way from solving the problem of computer crime; we are not even trying to solve it. We are still sluggish on deploying digital cash (no, not Bitcoin, more like Chaum), relying on traditional systems of banking that have been translated into electronic forms (debit cards, credit cards, PayPal, etc.). We are still relying on passwords to protect money, personal information, and so forth. We are still relying on the From: field in an email to determine who the email came from. When things go wrong, we just call up the police and do nothing to fix the inherent security problems that made the attack possible.

      Is it any wonder computer crime remains a serious problem? Society has not yet adjusted its thinking to align with the computer age. People have no concept of how easily emails can be forged -- one of my favorite demos to give people is to send them an email that has their own email address in the "From" field. There is also a general lack of technical knowledge that creates problems for people; a friend once told me that by password-protecting her BIOS, she could ensure that a thief would not be able to read her hard drive (she was shocked when I made her aware that a thief could just remove her laptop's hard drive and insert it into a different computer).

      Eventually society will catch up. People eventually learned that traditional sword fighting tactics need to be dropped when you are dealing with firearms. In a few decades, computer security will improve out of necessity. Unfortunately, the time between now and then will be painful.
      • by drinkypoo (153816)

        It is not just that we are a long way from solving the problem of computer crime; we are not even trying to solve it. We are still sluggish on deploying digital cash

        That only shifts who can be a criminal from anyone to only the government, which has proven its criminal intent repeatedly. I do not think this is as good an idea as you do.

        People eventually learned that traditional sword fighting tactics need to be dropped when you are dealing with firearms

        And yet we still issue bayonets...

      • by TheLink (130905)

        We are still sluggish on deploying digital cash

        How does digital cash solve the Nigerian scam problem?
        How does digital cash solve the problem of using a user's credentials to transfer money out?
        Which common computer crime problems does digital cash solve?

        • by betterunixthanunix (980855) on Monday April 16, 2012 @10:57AM (#39700717)

          Which common computer crime problems does digital cash solve?

          https://en.wikipedia.org/wiki/Card_not_present_transaction [wikipedia.org]

          You know how you get this funny feeling about giving your credit card details to some unknown website, or over an unsecure connection, or to some stranger at a gas station? The reason you get that funny feeling is that you are worried that the person you just gave that information to might turn around and spend your money, a basic form of online credit card fraud. It happens all the time, and that information is one of the things that is traded on "carder" forums. Now we have an even worse problem: well known businesses might be attacked, and have databases full of payment information copied.

          Now, a digital cash smart card is another story. You have a card with enough memory to store some digital cash tokens and some circuitry for carrying out a digital cash protocol. You want to buy something online? Plug your smartcard into your computer (why don't we ship computers with smartcard readers?), make the payment, and the worst that can happen is that the counterparty never delivers what you purchased. No fears about your credentials being used to make fraudulent payments, no worries about a database of payment information, and your money can only be stolen the traditional way: someone taking your smartcard from your wallet.

          This was one of the original points of digital cash. Anonymous payments are not good because they let you evade government regulations, they are good because they do not create identity theft problems. Digital cash is good because it is anonymous, and because it is hard (in a cryptographic sense) to make fraudulent payments without at least betraying your identity in the process (and thus opening yourself up to prosecution).

          I am not going to claim that all financial crime problems will be solved with digital cash. People will still need to transfer cash to their smartcards somehow, which is something that also needs to be secured. The point here is that we could defend ourselves from a large and important class of computer crimes by deploying relatively inexpensive hardware (a one-time cost) and some well-developed cryptographic protocols.

          • I recently got to play with a new prototype credit card. It's pretty neat, there is a small LCD and a button built into the card, as well as a NFC transceiver. You put it near your phone or computer and it displays the transaction amount on the card's screen. You press the button and it authorises it, by sending a single-use token to the computer. If your computer is trojaned then it can only be used to steal amounts equal to those of purchases you make (but altering the payee ID, although the next vers

          • by TheLink (130905)
            No, I don't get that funny feeling at all. Because with credit cards it's not my money - it's a CREDIT card after all! If there's card fraud it's usually the merchant's (or more rarely the bank's) money that's gone. And if the merchant doesn't deliver, I complain to my card issuer, and I don't have to pay for that transaction. It may take a while for some cases but meanwhile the scenario is: my money is with me, the bank says I owe them. It's in the interest of the bank to fix the situation. I can complain
    • by mlush (620447)

      I've spoke with people who let a phone caller from "Microsoft" take control of their PC.

      Fair do's here... this con has always been quite convincing, you are after all talking to a real person and they know your computer is running slow, so they must be on the level and there getting better and better scripts .

      The first ones I got were pretty crude where they make a non-specific allegation that "We are calling on behalf of your ISP and they say..." more recently they have talked me through opening up my Event Viewer so I could see all the scary warnings and errors to be told 'ohhh its wors

      • I've spoke with people who let a phone caller from "Microsoft" take control of their PC.

        I've had 2-3 of these a year for the last few years and I try and string them along as long as possible as a service to
        society... Its great fun, but don't try and buy time by saying you have to switch your computer on, they just ring off :-(

        Well, if you think about it, someone who doesn't leave their computer on all the time is a less desirable target for data harvesters or trojan/botnet admins. The more someone uses their computer to manage more parts of their life (and therefore have more sensitive data stored there) the more likely they are to leave it on all the time, for later rooted perusal, DDOS zombie use, etc.

    • by wvmarle (1070040)

      I've received legitimate emails from my bank that l could've sworn up and down were from a spammer (unsolicited, from someone I've never met, from a branch that I don't go to, poorly formatted and offering me a free credit card) but which were upon further review (checked the email address and the phone number provided in the email with the bank's fraud division) were legit.

      I'm surprised you actually went that far, and didn't delete the mail instantly. That's what I do with such mails. From my bank I only expect automatic incoming remittance notifications; anything else that appears to be from my bank or any other bank gets deleted without even reading the body.

      • by alaffin (585965)

        Most of them go to my spam folder or get filtered into another folder that is not spam but might as well be for the number of times I look there. When one gets past that gauntlet I naturally want to find out how it did so and where my rules might need tuning. Because I thought it was fraud I started collecting info from the email to send to my bank's fraud division (as long as I was reading the email anyway) and it rolled from there.

    • by bcrowell (177657)

      Over reported? Possibly. Is it still a problem that is a long way from being solved? Yes.

      Your post, and every other slashdot comment I've read so far on this article, misses the two main points of the article and talks about something else instead. The two main points of the article are:

      (1) The monetary damage to victims of cybercrime has been wildly overestimated.

      (2) The profitability of cybercrime is extremely low.

      Your anecdote about the phishing scam hitting your university doesn't contradict either of these points. From your description, it sounds like there were a lot of hassles created fo

      • by alaffin (585965)

        On the surface it appears to be nothing more than a hassle for my department. To a point that's fine - that's what our department is paid to do. However there is an opportunity cost there - the time we spend cleaning up the mess is time we could have spent elsewhere. There's also cost to the students, staff and alumni involved in the attack (yes, we provide email to all three groups) - students and staff dislike the policy we have of making them prostrate themselves before our department to ask that they

        • by bcrowell (177657)

          I believe your claim that this particular phishing attack has had negative effects on various people. What I don't believe is that (1) this has anything to do with the article linked to from the slashdot summary, or (2) that these negative effects are in any way quantifiable (which is basically the point of the article). The problems you're citing are like broken windows, graffiti, or finding used condoms in your front yard when you go out to get the morning paper; they're a bummer, but they're not quantifi

  • If you are a member of a non-profit that exists to educate and information about specific harm X, you should make sure to inflate your figures so that it seems there's a Biblical plague of X out there. Job security is guaranteed this way. If you just leave it up to X to manifest itself, you could be out of a job real quick. The biggest user of this theory is government itself, which is going to invent waves of drug dealers, Nazis, terrorists, fundamentalists, pedophiles and corporate men in black in order t

  • ...there is never an under-estimation reported.

    Say what again?

    • by residieu (577863)
      Seem to assume the only way to cancel out an over-estimation is someone reporting a negative loss. Not sure why, Respondent A reporting $10k when his loss was really $5k could be canceled by Respondent B who lost $5k but was too embarrassed to say so.
  • Feature, not Bug (Score:4, Interesting)

    by mbone (558574) on Monday April 16, 2012 @08:27AM (#39699555)

    How do we reconcile this view with stories that cybercrime rivals the global drug trade in size? One recent estimate placed annual direct consumer losses at $114 billion worldwide. It turns out, however, that such widely circulated cybercrime estimates are generated using absurdly bad statistical methods, making them wholly unreliable.

    Having dug into some of the statistics publicized for the drug war, I would say that merely having "absurdly bad statistical methods" could be an improvement. In the drug war, statistics are frequently more or less made up. Remember, the people funding this research have a vested interest and a strong desire to have the numbers come out the way they want them to and, no surprise, they generally do. There are whole institutes, such as the Center on Addiction and Substance Abuse at Columbia University, whose statistics I regard as consistently untrustworthy.

    I would not be too surprised to see the same dynamic, and even the same people, involved in the cybercrime statistics game.

    • by Jay L (74152)

      Remember, the people funding this research have a vested interest and a strong desire to have the numbers come out the way they want them to and, no surprise, they generally do.

      Yep. I worked on a cybercrime startup idea for a while, and every single "cost of cybercrime" calculation I found - even from government agencies - was based on the same estimate from MarkMonitor. After a few years, MM was able to cite the more "official" sources with a circular reference.

The ideal voice for radio may be defined as showing no substance, no sex, no owner, and a message of importance for every housewife. -- Harry V. Wade

Working...