The Cybercrime Wave That Wasn't 85
retroworks writes "Dinei Florencio and Cormac Herley write that cybercrime depleted gullible and unprotected users, producing diminishing returns (over-phishing). They argue that the statistics on the extent of losses from cybercrime are flawed because there is never an under-estimation reported. Do they underestimate the number of suckers gaining internet access born every minute? Or has cybercrime become the 'shark attack' that gets reported more often than it occurs?"
Flavour of the month (Score:5, Informative)
Ever notice how when there is a notorious crime reported suddenly lots of other similar crimes start happening? Well, they don't suddenly start, they were happening before, just not being reported. It isn't over or under reporting in the sense that our stats are wrong, only in the sense that the mass media does a shit job of conveying factual information to the public.
Defences are improving, people are getting more savvy. Obviously crime levels will go down. Back in 2002 XP didn't even have its firewall enabled by default. Everyone hated Vista for being locked down and hurling UAC prompts at the screen all the time, but it definitely worked.
Re: (Score:3)
I don't see why you would think this would be the case.
Pretty much every current IPv4 router[1] comes by default in a NAT configuration. To enable bridging, port forwarding etc generally requires changing settings on the router.
There's absolutely no reason why IPv6 routers can't have a stateful firewall that blocks incoming connections by default. It's LESS difficult to do than NAT as there doesn't need
Re: (Score:2)
Indeed. My WRT54GL (running a customized version of TomatoUSB with IPv6 and an OpenVPN server) handles IPv6 in precisely that way, with DROP being the default.
For the few home IPv6-capable servers that I run that need incoming access from the IPv6 internet, the router's web interface allows one to open specific ports for specific IPv6 addresses. No NAT required, which is nice: I can have several servers running on the same port with no issues.
Re: (Score:2)
he router's web interface allows one to open specific ports for specific IPv6 addresses. No NAT required, which is nice: I can have several servers running on the same port with no issues.
The question I put back to that statement though: Since NAT is a pseudo-firewall for IPv4, applications running on computers leverage some IP trickery (NAT traversal techniques) or dynamically map ports via UPnP to achieve connectivity. Those techniques aren't the classical "allow X past firewall" setting though, they merely give the traffic somewhere to go instead of bouncing off of the router's TCP stack.
How does one achieve the connectivity that full IPv6 *should* have (but won't because the clients w
Re: (Score:2)
If there is no firewalling an attacker with access to the adjacent network "outside" the NAT router can access the internal network (assuming knowledge of the internal IP addresses - which isn't that hard). This risk is normally quite low, compared to the risk of someone "out there" trying to get in.
But thinking they can't get in just because there's NAT and they're the other side of the world is not true. Hackers have been able to subvert ISP routers and
Re: (Score:1)
NAT by default drops all incoming connections
No it doesn't. NAT by default performs address translation. The stateful firewall drops incoming connections by default, NAT translates the permitted ones to a given address. There are consumer NAT boxes that include the concept of a 'default host' so any inbound traffic goes to that machine. There are others that include a firewall that drops inbound traffic.
The situation is more or less the same for IPv6. A firewall may default to not allowing any incoming connections, to only allowing incoming con
Please mod this informative (seriously) (Score:3)
Oh noes, he said something true that I don't like. Quick, mod it down! If you just mod hard enough eventually 2+2 will equal 5.
You were modded down because you're an asshole, posting off-topic. I humbly request anyone with a spare mod point to make this troll's day:
2+2 = 5
Re: (Score:2)
Two issues:
1 : the crimes were reported, as fraud, identity theft, etc ... just not categorised as Cyber Crime ...
2: People do more on-line now and so the crime that does happen costs them real money, not just inconvenience and so gets reported
Vista was rubbish at security, Microsoft finally woke up to the don't run as root model, then implemented it in a very visible way that annoyed the user into not reading the prompts ... so they accepted everything (including the scumware..)
Win7 seems
Re: (Score:2)
Win7 seems to have implemented it in the right way, ask when it's important, once, so it's unusual to see a prompt and so people actually read it ...
With Windows 7, I concur that Microsoft did do it right, but it's not that it asks any less frequently per se, it's just that certain things are automatically elevated without a UAC prompt. There were some nifty little tricks that abused that at first, because rundll32.exe was one of the auto-elevated applications.
What was really obnoxious about UAC in Vista (that lead me to turn it off) was that even running MMC, by itself, would cause a prompt. This was annoying as all hell when you were launching it t
Re: (Score:2)
Microsoft finally woke up to the don't run as root model, then implemented it in a very visible way that annoyed the user into not reading the prompts ... so they accepted everything (including the scumware..)
It was, unfortunately, necessary.
Back in the XP days legit software did a lot of bad things. Writing to the registry, shitting all over the filesystem, changing OS settings, installing drivers, making itself start at boot time and so forth. Microsoft could have just broken all that but then people would have been pissed off that none of their software worked. Instead they came up with UAC that annoyed the user in the hope that application developers would change their habits and try to avoid generating them
Smarter and Smarter (Score:2)
Re: (Score:2)
How do you phish with only 2 bits? That must be a miracle of coding.
Re: (Score:2, Funny)
Re: (Score:2)
Re: (Score:2)
Over-Phishing (Score:5, Funny)
Let's continue using the phishing analogy
Fly-phishing: Phishing involving air travel
Saltwater Phishing - Phishing from overseas
Weekend Phishing - A leisure time activity that's used more as an excuse to drink beer than to scam people
Phishing Boat - A scammer's base of operations located on a vessel in international waters
Phishing Rod - Viagra scams
Phishing Line - Like a pick-up line, but for money instead of sex.
Re: (Score:2)
No no no, Viagra Scams are Phishing Tackle.
Re: (Score:2)
Re: (Score:2, Funny)
So then is a phishing scam involving trousers called a Tackle Box?
no you wont see Tackle Box phishing scams until Viagra for women.
Re: (Score:2)
Somehow I see this taking a sidestep into trolling(as in fishing trolling, not "trolling is a art" trolling).
Re: (Score:2)
Re: (Score:2)
| - - - - - - - - - - |
Lameness filter encountered. Post aborted!
Filter error: Please use fewer 'junk' characters
Slashdot lameness, if that's really a really real word, should be la la la space filler.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Nunc eu dolor arcu. Mauris vestibulum venenatis dui. Nullam eu neque dui, et vulputate neque. Mauris dictum, ipsum vel suscipit bibendum, augue lorem semper sem, eu tempus justo magna at
Re: (Score:1)
Re: (Score:2)
UNPOSSIBLE! (Score:2, Insightful)
Cybercrime is the new terrorisim! The new war on drugs!
Something we can 'fight' forever and spread alot of money around. (most of it to ourselves and business partners)
Why do you hate america? Do you wan't the evil cyberterrorist criminals to steal your identity and rape your dog?
Plenty of suckers in the sea (Score:5, Interesting)
I work in a place that gets many calls related to phishing scams. You would not believe how many people argue with you on the legitness of the letter, they just don't understand why the money hasn't come to them yet. I don't believe in the past 5 years I've been here, the volume has decreased. Hasn't increased either, it tends to be steady every year.
My own parents were hit with a rental scam (even though I had told them always ask me first about anything fishy). It was hey we'll sign contract, here's money order, oh crap we sent you too much, can you send the difference back. Lost $500, but learned a lesson and changed how they do rental agreements as a result.
So 1 fish is out of the sea, but unfortunately with billions of people on the planet, there are plenty suckers out there. Also, many of these scams appeal to the get rich quick mentality of people. I mean how come other scams can keep working unless people have this need that "maybe this is the time this works and I can stop working or afford ".
To people thinking that every generation will get more computer savvy and this will go away, i tend to disagree. Just because a generation is tech savvy doesn't mean they won't fall for the temptation to make money quick, even if it does sound too good to be true.
Anyway, just my 2 cents.
Re:Plenty of suckers in the sea (Score:5, Funny)
If you think it's bad for the victims, think of the poor princes in Africa who can't find anyone to believe them when they want to traffic large sums of money into an offshore account?
Re:Plenty of suckers in the sea (Score:4, Funny)
Re: (Score:3)
Individual phishing events are the least of ones worries these days. Even if you're able to completely avoid fraud yourself, you're likely to have your account detailes exposed in a breach of a credit card processor.
Re: (Score:2)
Prepaid credit cards only, mate. $5 at Walgreens/CVS.
You can load enough cash to buy a car, and once it's empty there's no point in worrying - nothing gets charged unless you put the cash into the account first.
Re:Plenty of suckers in the sea (Score:5, Informative)
Or I could just use my regular credit card, which gives me various perks (cash back, airline miles, etc.) with no service fees (unlikely the prepaid ones).
In the unlikely event that my card is misused I simply call the bank, dispute the charges, and get a new card in the mail. This has happened to me once or twice over the years (bad guy acquired card info without my knowledge) and I've spent less than 30 minutes total dealing with the fallout from such events.
Sure, I shouldn't have to deal with it at all in an ideal world, but dealing with the aftermath of credit card fraud is pretty much a non-issue from the side of the customer.
Re: (Score:2)
Re: (Score:2)
I assume you're Canadian?
Laws regarding credit cards no doubt vary considerably internationally. In the US they're shockingly consumer-friendly. The burden of proof is basically on the merchant to demonstrate that the charge is legitimate. Until the dispute is resolved the charge has to be removed, you don't have to pay it, and you can't be charged interest on it either.
Re: (Score:2)
How often do these data breaches actually result in fraud?
Every few months, there seems to be another story about how a hacker has stolen millions of credit card numbers, but you hear few stories about victims of these attacks. You think there should be a large class action lawsuit or something in the news.
It just seems like most of the time, security consultants are exaggerating these stories to sell their products.
Re: (Score:2)
There was a slashdot report recently about the average taking from a stolen card number in a recent breach being about $20. This probably makes sense. If you put three $7 transactions on a card over a six month period then most people will probably just ignore them and assume that they were things that they simply forgot about. Some people will complain, and the bank will just reverse the charge and make the merchant (you) eat the loss (not really a loss, because you didn't really provide a product in re
Re: (Score:2)
legitness
Completely off-topic, but the word you're looking for is "legitimacy". I'm no grammar nazi, and I'm not trying to troll or put you down either; You seem quite literate. I just wouldn't like to think that you'd put such a non-word into a term paper / official document by mistake.
Re: (Score:1)
Hadn't had my caffeine yet. Normally I can't stand people misspelling words (even in MMO's), but don't say anything, just a pet peeve. When I noticed it, was already submitted and no edit button.
Re: (Score:3)
for Telephone scams one big trick is to have
http://www.gpo.gov/fdsys/pkg/CFR-2011-title47-vol3/xml/CFR-2011-title47-vol3-sec64-1200.xml [gpo.gov]
printed out and ready to read from during the call
very good odds that if they even think you know the law they will hang up quickly.
and yes in the US 47CFR64.1200 is THE LAW period FULL STOP
Re: (Score:2)
It was hey we'll sign contract, here's money order, oh crap we sent you too much, can you send the difference back. Lost $500,
I think banks should be held responsible for that one.
I never got the money order to see, but from what I understand banks deposit the money order and credit it (not like a check that gets verified first) and then, 2 weeks later, the money is yanked from your account, because money order is fake.
If you bring cash, bank will test it. If you deposit a check, it will get confirmed before money is available. Why are money orders different??
Fix the Surveys (Score:5, Funny)
Still a problem (Score:5, Interesting)
Over reported? Possibly. Is it still a problem that is a long way from being solved? Yes.
Just last week the university that I work at suffered a significant phishing attack that compromised a large number of email accounts (we don't have a complete count yet - the phisher turned around and used those accounts to send out spam and he didn't use all of them at one time). How did it work? Well, it wasn't very sophisticated - a dupe of our webmail login page (at a different URL) and an email that said "dear {university} account user...blah...account being locked...blah...go to this page {link to copy of page with fugly URL}...blah" from a Yahoo address. And the students (arguably an intelligent bunch, and most young enough to know how computers and phishers work) drank the kool-aid, clicked on the link and, in the end, made quite a mess.
I've actually been in the room when people have said "hey, this Nigerian prince thing looks like a good idea" . I've spoke with people who let a phone caller from "Microsoft" take control of their PC. And it comes from both sides. I've received legitimate emails from my bank that l could've sworn up and down were from a spammer (unsolicited, from someone I've never met, from a branch that I don't go to, poorly formatted and offering me a free credit card) but which were upon further review (checked the email address and the phone number provided in the email with the bank's fraud division) were legit. That irks me the most because it just encourages people to accept stuff that doesn't pass the smell test.
The more press this kind of thing gets the better. I'm not saying it should take headlines and mindspace from other, worthy causes but the fact is that people - including me - are stupid. If you don't hit us over the head every once in awhile to remind us why we ought not to do this than we probably will.
Worse than just being long... (Score:5, Insightful)
Is it any wonder computer crime remains a serious problem? Society has not yet adjusted its thinking to align with the computer age. People have no concept of how easily emails can be forged -- one of my favorite demos to give people is to send them an email that has their own email address in the "From" field. There is also a general lack of technical knowledge that creates problems for people; a friend once told me that by password-protecting her BIOS, she could ensure that a thief would not be able to read her hard drive (she was shocked when I made her aware that a thief could just remove her laptop's hard drive and insert it into a different computer).
Eventually society will catch up. People eventually learned that traditional sword fighting tactics need to be dropped when you are dealing with firearms. In a few decades, computer security will improve out of necessity. Unfortunately, the time between now and then will be painful.
Re: (Score:2)
It is not just that we are a long way from solving the problem of computer crime; we are not even trying to solve it. We are still sluggish on deploying digital cash
That only shifts who can be a criminal from anyone to only the government, which has proven its criminal intent repeatedly. I do not think this is as good an idea as you do.
People eventually learned that traditional sword fighting tactics need to be dropped when you are dealing with firearms
And yet we still issue bayonets...
Re: (Score:2)
We are still sluggish on deploying digital cash
How does digital cash solve the Nigerian scam problem?
How does digital cash solve the problem of using a user's credentials to transfer money out?
Which common computer crime problems does digital cash solve?
Re:Worse than just being long... (Score:4, Interesting)
Which common computer crime problems does digital cash solve?
https://en.wikipedia.org/wiki/Card_not_present_transaction [wikipedia.org]
You know how you get this funny feeling about giving your credit card details to some unknown website, or over an unsecure connection, or to some stranger at a gas station? The reason you get that funny feeling is that you are worried that the person you just gave that information to might turn around and spend your money, a basic form of online credit card fraud. It happens all the time, and that information is one of the things that is traded on "carder" forums. Now we have an even worse problem: well known businesses might be attacked, and have databases full of payment information copied.
Now, a digital cash smart card is another story. You have a card with enough memory to store some digital cash tokens and some circuitry for carrying out a digital cash protocol. You want to buy something online? Plug your smartcard into your computer (why don't we ship computers with smartcard readers?), make the payment, and the worst that can happen is that the counterparty never delivers what you purchased. No fears about your credentials being used to make fraudulent payments, no worries about a database of payment information, and your money can only be stolen the traditional way: someone taking your smartcard from your wallet.
This was one of the original points of digital cash. Anonymous payments are not good because they let you evade government regulations, they are good because they do not create identity theft problems. Digital cash is good because it is anonymous, and because it is hard (in a cryptographic sense) to make fraudulent payments without at least betraying your identity in the process (and thus opening yourself up to prosecution).
I am not going to claim that all financial crime problems will be solved with digital cash. People will still need to transfer cash to their smartcards somehow, which is something that also needs to be secured. The point here is that we could defend ourselves from a large and important class of computer crimes by deploying relatively inexpensive hardware (a one-time cost) and some well-developed cryptographic protocols.
Re: (Score:3)
I recently got to play with a new prototype credit card. It's pretty neat, there is a small LCD and a button built into the card, as well as a NFC transceiver. You put it near your phone or computer and it displays the transaction amount on the card's screen. You press the button and it authorises it, by sending a single-use token to the computer. If your computer is trojaned then it can only be used to steal amounts equal to those of purchases you make (but altering the payee ID, although the next vers
Re: (Score:2)
Re: (Score:1)
I've spoke with people who let a phone caller from "Microsoft" take control of their PC.
Fair do's here... this con has always been quite convincing, you are after all talking to a real person and they know your computer is running slow, so they must be on the level and there getting better and better scripts .
The first ones I got were pretty crude where they make a non-specific allegation that "We are calling on behalf of your ISP and they say..." more recently they have talked me through opening up my Event Viewer so I could see all the scary warnings and errors to be told 'ohhh its wors
Re: (Score:1)
I've spoke with people who let a phone caller from "Microsoft" take control of their PC.
I've had 2-3 of these a year for the last few years and I try and string them along as long as possible as a service to :-(
society... Its great fun, but don't try and buy time by saying you have to switch your computer on, they just ring off
Well, if you think about it, someone who doesn't leave their computer on all the time is a less desirable target for data harvesters or trojan/botnet admins. The more someone uses their computer to manage more parts of their life (and therefore have more sensitive data stored there) the more likely they are to leave it on all the time, for later rooted perusal, DDOS zombie use, etc.
Re: (Score:2)
I've received legitimate emails from my bank that l could've sworn up and down were from a spammer (unsolicited, from someone I've never met, from a branch that I don't go to, poorly formatted and offering me a free credit card) but which were upon further review (checked the email address and the phone number provided in the email with the bank's fraud division) were legit.
I'm surprised you actually went that far, and didn't delete the mail instantly. That's what I do with such mails. From my bank I only expect automatic incoming remittance notifications; anything else that appears to be from my bank or any other bank gets deleted without even reading the body.
Re: (Score:2)
Most of them go to my spam folder or get filtered into another folder that is not spam but might as well be for the number of times I look there. When one gets past that gauntlet I naturally want to find out how it did so and where my rules might need tuning. Because I thought it was fraud I started collecting info from the email to send to my bank's fraud division (as long as I was reading the email anyway) and it rolled from there.
Re: (Score:2)
Over reported? Possibly. Is it still a problem that is a long way from being solved? Yes.
Your post, and every other slashdot comment I've read so far on this article, misses the two main points of the article and talks about something else instead. The two main points of the article are:
(1) The monetary damage to victims of cybercrime has been wildly overestimated.
(2) The profitability of cybercrime is extremely low.
Your anecdote about the phishing scam hitting your university doesn't contradict either of these points. From your description, it sounds like there were a lot of hassles created fo
Re: (Score:2)
On the surface it appears to be nothing more than a hassle for my department. To a point that's fine - that's what our department is paid to do. However there is an opportunity cost there - the time we spend cleaning up the mess is time we could have spent elsewhere. There's also cost to the students, staff and alumni involved in the attack (yes, we provide email to all three groups) - students and staff dislike the policy we have of making them prostrate themselves before our department to ask that they
Re: (Score:2)
I believe your claim that this particular phishing attack has had negative effects on various people. What I don't believe is that (1) this has anything to do with the article linked to from the slashdot summary, or (2) that these negative effects are in any way quantifiable (which is basically the point of the article). The problems you're citing are like broken windows, graffiti, or finding used condoms in your front yard when you go out to get the morning paper; they're a bummer, but they're not quantifi
Re: (Score:2)
That is all.
Beat me to it.
I miss Taco...
Trolling for profit and job security. (Score:1)
If you are a member of a non-profit that exists to educate and information about specific harm X, you should make sure to inflate your figures so that it seems there's a Biblical plague of X out there. Job security is guaranteed this way. If you just leave it up to X to manifest itself, you could be out of a job real quick. The biggest user of this theory is government itself, which is going to invent waves of drug dealers, Nazis, terrorists, fundamentalists, pedophiles and corporate men in black in order t
there is never an under-estimation reported (Score:2)
...there is never an under-estimation reported.
Say what again?
Re: (Score:2)
Feature, not Bug (Score:4, Interesting)
Having dug into some of the statistics publicized for the drug war, I would say that merely having "absurdly bad statistical methods" could be an improvement. In the drug war, statistics are frequently more or less made up. Remember, the people funding this research have a vested interest and a strong desire to have the numbers come out the way they want them to and, no surprise, they generally do. There are whole institutes, such as the Center on Addiction and Substance Abuse at Columbia University, whose statistics I regard as consistently untrustworthy.
I would not be too surprised to see the same dynamic, and even the same people, involved in the cybercrime statistics game.
Re: (Score:2)
Remember, the people funding this research have a vested interest and a strong desire to have the numbers come out the way they want them to and, no surprise, they generally do.
Yep. I worked on a cybercrime startup idea for a while, and every single "cost of cybercrime" calculation I found - even from government agencies - was based on the same estimate from MarkMonitor. After a few years, MM was able to cite the more "official" sources with a circular reference.