Phishing fraud in aggregate
Phishing fraud has also proven itself to be enormously profitable in aggregate. In just a few years, "phishing" has become a household name for stealing banking details from hapless victims over the internet. There's a sucker born every minute, and they all use email nowadays – thanks to our woefully insecure e-mail system, people get lured to a fake site. What might be surprising is how quickly a phisher can turn a profit and convert that "virtual money" into real cash.
At Virus Bulletin this year, Guillaume Lovet from Fortinet gave an interesting presentation about "dirty money on the wires: the business models of cyber criminals" where he detailed the often complex set of arrangements behind the Big Population risk. His accompanying paper was published in the proceedings of the 16th Virus Bulletin International Conference.
From younger workers doing technical grunt work to older folks doing the money laundering and interacting with organised crime, the illicit business model runs the full gamut of criminal activity. Most interesting to me was Lovet's discussion of the intense profitability around phishing – after he presented a typical phishing business model, he compared its profitability to the manufacture and sale of heroin.
More incredibly, he argued that electronic phishing scams might just be even more profitable than selling drugs. The exact numbers and the drug analogy can be disputed, of course. But based on the short time needed and the large payoff I'd say there's probably less risk of getting caught doing phishing (as opposed to selling drugs) as well. Lovet found that a typical phishing profit might range from $2,500 to $25,000 - not bad for a day's work.
Looking at the groups behind the theft gives a keen insight to the business of cyber crime. Low risk, high profit, and it's unlikely that the criminals will get caught. No wonder phishing has exploded in just a few years. More than that, it's unlikely that the victims will even know something was wrong with their Windows computer until their identity, banking, or credit card details are compromised and used. That $499 PC purchased mail-order for your aunt isn't looking so attractive any more, is it?
That's pretty much where we are today. The only problem with Lovet's analysis, as I could see, is around getting hard numbers and actual case studies – but understand that the very nature of the crime means that this sort of data is likely only held by the FBI, Interpol, and other national police agencies. And for every crime ring they crack, there are countless more that go unpunished.
Big money from the Little Guy
It's pretty common to find viruses or trojans now that encrypt a user's hard drive and then demand a ransom to give the data back. This is a somewhat targeted attack focusing on individuals, the Little Guy, and is small potatoes for the most part (unless you're one of the victims). Where it gets interesting is with the upturn in targeted trojans that seek out individual companies and then try one do one thing very, very well.
Targeted trojan attacks are just as one might expect: software that is very focused on stealing from individual companies in a stealthy manner. The people behind these trojans are criminal hackers going after some very specific types of data from within just one target: a large bank, a military installation, a Fortune 500 company or a government office. They craft a customised trojan horse – or purchase one – that avoids detection from anti-virus software. Then they try to lure at least one person from the target organization to install it, and voila. Reconnaissance begins. The trojan could be sent via e-mail, but that seems unlikely because it's so obvious. Even accounting people today know not to click on unknown attachments in email.
But what about a blended attack, a malicious Word or Excel document sent in email with a zero-day exploit? Or it could be as simple as sending the victim a link to a web page with a zero-day exploit for Internet Explorer, easily infecting the machine and prompting the download and installation of a malicious trojan. Step one is complete.
These are threats that are very difficult to detect, because by their nature they almost always avoid the signature-based detection models used by anti-virus software – no signature will have been created yet because none of the AV companies would have seen this exact trojan signature before. Some types of heuristics in various AV software can still identity unknown trojans, but the results are not always consistent or reliable. The point of this discussion is that sometimes the Little Guy, the individual or isolated company, is not so little after all.