Criminals Find New Ways to Attack on the Internet
STEVE INSKEEP, host:
And on Mondays we focus on technology. Today, Internet security. A report says home computer users - home computer users - are the most common victims of cyber crime. And as for cyber criminals, they've become more sophisticated, as NPR's Wendy Kaufman reports.
WENDY KAUFMAN: Dave Cole's work requires a very specific mindset.
Mr. DAVE COLE (Advanced Threat Research Team, Symantec): Our job is to think like the bad guys and to think where the bad guys will go next.
KAUFMAN: Cole oversees the advanced threat research team at Symantec, the world's largest provider of computer security software and services. The team's job is to find security flaws and address them before criminals can exploit them.
Mr. COLE: If we're not thinking like the bad guys every day, we have the potential of falling behind and basically only reacting to their moves.
KAUFMAN: Cyber criminals typically go after home computers. They tend to be less secure than those in corporate networks. The most recent study by AOL and the nonprofit National Cyber Safety Alliance found that four out of five home PCs lacked at least one of three critical protections: updated anti-virus software, spyware protection, or a working firewall which blocks certain communications.
Experts say without these protections your computer is vulnerable.
One method of attack is with something called a botnet, or a zombie army. Cyber criminals take over your computer and link it to hundreds, even thousands of other infected machines.
Jeff Moss, of the computer security training firm Black Hat, says the assault might look something like this.
Mr. JEFF MOSS (Black Hat): You see this plausible looking e-mail from Aunt Betty, and you click on the attachment, and it shows you a picture of a flower or something. But really in the background it has also infected your machine, taken it over and merged it into a larger grouping of other infected machines, under the control of some third party. And when they want to use it, they'll issue it commands and your computer will respond.
KAUFMAN: The attacker could have complete control of your machine, watching everything you do, gaining access to passwords and other personal data without you even knowing it. In some cases, these attacks can occur without you even opening an e-mail.
No one knows just how many machines are infected in this way, or indeed how many machines have been attacked in any form, though a Microsoft white paper published in June reported that in the preceding 15 months, 5.7 million Windows machines were found to have malicious software.
As we do new things on the Internet, the attackers have followed. Symantec's Dave Cole says social networking sites such as MySpace have become attractive targets. They contain vast amounts of personal information in one place, and users aren't always as careful as they should be.
Mr. COLE: If you're going out and looking at, you know, adult sites, there might be problems there and attempts to hack you. You might have your guard up. But if you're going to your friend's MySpace site, you're not expecting the advertisement in that page to attack you and to try and put a bunch of nasty stuff in your machine. And that's exactly what we've seen happen.
KAUFMAN: Given the amount of material that's posted to MySpace every day, it's all but impossible to ensure that individual postings are safe from spyware, viruses and worms.
Still, another potential avenue for cyber crime, says Jeff Moss, is the software embedded in devices such as a cable router, a TiVo, perhaps a TV satellite box, or a computer printer.
Mr. MOSS: How often do you update the software on your printer? You never do. But it's a computer running print software, and if you can find a way to break into that printer, you can use it to do - store information, attack the rest of the network. You can do many things with it. And really, there's a growing awareness that the threat is just not computers and home users. The threat is any computing device that's not properly configured.
KAUFMAN: Moss adds that hackers and criminals are typically looking for the low-hanging fruit, the easiest thing to attack that comes with a large payout.
Wendy Kaufman, NPR News, Seattle.