The Internet – A Living Breathing Minefield!

image An strong argument could be made, that the Internet has turned into a playground for cyber-criminals. While it may be a playground for criminals, without a doubt – it is a minefield for the rest of us.

In fact, I have been arguing this position for considerably over a year on this Blog, and for much longer than that on other sites I contribute to.

I’m not suggesting that I’m alone in this view. Many of the Internet security specialists within my group, have come to the same conclusion.

Why then are typical/average Internet users blissfully unaware of the potential dangers – actually, lets stop the “potential” nonsense – the very REAL dangers users are forced to deal with while attached to the Internet?

Let me start by selectively quoting Graham Cluley, senior technology consultant, at Sophos“:

“No one should be in any doubt that the web is still the main vector of attack for cybercriminals”.

“The problem is that too many computer users still think there’s no danger in surfing the web”.

This second point is the issue. That’s the reality that’s consistently missed by the mainstream media. The same mainstream media who jump on non stories -non stories like the recent Conficker scare, which supposedly was primed to take over the cyber world last April 1. Most of us are aware however, that essentially nothing happened.

image

Curiously, this same mainstream media have failed to follow up on this story to report on the considerable devastation being caused by this malware since April1. No surprise there though, since powerful media groups seen to suffer from attention deficit disorder.

As Internet users we are engaged in a battle, yes a battle, against highly sophisticated and highly organized cyber-crooks who are relentless in their pursuit of your money and make no mistake – it’s all about the money; your money.

In the worst case scenario, your identity and your financial security can be severely compromised by these cyber-criminals.

Looking at recent estimates provided by a number of Internet security companies, the consensus seems to be that there are over 11,000,000 malware programs currently in the ether. Various Internet security companies report having to deal with as many as 20,000 new versions of malware daily. Here’s the math; one new malware program every four seconds!

Frankly, I’m at a loss trying to understand why this is not NEWS! One would think that a criminal enterprise, or enterprises, that stole, according to some estimates, 105 Billion dollars annually, would be subject to massive coverage in the mainstream media.

But, what do I know – I’m just one of the guys in the trenches who has to deal with this every day! Just one of the guys who sees the consequences Internet users who have been impacted by this crime wave, are left to deal with. See “How Fake/Rogue Software Affects Real People”, on this site.

Since additional sophisticated threats are being developed, or are currently being deployed, some observers are of the opinion that the Internet is essentially broken. If you think this is an exaggeration, check out the following and then you decide.

Tainted search engine results: Internet security gurus have known for some time that we can not rely on Internet search engine output to be untainted and free of potential harmful exposure to malware.

Cyber-crooks continue to be unrelenting in their chase to infect web search results, seeding malicious websites among the top results returned by these engines. When a potential victim visits one of these sites, the chances of downloading malicious code onto the computer by exploiting existing vulnerabilities, is extremely high.

Infected legitimate websites: According to an Internet security industry leader Sophos, over 90 percent of dangerous websites, that is – websites that are distributing Trojan horses and spyware – are legitimate sites that have been hacked through SQL injection.

It was reported recently that over sixteen thousand web pages are being infected daily; three times the rate of infection noted in the previous year. Work out the math, and you’ll find that’s one new infected legitimate website every five seconds!

More disturbing, seventy nine percent of compromised web pages tracked this year were on legitimate web sites; including web sites owned by Fortune 500 companies, government agencies and ironically, security vendors.

Drive-by downloads: Drive-by downloads are not new; they’ve been lurking around for years it seems, but they’ve become much more common and craftier recently.

If you’re unfamiliar with the term, drive-by download, they are essentially programs that automatically download and install on your computer without your knowledge.

This action can occur while visiting an infected web site, opening an infected HTML email, or by clicking on a deceptive popup window. Often, more than one program is downloaded; for example, file sharing with tracking spyware is very common. It’s important to remember that this can take place without warning, or your approval.

Rogue software: Unless you have had the bad experience of installing this type of malicious software, you may not be aware that such a class of software even exists. But it does; and regrettably, it is becoming more widespread.

Most rogue software uses social engineering to convince users’ to download this type of malicious software.

A rogue security application is an application, usually found on free download and adult websites, or it can be installed from rogue security software websites, using Trojans or manipulating Internet browser security holes.

After the installation of rogue security software the program launches fake or false malware detection warnings. Rogue security applications, and there seems to be an epidemic of them on the Internet currently, are developed to mislead uninformed computer users’ into downloading and paying for the “full” version of this bogus software, based on the false malware positives generated by the application.

Even if the full program fee is paid, rogue software continues to run as a background process incessantly reporting those fake or false malware detection warnings. Over time, this type of software will essentially destroy the victim’s computer operating system, making the machine unusable.

Some types of rogue security software have the potential to collect private and personal information from an infected machine which could include passwords, credit card details, and other sensitive information.

Email scams: Email scams work because the Cyber-crooks responsible use social engineering as the hook; in other words they exploit our curiosity.

The fact is, we are all pretty curious creatures and let’s face it, who doesn’t like surprise emails? I think it’s safe to say, we all love to receive good news emails.

It seems that more and more these days, I get phishing emails in my inboxes all designed to trick me into revealing financial information that can be used to steal my money.

If you’re unfamiliar with phishing, it is defined as the act of tricking unsuspecting Internet users into revealing sensitive or private information. In a phishing attack, the attacker creates a set of circumstances where the potential victims are convinced that they are dealing with an authorized party. It relies for its success on the principle that asking a large number of people for this information, will always deceive at least some of those people.

A personal example of how this works is as follows. According to a recent email (similar in form and content to 20+ I receive each month), my online banking privileges with Bank of America had been blocked due to security concerns. This looked like an official email and the enclosed link made it simple to get this problem solved with just a mouse click. What could be easier than that?

Clicking on the link would have redirected me to a spoof page, comparable to the original site, and I would then have begun the process whereby the scammers would have stripped me of all the confidential information I was willing to provide.

My financial and personal details, had I entered them, would then have been harvested by the cyber-crooks behind this fraudulent scheme who would then have used this information to commit identity and financial theft.

These types of attacks against financial institutions, and consumers, are occurring with such frequency that the IC³ (Internet Crime Complaint Center), has called the situation “alarming”, so you need to be extremely vigilant.

Being involved in computer security, I am amazed and frankly frustrated, at the lack of knowledge exhibited by most typical computer users, and most importantly, the lack of knowledge concerning the need to secure their machines against the ever increasing risks on the Internet. This takes us back of course to the lack of media coverage dealing with these issues.

We now live in the age of the “Interconnectedness of All Things” in which we are beginning to see the development and availability of large numbers of Internet connected devices. There is no doubt that this will lend new strength to computer-aided crime and in this new political environment we now live in, perhaps even terrorists.

This is by no means an exhaustive list of the dangers we are exposed to on the Internet. There are many more technical reasons why the Internet is becoming progressively more dangerous which are outside the scope of this article, but one worth mentioning is the recent discovery that the very backbone of the Internet DNS can be compromised.

The Domain Name System serves as the “phone book” for the Internet by translating human-readable computer hostnames, e.g. http://www.example.com, into IP addresses, e.g. 208.77.188.166, which networking equipment needs to deliver information.

So what do you think? Is the Internet broken, and is it a playground for cyber-criminals? Your comments are always welcome.

Review the following actions you can take to protect your Internet connected computer system:

Install an Internet Browser add-on such as McAfee SiteAdvisor, which provides detailed test results on a site’s safety; protecting you from security threats including spyware, adware, spam, viruses, browser exploits, and online scams.

Don’t open unknown email attachments

Don’t run programs of unknown origin

Disable hidden filename extensions

Keep all applications (including your operating system) patched

Turn off your computer or disconnect from the network when not in use

Disable Java, JavaScript, and ActiveX if possible

Disable scripting features in email programs

Make regular backups of critical data

Make a boot disk in case your computer is damaged or compromised

Turn off file and printer sharing on the computer.

Install a personal firewall on the computer.

Install anti-virus and anti-spyware software and ensure it is configured to automatically update when you are connected to the Internet.

Ensure the anti-virus software scans all e-mail attachments.

For more information on the current unstable nature of the Internet, checkout “A Vast Criminal Enterprise Aimed At You – Five Defensive Strategies“, on fellow Blogger TechPaul’s site.

6 Comments

Filed under Browser add-ons, Don't Get Hacked, Firefox Add-ons, Interconnectivity, Internet Safety, Online Safety, Personal Perspective, Phishing, Rogue Software, Viruses, Windows Tips and Tools, worms

6 responses to “The Internet – A Living Breathing Minefield!

  1. There are very powerful influences who WANT the average person to be blissfully ignorant.

    Consumer Confidence, etc.

    Yes. It’s broken. What kind of event will it take to “wake” people up?

    • Bill Mullins

      Paul,

      Human nature being what it is, I don’t expect to see any improvement in conditions on the Internet in the short term.

      Earth shattering events generally have no impact, at least in my experience, on peoples’ behavior, unless an individual can draw a straight line back to themselves from the event. A tropical Typhoon in the Sea of Japan is just news to someone living in Louisiana, but Hurricane Katrina changed the behavior of the residents of New Orleans likely forever. Hurricane Katrina was not just news to these people – it was a personal event. Direct impact will force behavior changes.

      So, unless we have a cataclysmic seismic event on the Internet, that directly impacts large numbers of people, we can expect to see little, or no improvement, in current Internet conditions.

      Bill

  2. Pingback: The Internet – A Living Breathing Minefield! « Bill Mullins … | Digital Journal

  3. The under-reporting reminds me of how most ‘white collar’ crime goes un- or under-reported. Especially over the last 20 years, there have been far more up-beat success stories from the field of investment and finance than stories about fraud, etc. Of course, we all know where that ended up. 🙂

    • Bill Mullins

      Thanks Wendell,

      Indeed, we do know where that ended up. I used to be cautiously optimistic that we might see some positive changes to the Internet. Now, I’m simply discouraged.

      Glad to hear from you – trust all is well on the east coast.

      Bill

  4. Pingback: Online – Dangers | Thievery | A New Chrome « Tech–for Everyone