And sorry, I have no contacts there, nor any inside info to offer.

C.

Like or Dislike: 0  0

Like or Dislike: 0  0

Like or Dislike: 0  0

Like or Dislike: 0  1

Like or Dislike: 1  0

My partners and I have been debating who should be responsible for these attacks. On one hand, you can blame the banks for having poor business processes that do not account for the potential for misuse. On the other hand, you have the organizations themselves who have ignorant users who provide access to banking credentials.

Since I think that the argument can go either way (or both ways, which would be the reality), I think that it would be really interesting if you were to put up a “Wall of Education” page that lists the affected banks and organizations, sorted by dollar value of the attack. It would be interesting to see how many times individual banks start popping up.

Like or Dislike: 2  1

btw I served on a local (regional) school board for a few years, comparable in size to Duanesburg. Our entire IT budget would not have covered my present salary, and that’s probably true for most of the knowledgeable readers on here. It takes time and effort and diligent competence to properly manage and secure systems, that’s why it is so seldom done right. If local governments and schools spend money to get the resources they need to do the job right they get slammed by taxpayers and/or cut back in mission critical areas.

@ TheGeezer, “Parkinson Construction is not in the computer business.” Exactly the problem. It takes so much competence and diligence to properly secure desktop PCs that almost anyone not in the IT business cannot justify the expense to do it right, especially with the need for expertise so outstripping the available supply.

Like or Dislike: 3  0

The registrar’s role is therefore VERY important!
And yes, we can claim to not know how this happened. Was it again a fraudulently registered domain that should have been detected by the registrar? Or was it an employee downloading ‘free’ software? We don’t know how this happened. “not having a clue about operating systems and system security” is not the answer.

Let’s look at the example of the small business in D.C., Parkinson Construction, which fell victim to the Social Security Administration exploit which Brian reported on early december.
http://voices.washingtonpost.com/securityfix/2009/12/who_says_pay-per-click_revenue.html

The Zeus botnet SSA exploit was running in late November using the ccTLD of ‘.be’.
It should have been clear to any registrar that the US Social Security Administration does not register with DNS.be and does not use a fast-flux server. The registrar is in the computer business.
They should be able to see this and respond. Parkinson Construction is not in the computer business.
If this registrar had shown the same responsibility demonstrated by some others, Parkinson Construction would have received a ‘Host Not Found’ error message rather than a trojan.

The personal computer has become a necessary but dangerous appliance for most people and certainly for business.
No one is required to know electronics to be guaranteed safety from electrical shock from their dvd player.
You should not have to be a computer guru to avoid ‘software shock’ from your computer either.

The registrars need to have their focus redirected from bragging about how many domains they’ve registered to how few malevolent domains they’ve registered. They are the ones who should be the computer gurus, not victims like Mr. Parkinson and Duanesburg Central School District.
It doesn’t take much of a computer guru to know that the IRS and SSA are not located in Chili or Argentina.
Let the Registrar be responsible for the research. That would prevent the majority of these incidents.

Like or Dislike: 1  1

However if this is not the case then I agree with you that the USER is the problem and as someone stated before maybe a mandatory web usage IQ test is required to sift out those unfit for internet Banking. Although the Banks would have to agree on this and we all know what their stance is on profit margin related things.

Signed
Anonymous Coward

Like or Dislike: 0  0

A reader sent this to me via e-mail and I thought it was interesting enough that I got permission to excerpt part of it here.

—

I have read your column for many years and have always found you to be factual and on the cutting edge of cyber crime trends. I worked for an online financial services company for more than a decade. I was in their corporate security investigations group. I was the senior manager of investigations from late 2005 until I left and worked directly with law enforcement on the types of cases you have written about so well.

My group investigated all fraud activity perpetrated against it and I can tell you we dealt with the Russian or as we told everyone “Eastern European” groups since 2003. They started small by opening accounts with stolen identities and funding via ACH and experimented with stock pump and dump as early as December 2003. Our firm lost less then a million dollars in 2004 to ACH, wire fraud and pump and dump and a couple of million in 2005, but we fully reimbursed customers because of what it could do to our business if it became public. We had compromised customers sign a general release/non-disclosure form to protect our reputation. We also had these customers send us their hard drives or we performed remote diagnostics and as a result were highly familiar with the viruses and how credentials were being stolen. We referred all of these cases to law enforcement and I worked directly with different FBI and Secret Service agents on many of these cases. We also participated in Secret Service Electronic Crime Task force groups around the country during this time frame of 04/05.

2006 changed the course of history, as my firm lost more money between July and September then we had between 2001-June 2006, when we lost over $10 million. It was a result of pump and dump, as well as wire and ACH fraud. Of course this impacted everyone in the online brokerage business, but we were on the bleeding edge. As you well know, RBN and others learn quickly and they used all of the knowledge and skills they had accumulated over the past several years and they came at us hard and fast. We had founded a working group with NCFTA in Pittsburgh and had quarterly meetings to share all of this information and we also began sharing information directly via email within our working group real time to help combat this activity. It helped to slow it down, but we were never able to stop it.

The “bad guys” continue to evolve and your articles have well documented how this evolution is continuing. They still hit individual accounts at banks and brokerages, but the bigger targets are now small business and local governments.

Keep up the good work and hopefully you can bring more attention to this growing problem.

Well-loved. Like or Dislike: 4  0