Let's now set aside the issue of online privacy I hope that I've managed to convince you that there's
a lot of information available on the Internet that should be treated as confidential.
There's a new approach towards privacy that has emerged recently and this approach directly affects
the shape of our security and the security of our systems.
Cyber criminals
of refrained from using the word hacker in this course.
It's been so overused that ceased to mean anything
cyber criminals should be defined by two characteristics.
Their motivation and their skills.
Where do hackers fit in this graph.
With equal probability a hacker could be a script kid an unskilled individual who scans a computer and
launches a pre-made exploit out of curiosity.
Or an expert who wants to make money.
The read portion of the market is growing the fastest and it's the most dangerous.
You need to gird yourself against these criminals.
Let's find out if this is really true.
I'll give you a couple of real stories in chronological order.
The first is a story of a gentleman known as Bhola a criminal working in the 90s who set up a Web site
that offered credit card numbers for sale at a good price.
At its peak the Web site had a selection of one hundred fifty four thousand stolen credit card details
the credit card numbers were stolen from large international corporations.
How is this possible.
Well when his partners did not use any exploits for their attacks
they instead struck a deal with Marriott Hotels porters and other people.
Or sent one of their men to take a job in a company when it searched for a skilled worker.
A simple and efficient method was eventually arrested in Cyprus and extradited to the U.S..
He was charged with defrauding over $2.5 billion.
It was revealed during the investigation that he was also engaged in a Cyprus based money laundering
company that washed billions
there's a happy ending in the story.
Bo and his partners Igor and the totally terrorist Sinko and others were arrested.
What's relevant for us is that their fraud did not involve electronic intrusions into computer systems.
This is why it brought such great results.
If we want to paint a fuller picture of cyber criminals we need to mention the attack that hit Blue
security in 2005
loose security announced the release of a new product and anti-spam filter this filter was not like
any of the anti-spam filters we use today.
It didn't block spam.
The tool instead detected the spammers address and sent back a complaint thanks.
I don't want to receive spam from you.
The system utilized a retaliation mechanism
a server that sent a lot of spam messages received a lot of answers.
It was successfully attacked and the attack resulted in a denial of service.
The story of Blue Security is quite interesting.
You can see here a message that was e-mailed to users of the tool that blue security provided.
It was written and sent by pharma master a Russian online seller of fake Viagra.
As you see pharma master obtained e-mail addresses of blue security users
the attackers broke into the blue security system and extracted a database with user's addresses.
In the message form a master warns users that blue security is the real spammer.
To give more weight to the email from a master.
Also send it to blue security
sending spam to spammers in this way it was large scale as a Blue Security user.
You're in for a backlash from furious internet communities.
If you don't get rid of the tool your address will be put on the spamming list.
There can be other trouble as well.
As you see reading the email uninstalling the system won't be for your benefit don't install it ever
again.
Apart from attacking blue security users the servers of the company were also targeted.
The first step was to block foreign access to the Israeli company's servers next to global access was
cut off transporting services to servers of an external provider that specialized in guarding against
denial of service attacks did not help the attackers one this time Blue Security withdrew the blue frog
project and fold it soon after
the release the official statement the company said that it did not want to escalate the war.
The stories of Roman Bo Veiga and the attack on Blue Security show that cyber criminals aren't just
bored script kids who try to launch some program they found on the Internet after school.