The rise of the identity theft

A study from the research firm Gartner suggested that there is a sharp increase of identity theft related incidents since 2003.

Facts:

• 15 millions Americans were identity theft victims in mid 2005 - mid2006.
• The average loss of a case of identity theft was US$ 3,257 (2006) and US$ 1,408 (2005).
• Only 61% of the loss fund was recovered in 2006.

Means of identity thefts:

• Internet auctions
• Non-regulated money transmittal systems
• Impersonate lottery contests
• Others.

Read more from here.

Unauthorised tapping into home WIFI - Teenager is facing a jail term

Imagine tapping into the other's home wireless network (WiFi) connection using your laptop to access Internet. You may end up in the jail.

A Singaporean teenager is the first person to be charged in Singapore under the new law - Computer Misuse Act - for tapping to gain unauthorise access) into other's home WiFi. The affected neighbour has made a police report on the incident against him.

If convicted, he can go to the jail up to 3 years and fined up to S$10,000. This is indeed very expensive as compare to applying and install your own Internet access.

For more reading, refer to TheStar (12th November 2006) and NST (12th November 2006)

Question:
Who's responsibility to secure the home WIFI systems? Owner or Service Provider?

Online Brokerage Fraud - Millions of dollars loss

2 largest e-brokerage companies in US, namely E-Trade Financial and Ameritrade, reported on a shocking online brokerage fraud through computer criminal hacking which caused millions of dollars losses.

Some of the interesting facts:

• Estimated losses are $4 and $18 million for Ameritrade and E-Trade Financial respectively.
• Much of the fraud occurred overseas while clients were using public computers infected with spyware or wireless connections. User IDs and passwords were stolen.
• Fraud committed against E-Trade customers appeared to be concentrated in Thailand and eastern Europe
• Hackers are increasingly turning their attention to financial services firms.
• Identity theft

Read more here from www.ecommercetimes.com 25th Oct 2006.

Internet Security Threats - Its Changing Faces (Part 2)

This is the part 2 of the Internet Security article from www.ecommercetimes.com

Among the facts:
New Threats:

• New malicious programs increased by 8% with more Trojan applications aims to steal information and e-login.
• The use of rootkit malware that allow a person to hide their malicious activities and programs is also in the rise.
• Another threat is holding data hostage - a program used to modify data on a victim machine and then blackmail the user.

Preventions:

• The need for fast, efficient and unobtrusive protection has led some security systems developers to become managed security service providers (MSSPs) which has broader security management services besides delivering patches and system updates.
• Services are such as internal and external scanning for vulnerabilities; threat intelligence to identify emerging exploits; richer correlation of asset data with vulnerabilities, threats and attacks; and blocking or shielding capabilities to stop attacks

Read more on this article - The Changing Faces of Internet Security Threats, Part 2

Previous entry on Part 1 is available here.

Internet Security Threats - Its Changing Faces

An interesting article on the changing faces of the Internet Security Threats - Lecture 4 (E-Commerce Security)

Among the facts are:

• Analysts estimate roughly 75 percent of all security attacks are targeted at applications.
• However, only 10 percent of enterprise security spend is focused on application security. (This show the potential attacks to be encountered by the entreprises)
• Demand for third-party security management services, as well as for systematic security risk-profiling and management solutions, continues to grow
• The need to protect applications and data resources more proactively is also driving the development and application of heuristics -- that is, empirical, judgment-based rules for intrusion detection and prevention -- and other forms of artificial intelligence in security products and services.

You can read more from this article - The Changing Faces of the Internet Security Threats (ecommercetimes.com)


Coming Soon:
Part 2: Evolving Threats and the Rise of Managed Security Service Providers

Internet Banking scam in Malaysia: 13 youth nabbed

There are multiple news reports available in TheStar, NST and TheSun on this story today.

This is related to e-commerce security and crime - Lecture 4.

Key points from these stories:

• Phishing
• 26 people were conned with RM36,000 from a single bank.
• 13 suspects, between 18 and 25, have been described as computer experts with several hackers among them.
• Four of the suspects were college and university students.

For more reading, this is from NST:

A group of computer-savvy youth was nabbed recently after scoring a first of sorts for phishing.

Phishing uses email and fake websites to lure Internet users into providing their personal banking details, which are then used to steal from their accounts.

This group of 13 is believed to have conned at least 26 people by using their particulars to steal more than RM36,000 from their accounts in two weeks.

All 26 victims had accounts in one particular local bank and it was the bank that notified police of the fraudulent transfers.

Following the report, police monitored several homes and cybercafes in three states.

After two weeks of checks, they nabbed 13 suspects, including a woman, in Kelantan, Selangor and here.

The suspects, between 18 and 25, have been described as computer experts with several hackers among them.

Commercial Crime Department assistant director ACP Ismail Yatim said four of the suspects were college and university students.

"The 13 are skilled in different areas and they joined forces to steal confidential data from unsuspecting victims.

"The losses reported may have been bigger if the bank had not been alert in detecting the fraudulent transfers."

Police believe this may only be the tip of the iceberg as more reports were expected.

It was learnt that several of the suspects had the ability to hack into the computer systems of leading firms in the city. Checks revealed that the group used a foreign server and police were trying to ascertain if they had international connections.

The group preyed on those who used Internet banking, sending account holders emails asking them to update their accounts.

In that same email, links would be available for the victims to click on and a new web page would open revealing a web site similar to the bank’s internet login site.

The unsuspecting victims would login, unknowingly giving their usernames and passwords, which would be sent to a decoy website set up by the group.

Using the confidential information, the group would access the victims’ accounts and transfer funds to another account before it is withdrawn.

"We believe there are still groups out there actively involved in such scams," Ismail said.

He urged account holders to check with their banks upon receiving notifications to update their accounts.

Meanwhile, four people were cheated by a group, which sent them text messages claiming they had won cash prizes and obtained their bank account details.

They then made online withdrawals totalling RM7,000.

The group had imitated a similar group of scam artists, who had cheated 36 fans of the reality show Akademi Fantasia.

The victims were told to call a phone number and asked to reveal their Internet banking account details, including their pin number, on the pretext of depositing their winnings.

The victims’ accounts were then cleaned out.

Police have so far received four reports — three from Kuala Lumpur and another from Sabah.

Organisations Not Doing Enough to Secure Data

A new survey shows that organisations are not doing enough to prevent IT data breaches and the loss of "sensitive" data.

The survey is based on interviews with 359 executives responsible for security, compliance, risk management and legal issues at large organisations in North America.

Facts highlighted:

• A total of 94 percent of respondents reported having no visibility into how many e-mail messages containing confidential or private information were leaving their organization each month or believed that some leaks were occurring.
• Only 6 percent reported no information leaks.
• A total of 80 percent of participants reported having information leaks -- through e-mail or other electronic channels such as Blackberrys or HTTP links -- or admitted to no visibility to leaks that occurred within their organization last year.
• About 17 percent were afraid to know how many leaks they had.

It is not just small companies who are laggards with security measures. The world's biggest employer, the U.S. government, has performed poorly in this area of content security.

Click here for more reading.

Spamming list - US at the top

According to the most recent "Dirty Dozen" report from security firm Sophos, the United States is the nation that leads the world in terms of how much spam passes through its e-mail networks.

Some interesting facts:
1. United States - 23.2% of world spamming.
2. China - 20%
3. South Korea - 7.5%

• While the United States accounts for the highest spam output as a country, together China, Hong Kong, South Korea, Japan and Taiwan account for almost half of the worldwide spam output, making Asia the top offending continent with 40.2 percent of all spam.
• Europe surpassed third-place North America, rising to the second position among continents, with a marked rise from the first quarter of 2006 due to increased zombie activity.
• South America ranked fourth with 5.5 percent while Australia and Africa tied for fifth with 0.7 percent each.

How:
The vast majority of spam is relayed by "zombies," also known as botnet computers, which have been hijacked by Trojan horses, worms and viruses, according to Sophos. Once the hackers take control of infected computers, cyber criminals can use them to blast out spam messages.

Legal implication so far:
Although there have been a few high-profile prosecutions of spammers, the spammers' risk versus reward analysis weighs heavy on the reward side.

More reading on this article.

Celcom to expand its 3G coverage

Celcom is expected to expand its 3G services coverage to cover the whole country by July 15 this year.

Its 3G service currently covers the major urban areas, such as the capital, Shah Alam, Johor Baru, Ipoh, Alor Star, Kota Kinabalu and Kuching. There are 100,000 subscribers to the service now. (It was 45,000 3G subscribers at the end of 2005). Celcom is also targeting to increase its 3G subscribers to 150,000 by year end - an increase of 233%).

To fend off competition, as well as upcoming technology such as WiMAX (Worldwide Interoperability for Microwave Access) - a rival wireless broadband platform - Celcom said it is looking at upgrading its 3G network to HSDPA (High Speed Downlink Packet Access) standard.

It has already started its HSDPA trials and this is scheduled to end late next month.

HSDPA enables much faster data download speeds (at least 4 times faster) on 3G networks than is possible now. What takes minutes to download now will take only seconds with HSDPA, said Celcom. This will be a boon to corporate users who need to send and receive extensive files on their mobile devices faster.

The only catch is that consumers will need to change their 3G phones and PC datacards to enjoy the benefits of HSDPA technology.

Celcom has selected six Klang Valley sites for its HSDPA trials - Suria KLCC, Mid Valley, Berjaya Times Square, Bangsar and, within Menara Celcom and Menara TM.

Source: TheStar InTech, (20 June 2006, page IT27)

Spammer Agrees to $10 Million Settlement

Ryan Pitylak, 24, one of the world's most notorious spammers and a recent University of Texas graduate, has admitted sending 25 million e-mails every day at the height of his spamming operation in 2004. At one time, Pitylak was listed as the fourth-worst spammer in the world.

How he earned using spamming:
Pitylak's e-mails touted low-cost mortgages, extended auto warranties and debt-counseling services, among other offers, and he received $3 to $7 for every lead he generated when someone clicked on the links in his messages.

Turning a new leaf
Pitylak says he now opposes spam and is offering his skills to Internet companies to help them fight spam.

More reading is available here.

Mass Defacement of Website in Malaysia

An article from The Star InTech which is related to online threats towards e-commerce and website (Lecture 4)

PETALING JAYA: The Malaysian Computer Emergency Response Team (MyCERT) has detected 300 website defacements up till the end of May this year.

MyCERT said it observed a mass defacement of .my domain websites in early May affecting mostly those on the FreeBSD and Linux platforms.

However, Kol Husin Jazri, director of the National ICT Security and Emergency Response Team (Niser), said in an e-mail interview that the attacks weren’t platform specific but were targeted at virtual webhosts.

MyCERT is a unit of Niser and is responsible for tracking and logging security incidents, as well as analysing major security incidents and trends.

Virtual hosts are multiple websites hosted on a single machine.

"A few of this virtual hosts were targeted resulting in between 20 to 100 web¬sites being defaced at any one time," Husin said. Intelligence and reconnaissance activities are involved before launching the attacks, Husin said.

Husin said the recent attacks indicates attackers have taken due diligence before executing their strategies. "Intelligence and reconnaissance activities are involved before launching the attacks," he said.

MyCERT's analysis of the recent attacks showed that it was done via PHP scripting vulnerability. (PHP is web scripting language).

Husin said this involves modifying computer program scripts to ensure validation of input.

"These vulnerabilities are exploited to allow entry to access certain restricted locations within the host," Husin said. He added that in some cases, these vulnerability exploits even open up arbitrary Net connections and turn some PHP scripts into proxies and open mail relays.

MyCERT has already pro¬vided an alert on the recent attacks and encourages victims to submit the audit trails to MyCERT through the MyCERT website for further analysis.

Piracy down in China and Russia...plus Malaysia too

Business Software Alliance (BSA) reported that 35% of the packaged software installed on personal computers worldwide in 2005 was illegal.

The Business Software Alliance (BSA) is a trade group representing a number of the world's largest software makers. It is funded through membership dues based on member company's software revenues, and through settlements from companies it successfully brings action against.

Its principal activity is trying to stop copyright infringement of software produced by its members - an activity it claims to cost the software industry over 11 billion dollars each year.

Some facts from the report:

• Losses from the illegal software = US$ 34 billion (2005), an increase of US$ 1.6 billion from 2004.

• The four countries with the biggest percentage declines in piracy were China, where 86 percent of all software sold is pirated, down 4 percentage points from the 90 percent of 2004; Russia, down 4 percentage points to a piracy rate of 83 percent; Ukraine, down 6 percentage points to a piracy rate of 85 percent, and Morocco, down 4 percentage points to a piracy rate of 68 percent.

• By contrast, the United States had the lowest piracy rate in the world last year at 21 percent. However, that amounted to $6.9 billion in losses to software manufacturers, the highest of any country because the U.S. market for computer software is so large.

• The lost sales in China totaled $3.9 billion, putting it in second place in dollar losses followed by France with losses put at $3.2 billion and a 47 percent piracy rate.

• One out of every three copies of PC software were obtained illegally last year.

• The countries with the highest piracy rates, according to the study, were Vietnam, 90 percent; Zimbabwe, 90 percent, Indonesia, 87 percent, and China and Pakistan, both at 86 percent.

• The countries with the lowest piracy rates were the United States, 21 percent; New Zealand, 23 percent; Austria, 26 percent, and Finland, 26 percent.

----------------------------------------

Malaysia:

• 60% of the software installed on PCs in Malaysia in 2005 was illegal.
• The software piracy rate declined by three percentage points in the last two years
• BSA attributed the reduction to the Ops Tulen antipiracy campaign which is held in conjunction with the Domestic Trade and Consumer Affairs Ministry.
• The campaign, which involves raids and software audits, began in 2002 and aims to cut down the use of unlicensed software by Malaysian businesses.
• The BSA said that its software auditing programme was well received by Malaysian companies, with 1,493 businesses performing self-audits to check if their software is genuine.
• Companies that perform the audit are given a grace period of immunity from raids by the BSA and other authorities in order to “clean up their act” if they have pirated software in their offices.
  
• However, despite the small drop in piracy levels, the ringgit value of losses increased from US$134mil (RM509mil) in 2004 to US$149mil (RM566mil).
  

Types Software Piracy

Source: The StarInTech, 30 May 2006, pg 29 - An article being part of the Ops Tulen 2006 antipiracy campaign organised by the Ministry of Domestic Trade and Consumer Affairs.

This article is related to Lecture 4 - E-Commerce Security Systems

Additional link for software piracy: WiseGeek - What is Software Piracy?

Don’t be caught in the piracy trap

This is the second of a six-part weekly series brought to you by the Business Software Alliance. The articles are part of the OpsTulen 2006 antipiracy campaign organised by the Ministry of Domestic Trade and Consumer Affairs.

AS WE have discussed the impact and unravelled the myths of software piracy last week, it is time to look at the different types of software piracy, and how we can differentiate genuine from fake products. While many know that copying and distributing copyrighted software illegally is considered piracy, not many are aware that possessing software that has been illegally copied or using software against its licensing terms is also piracy. There are several types of software piracy:

Casual copying

This is a most common method of piracy, where copies are made of the genuine version and distributed among friends and colleagues in a casual office environment (against the end-user licence terms), and it is also called “softlifting."

Tip: Ensure you keep the genuine software CD-ROM or diskette in a safe locked central location with a single identified person accountable, i.e. the IT or finance manager.

Under-licensing

This happens when one copy of licensed software is purchased and loaded in more than one computer system without proper licensing and monitoring of the number of licences purchased against the number actually installed.

Tip: Ensure you conduct regular software audits (every six months) to ensure the number of licences you have purchased tallies with what has been installed on the computers.

Hard-disk loading

This type of piracy often goes undetected especially when businesses do not check the legitimacy of the application that comes with the purchase of PCs and laptops. It happens when a hardware distributor or reseller installs illegal and/or unlicensed software on to a computer and sells it as a package. Often, this is attractive to buyers as the price is low.

Tip: Ensure you always insist on genuine software pre-installed up front with your purchase and that it comes with the proper licence documentation, i.e. genuine CD-ROM or diskette, manuals, receipt/invoice, end-user license agreement, certificate of authenticity (COA), etc.

Counterfeiting

This happens when pirated software is packaged in a manner that is very similar to the original packaging, thus looking like original. This could easily fool buyers, as counterfeit registration cards with unauthorised serial numbers, boxes and manuals are often a part of these packages.

Tip: Ensure you consult your software principal on how to tell genuine software from the fakes and what licence documentation is required.

Licence misuse

Software vendors often provide various types of licensing, including OEM (original equipment manufacturer), volume licensing, those meant for non-profit organisations and academic institutions, upgrades, etc. Using software against its licensing terms is a form of piracy for example using academic licences in a commercial business or purchasing OEM licences (required to be pre-installed with a new computer system) separately without the new computer system (unless otherwise specified by the licensing terms).

Tip: Ensure you consult the end-user license agreement or the software principal to see what rights you acquired with your software licence type.

Multiplexing

There are many multiplexing devices (pooling, dumb client, thin client = hardware that reduces number of CPUs/ PCs/ input devices) available in the market today that promise the reduction in the number of software licences required. Beware that multiplexing DOES NOT necessarily reduce the number of software licences required.

Tip: Ensure you refer to the specific licensing terms or product usage rights accompanying your software to always be certain.

Renting

This type of piracy works in the same manner as video rental where a licensed copy of software is rented out for temporary use against the licence agreement, or without the owners’ agreement.

Tip: Again, ensure you consult the licensing terms.

Internet piracy

The sharing of illegal and unlicensed copies of software has become easier and more prevalent, as identity over the Internet can be faked easily. Beware of sources selling cheap software online disguised as “on sale” or “OEM version” via what looks to be very professional looking websites or spam e-mail messages.

Online auction is another popular channel for Internet piracy. Unlicensed software could be easily resold over an auction site. In addition, technologies that have emerged to enable easy sharing of files over the Internet such as FTP (File Transfer Protocol) and P2P (Peer-to-Peer), allow faster and easier transfer of pirated software.

FTP allows transferring of large files easily by downloading files to a site. P2P technology allows a community of people to share files. Most people are attracted to the wide range of software resources available for free when they join a P2P community, and they, in turn, contribute by sharing what they have. Often, pirated software is easily available through both FTP and P2P technology users.

Tip: Ensure you purchase your software from reputable and trusted sources only. If the deal seems too good to be true, it probably is.

If you would like to learn more about software piracy and Software Asset Management (SAM) visit www.bsa.org/malaysia. You can also contact the BSA Antipiracy Hotline at 1-800-887-800.

E-Commerce Credit Card Fraud

An interesting case study on e-commerce credit card fraud in US.

According to Celent Communications, an international consultancy group, the United States alone faces US$3.2 billion of online credit card fraud by 2007.

Results from various surveys and reports were discussed such as:

• nine out of ten Americans want their banks to monitor their online accounts for suspicious behavior
• 79 percent surveyed said they were less likely to respond to e-mail from their bank because of worry over phishing scams

Company: US Digital Media
Problem: US Digital Media lost upwards of $200,000 due to e-commerce credit card fraud
Solution: Automated Fraud Prevention

Full story is here.

Another company sued for Internet Privacy

As additional story for Lecture 11, a company in US is currently being sued for selling email addresses.

Source of information: www.cnn.com

Suit alleges Internet privacy breach

Friday, March 24, 2006; Posted: 8:19 a.m. EST (13:19 GMT)
ALBANY, New York (AP) -- New York's attorney general sued an Internet company Thursday over the selling of e-mail addresses in what authorities say may be the biggest deliberate breach of Internet privacy ever.

Attorney General Eliot Spitzer accused Gratis Internet of selling personal information obtained from millions of consumers despite a promise of confidentiality.

The consumers thought they were simply registering to see a Web site offering free iPod music players or DVD movies and video games, Spitzer spokesman Brad Maione said. On sign-up pages, Gratis promised it "does not ... sell/rent e-mails."

Instead of confidentiality, Spitzer said, Gratis sold access to their e-mail information to three independent e-mail marketers, and hundreds of millions of e-mail solicitations followed.

In a statement, Gratis said the allegations that it sold e-mail addresses to e-mail marketers, and that these companies purchased personal user information from Gratis, were "completely untrue."

The company said it hired Datran Media of New York City, a leading e-mail marketer, to manage "the logistics of marketing products and services via e-mail to Gratis' own user base." It said Datran or two other hired companies "at no time ever engaged in a sale or purchase of data."

Gratis, based in Washington, D.C., always controlled and owned the users' information and never profited from any sale of data, the company said.

On March 12, Spitzer sued Datran Media, accusing it of using unauthorized personal data "mined" by other firms from about 6 million e-mail addresses nationwide. Datran agreed to reform its practices under a $1.1 million settlement.

"Unless checked now, companies that collect and sell information on consumers will continue to find ways to erode the basic standards that protect privacy in the Internet age," Spitzer said.

Spitzer's "data mining" investigation began last year amid reports of companies compiling and selling marketing lists.

Gratis owns and operates Web sites that offer free merchandise for registering their e-mail addresses. The state fraud lawsuit accuses its owners, Peter Martin and Robert Jewell, of privacy violations in 2004 and 2005.

Spitzer claims Gratis wrongly shared as many as 7 million "user records," creating the largest deliberate breach of a privacy policy discovered by U.S. law enforcement. He said the company's promises to consumers included: "We will never give out, sell or lend your name or information to anyone," and "We will never lend, sell or give out for any reason your e-mail address or personal information."

Spamming - Found guilty! and pay US$ 1.1 million

If you think of going for spamming, think twice. You may end up paying more........

An e-mail marketing company, Datran Media Corp. has agreed to pay US$1.1 million to settle accusations that it misused personal data reportedly mined from 6 million e-mail addresses across the country.

Datran sends marketing e-mail messages to addresses provided by partner companies, a practice that some people consider "spam."

Its clients include Business Week, Columbia House, Fox Home Entertainment, NASCAR, Orbitz and Pitney Bowes, according to its Web site

Read more here. (www.cnn.com)

How to counter attack web advertising's spyware?

In reference to the Lecture 7, this article may be useful.

Change our online habits.

Cyberspace War

Today, cyberspace is the new war frontier whenver there are conflicts between countries:

• China-Taiwan,
• India-Pakistan,
• United States-China,
• Palestine-Israel,
• Japan-South Korea,
• Japan-China and
• Malaysia-Indonesia.

Read this article entitled: Cyberspace the new war frontier, wrote by two researcher from NISER (National ICT Security and Emergency Response Centre) - hey, didn't we visited their website in this week tutorial - tutorial 4?

Are your credit card safe?

A news report from BBC News website - Up to 40 million of credit cards 'hacked'.

Related to the security on one of the e-payment methods (Lecture 4 & 5) - one of the security concern of credit card where the information database was hacked into or data being stolen.

MasterCard nets 1,400 phishing sites last year

The Star today reported MasterCard International said it has successfully shut down nearly 1,400 global phishing websites – 300 operating from Asia Pacific – last year through its Operation Stop IT (Identity Theft) campaign.

The credit card giant said its success was due to the effective monitoring of phishing activities discovered on the Internet and swift counteraction by Internet service providers (ISPs) and law enforcement agencies.