kw: book reviews, nonfiction, internet, cybercriminals
You may know the old saw: Speak of the devil and he may appear. This is particularly true in cyberspace. The most accomplished hackers, being fond of their reputations, have software agents on the lookout for their names to pop up. Preferring to remain below their radar, I'll leave names out of this review. Interestingly, the author of DarkMarket: Cyberthieves, Cybercops and You, Misha Glenny, names nineteen assorted online criminals, refers to at least sixteen others only by their handle, because he doesn't know their names, and has tentatively determined that two much-revered handles actually belong to consortia.
I came to the book looking for guidance; the and You in the title hinted at personal relevancy. There was none. Perhaps none is possible! On the World Wide Web, it is simply best to keep your wits about you, because it is certain that someone out there is hoping to gain the information needed to plunder your bank account. If you happen to be privy to your company's secrets, there is also someone out there hoping to get access to that. So we see two of the three major arms of online criminality: credit card and bank fraud, and industrial espionage.
The third arm is cyberwarfare. You and I may not be directly engaged in warfare, ever, yet still may suffer its effects: Typically it is carried out via denial-of-service attacks aimed at shutting down a country's or company's online presence. If you do business there, you may find yourself locked out for a time, and perhaps your data will be lost or looted.
The focus of the book is credit fraud, and a major sting carried out by the US FBI, through a web site called DarkMarket. It was a forum for people to "discuss" card fraud, and thus served as a meeting place. Deals were made elsewhere, as the stated aim of the site was to stay (barely) legal. The site was administered mostly by criminals, plus one or two federal agents, unbeknownst to the others. After almost a five-year run, DarkMarket came to an end three years ago.
Carding has several aspects. One is skimming. A small device is added to an ATM, and it reads the magnetic stripe on your ATM card when you swipe it or slip it in. Some have an attachment that reads your PIN as you enter it. The skimmer's "owner" sells the data to someone else, who may use it to clone cards and either raid the card owners' accounts directly, or hire someone else to do so (by visiting ATM after ATM). What is our defense? Get to know how the ATM's you usually use are supposed to look. Be suspicious with a new machine. Most of all, when entering your PIN, hold the other hand above the typing hand, so a nearby camera can't read your fingers. Also keep a sharp eye on a store or restaurant clerk to whom you hand your credit card. Make sure they don't slip the card out of your sight for a moment, to run it through a skimmer under the counter.
Another aspect is stealing a copy of a company's credit card verification database. While this may be done by hacking in, it is usually easier to use phishing, or social engineering. This points up the salient fact about internet security: people are the weak link. Recent incidents of the theft of millions of credit card verification data were cases of someone getting access to a computer with the help, knowing or unknowing, of an insider.
The main substance of the book is a running biography of about three dozen criminals and a number police and government agents around the world. Internet crime is not confined to America, nor to the English speaking world. In fact, some of the biggest players are in Russia, the Ukraine, Turkey, and China. The author singles out Odessa, Ukraine, as a major focus of online criminal activity. But it is simply first (or near first) among many. An innocent-seeming e-mail containing some kind of phishing or malware attack may seem to originate from Toronto, for example, but an expert "cracker tracker" may track it via a random African nation or two, to Singapore, and there find that the origin is still further on, but too obscured to track further.
Near the end, the author discusses what we ought to do with an arrested hacker. He is not discussing the organized criminals—who may employ a hacker for technical skills—, but those who program for the fun of it and for reputation, having little interest in getting money. A few of those currently behind bars are acknowledged as the best technical minds there are. He thinks it a shame to waste their talent. He may have a point, but the practice some have of hiring a hacker as a security agent smacks of putting the hen house in charge of the fox. A brilliant hacker may be useful, but employing one can only be done safely if he (you can count the females on your thumbs) is supervised by someone of equal talent.
The current state of the internet is much like the wild west. A few criminals have been incarcerated, and a few areas have a sheriff watching over things, but almost anything can be got away with, given some planning. I've been told that services such as LifeLock are unhelpful, but I am not sure. At the very least, keeping tabs on your credit report is a must. Employing LifeLock is probably best for those with something worth losing, like a big IRA.
Even though the book didn't have quite what I hoped to find, it is a fascinating read. The author obtained access to several incarcerated criminals and hackers, and to police and agents from a number of agencies. His acknowledgements indicate he taped 200 hours of interviews. That is about par for a history book this size. The hard work was not in gathering information, but in cross checking it, both because various people have various views, and because some just lied. Glenny has done an admirable job ferreting out a coherent picture that is as accurate as we are ever likely to have.
Showing posts with label cybercriminals. Show all posts
Showing posts with label cybercriminals. Show all posts
Thursday, April 05, 2012
Sunday, January 29, 2012
Cybercriminal to the rescue?
kw: book reviews, nonfiction, memoirs, autobiographies, computers, cybercriminals
I used to live in a working-class neighborhood, and soon found out that my next door neighbor's children were all criminals. The parents were good and hard-working people, but their kids had all gone astray. One of their sons in particular was clearly a psychopath. He thought nothing of anyone's property, only of what might benefit him. He was also, you might say, the master of the short cut. This was evident in the way he got from place to place. If he was going to the street corner, once he left the door to the house, he went in an absolutely straight line, right across the front yards of about six homes. He was a very small-time criminal, really. Nothing so blatant as robbery, for example; his stock in trade was the sob story intended to elicit a "loan" that would never be repaid, and a little sneak thievery.
Many computer system hackers are primarily trespassers. They don't profit from their exploits, at least not in any monetary way. They do it for fun, or for bragging rights. Others are out for the cash, and modern "identity thieves" (to call fraud by another name) hone their computer skills purely for the money in it. As it happens, the most skilled hackers and crackers fall into the trespasser category; not being distracted by the money, they focus on developing their skills and building up their library of code used for compromising computer systems.
Kevin Mitnick is of this latter sort. In his most recent book, Ghost in the Wires: My Adventures as the World's Most Wanted Hacker, written with William L. Simon, Mitnick claims frequently that he never obtained money by hacking. He was in it for the thrill of going where he wasn't supposed to go. Breaking into a computer system is quite a bit safer than physically breaking into, say, an office building or bank or military base. However, he did do a little B+E when it was the only way to get information he needed.
This is a case of a man's hobby becoming quite an expensive proposition. Mitnick took low-paying jobs to get access to computer systems, which he would compromise in ways that helped him get access to other systems over the telephone network. All this was in the days before the wideband Internet connections that so many of us have. Early days, he was limited to phone modems that ran at 300 to 1200 bits per second, and later at speeds to 9,600 bps. Connections from computer to computer were sometimes trunk lines that ran at 1,560,000 bps (called T1), and access to such a level of communication was a precious resource.
He started out "phone phreaking", primarily social engineering (deceiving phone company employees), to get levels of access that would permit him to use long distance at no charge. Later he was able to get free cell phone service, at a time the typical charge was a dollar per minute. Now, right there it is clear that, while he may not have had cash pass through his hands, he defrauded the telephone companies out of thousands of dollars by cheating to get free services. So his "no money" claim is rather hollow. In fact, his heavy use of cell phones in the dollar-per-minute days almost got him caught when fellow employees wondered how he could afford to call so much on a $28,000 salary.
After entertaining the reader with a racy history of his growth as a phone phreaker, and his eventual ability to pretty much take over the operations of at least one telephone company, he turns to the efforts of law enforcement to stop him. He was first jailed at the age of seventeen, but avoided spending time at "Juvie". Instead he had a supervised release program, which ran a few years, under which he was supposed to avoid computer use. He just used other people's computers. From this point, he soon became a fugitive, living under several assumed names.
Part of the reason he did not get into deeper trouble when he was young was that there were few laws prohibiting what he was doing. Once the Federal and State legislatures took care of that little detail, the FBI got involved. He was on the run from the FBI for several years. Once he was finally caught (if I recall right, he was by then 31), he spent nearly five years in various lockups. Most of that time was occupied with various arraignments and legal maneuverings. Once he was finally offered a plea deal he was willing to take, he was sentenced to little more than time served.
It has been said of this book that it reads like a Raymond Chandler thriller. I reckon so; it was designed that way by the co-author. It is, at least, easy to read, a page-turner. It opens a window on an unusual mind. We find a person compelled to find a way around restrictions, a person without conscience; if he refrained from profiting monetarily, it was mainly because he lacks the gene for love of money. Money isn't the only thing a thief can steal. By committing theft of services, stealing source code files so he could better break into systems, and taunting system administrators, he stole peace of mind, he caused large sums to be spent tracking him down, and he cut into the income of a few large companies just as effectively as if he'd robbed the pay clerks at gunpoint.
So what is he doing these days? Still hacking, but with permission. He has become a security consultant! On the theory that "it takes a thief to catch a thief" (the theme of a briefly popular TV show some forty years ago), he is paid handsome sums to commit "white hat" hacking. If he is still one of the best—which boils down to, if he is keeping his skills up to date—then if a system is made "Mitnick proof", it is probably pretty secure.
The biggest lesson of the book is that the weakest link in computer security is the human element. People are too trusting. Mitnick's "career" was based on harvesting low-hanging fruit. A couple of phone calls would often garner him access to a supposedly bullet-proof system. There is still a lot of low-hanging fruit out there! You just gotta hope that none of it can be found at your bank or broker's office.
Periodically at work, some of us get strange e-mails, usually directing us to do something very slightly shady; these are "Phishing" e-mails. It has been publicized that there is a place we are supposed to forward suspicious e-mails. Those who do so are praised; those who follow the Phishing directions are reprimanded. It is one facet of a white-hat-hacking program my company has, to see how much low-hanging "social engineering" fruit there is. The answer is distressingly large. Even where paranoia is justified, not all are sufficiently paranoid. This keeps Mitnick, and security consultants in general, and in business.
I used to live in a working-class neighborhood, and soon found out that my next door neighbor's children were all criminals. The parents were good and hard-working people, but their kids had all gone astray. One of their sons in particular was clearly a psychopath. He thought nothing of anyone's property, only of what might benefit him. He was also, you might say, the master of the short cut. This was evident in the way he got from place to place. If he was going to the street corner, once he left the door to the house, he went in an absolutely straight line, right across the front yards of about six homes. He was a very small-time criminal, really. Nothing so blatant as robbery, for example; his stock in trade was the sob story intended to elicit a "loan" that would never be repaid, and a little sneak thievery.
Many computer system hackers are primarily trespassers. They don't profit from their exploits, at least not in any monetary way. They do it for fun, or for bragging rights. Others are out for the cash, and modern "identity thieves" (to call fraud by another name) hone their computer skills purely for the money in it. As it happens, the most skilled hackers and crackers fall into the trespasser category; not being distracted by the money, they focus on developing their skills and building up their library of code used for compromising computer systems.
Kevin Mitnick is of this latter sort. In his most recent book, Ghost in the Wires: My Adventures as the World's Most Wanted Hacker, written with William L. Simon, Mitnick claims frequently that he never obtained money by hacking. He was in it for the thrill of going where he wasn't supposed to go. Breaking into a computer system is quite a bit safer than physically breaking into, say, an office building or bank or military base. However, he did do a little B+E when it was the only way to get information he needed.
This is a case of a man's hobby becoming quite an expensive proposition. Mitnick took low-paying jobs to get access to computer systems, which he would compromise in ways that helped him get access to other systems over the telephone network. All this was in the days before the wideband Internet connections that so many of us have. Early days, he was limited to phone modems that ran at 300 to 1200 bits per second, and later at speeds to 9,600 bps. Connections from computer to computer were sometimes trunk lines that ran at 1,560,000 bps (called T1), and access to such a level of communication was a precious resource.
He started out "phone phreaking", primarily social engineering (deceiving phone company employees), to get levels of access that would permit him to use long distance at no charge. Later he was able to get free cell phone service, at a time the typical charge was a dollar per minute. Now, right there it is clear that, while he may not have had cash pass through his hands, he defrauded the telephone companies out of thousands of dollars by cheating to get free services. So his "no money" claim is rather hollow. In fact, his heavy use of cell phones in the dollar-per-minute days almost got him caught when fellow employees wondered how he could afford to call so much on a $28,000 salary.
After entertaining the reader with a racy history of his growth as a phone phreaker, and his eventual ability to pretty much take over the operations of at least one telephone company, he turns to the efforts of law enforcement to stop him. He was first jailed at the age of seventeen, but avoided spending time at "Juvie". Instead he had a supervised release program, which ran a few years, under which he was supposed to avoid computer use. He just used other people's computers. From this point, he soon became a fugitive, living under several assumed names.
Part of the reason he did not get into deeper trouble when he was young was that there were few laws prohibiting what he was doing. Once the Federal and State legislatures took care of that little detail, the FBI got involved. He was on the run from the FBI for several years. Once he was finally caught (if I recall right, he was by then 31), he spent nearly five years in various lockups. Most of that time was occupied with various arraignments and legal maneuverings. Once he was finally offered a plea deal he was willing to take, he was sentenced to little more than time served.
It has been said of this book that it reads like a Raymond Chandler thriller. I reckon so; it was designed that way by the co-author. It is, at least, easy to read, a page-turner. It opens a window on an unusual mind. We find a person compelled to find a way around restrictions, a person without conscience; if he refrained from profiting monetarily, it was mainly because he lacks the gene for love of money. Money isn't the only thing a thief can steal. By committing theft of services, stealing source code files so he could better break into systems, and taunting system administrators, he stole peace of mind, he caused large sums to be spent tracking him down, and he cut into the income of a few large companies just as effectively as if he'd robbed the pay clerks at gunpoint.
So what is he doing these days? Still hacking, but with permission. He has become a security consultant! On the theory that "it takes a thief to catch a thief" (the theme of a briefly popular TV show some forty years ago), he is paid handsome sums to commit "white hat" hacking. If he is still one of the best—which boils down to, if he is keeping his skills up to date—then if a system is made "Mitnick proof", it is probably pretty secure.
The biggest lesson of the book is that the weakest link in computer security is the human element. People are too trusting. Mitnick's "career" was based on harvesting low-hanging fruit. A couple of phone calls would often garner him access to a supposedly bullet-proof system. There is still a lot of low-hanging fruit out there! You just gotta hope that none of it can be found at your bank or broker's office.
Periodically at work, some of us get strange e-mails, usually directing us to do something very slightly shady; these are "Phishing" e-mails. It has been publicized that there is a place we are supposed to forward suspicious e-mails. Those who do so are praised; those who follow the Phishing directions are reprimanded. It is one facet of a white-hat-hacking program my company has, to see how much low-hanging "social engineering" fruit there is. The answer is distressingly large. Even where paranoia is justified, not all are sufficiently paranoid. This keeps Mitnick, and security consultants in general, and in business.
Subscribe to:
Posts (Atom)
Posts
