Reply to Message

RE: The current state of the crimeware threat - Q&A

wizoddg 2nd Feb 2011

Criminals, like any other organism or organization, follow resources--usually money because it is most easily converted and moved.

The ability and proficiancy levels of criminals mirror the society--smart ones will eventually become more proficient at targeting.

But because the effort involved in attacks is minuscule (and uses stolen resources) there isn't the drive to specialize and target that physical crime requires.

Thus the specialization will proceed more slowly than in physical crimes where the resource devotion is much higher.

Stupid criminals do a poor job of targeting. This is why we still have bank hold-ups, despite the fact that the proceeds are low (~98% failure rate.)

But if the opportunity cost (work required and risk) of stealing a few pennies is equal the cost of stealing millions, and that cost is minuscule, there is little reason to be specific in targeting.

Online crime to date has a high return low risk profile.

Haven't seen it yet, but I expect to see financial raids which remove only pennies from a randomly selected set of accounts--such thefts would be much lower profile, and given the financial industry's huge need for faith in their systems, would be likely to be covered up and absorbed by the institutions.

I also haven't seen a lot of physical theft by computer, though redirecting shipments could easily permit the theft of massive amounts of material. Such redirections could be presold and would effectively act as a drop shipment.

Since such attacks could be written to create the modified data only on the bill of lading,which keeping the original system thinking that the shipment went as ordered, such thefts would be undiscovered until they failed to reach their proper destination.

Given the high rewards of being a black hat vs.the treatment and pay of talented programmers, the wonder is that more of us haven't gone over to the Dark Side.

Of course, automation has brought us to the point where actual knowledge is not required--it can be purchased or stolen pre-programmed. So even stupid people can commit major online crimes.