Internet and the computer has become an essential part of our lives and both makes our lives much easier but not without a price to pay; the threat from the Cyberspace. Over the past ten years criminals have been moving from stealing physical goods to stealing important personal information, this includes important personal information such as credit card details. In modern times this is equivalent to mugging. Cyber crimes that are previously unheard of are emerging and the crimes that were already there are increasing by staggering numbers. The main reason is the increase in the use of Cyberspace.A rising trend in Cyber crime is the use of social networks by the crooks. A 2012 study by Symantec has revealed that
But even with all these scams and profile hacks only 49% use their privacy settings to control what they share, and with whom.
The cloud based services provide attackers with a lucrative target where millions of account details are stored in Cyberspace. Cyber criminals may also use the cloud to spread their malware using stolen user accounts. We should also note that cloud based services are accessed through non cloud based device and if the intruder manages to hack into one of these mobile devices that are not very well secured like traditional end point devices he will be able to get into the information where ever it is stored.
Moreover as we are increasingly connected by social networks, even in Sri Lanka social networks are increasingly used to manipulate masses. This is a trend we have seen emerging recently. The recent social network verbal attacks between communities maybe a starting point to a critical situation between communities.
The threat faced by websites from hackers is also a major concern. Hackers target high profile websites and publish information from their databases online. Recently this has happened to several high profile web sites in Sri Lanka as well. Online banking is also targeted by Cyber-criminals. Banks are hit by Distributed Denial-of-Service (DDoS) attacks that bring down online banking websites and disrupt online banking services. Cyber criminals use Automatic Transfer Systems(ATS) today not only to pass stolen information from users accounts but also ATSs enable Cyber criminals to instantly carry out financial transactions that could wipe out users’ bank accounts without their knowledge.
Today the changes in the IT infrastructure and usage models including virtualization, cloud computing and mobility has dissolved the security boundaries and has created a profitable target rich environment for Cyber criminals. Among these threats APT is known to be mostly state sponsored, targeted, long term persistent attacks. These targeted attacks use a wide variety of techniques, such as drive-by downloads, phishing, SQL injection, malware, spyware, and spam. The attack has four phases; incursion, discovery, capture, and exfiltration.
An example for APT is the Stuxnet worm. This Malware spreads through networks and removable drives and exploits three Windows vulnerabilities. After infecting a system it connects to two URLs to send and receive commands from a malicious user. The virus targets specific SCADA (Supervisory Control And Data Acquisition) system. A SCADA system is an interface between digital and physical worlds thats is used in critical infrastructure such as power stations. These controllers enable the once manual work such as opening valves in pipelines to monitoring traffic signals to be carried out automatically by a master controller.
A good example for attack on a SCADA controller is the attack on Iran’s Natanz nuclear facility. The worm (Stuxnet) was targeting specific SCADA systems doing a specific job. The attack delayed the Iran’s nuclear work by around two years and there appears to be possible loss of life.
Today there are even search engines that enable a user to search for vulnerable controller systems which shows that there is an increasing interest among the hacker/hacktivist community in these systems.
Today the Cyber criminal is not the normal teenager who experiments with code and IT infrastructure but these criminals are organized, persistent and is after huge sums of money or damaging enemy economies, they engage in Cyber warfare they are also skilled enough to commit the crime run away and never get caught. In-order to counter these threats as a end user patch your computer regularly, keep your virus guard up to date and follow procedures mentioned on TechCERT web site. If you are a large or a medium scale Company request help from information security experts to look for vulnerabilities in your Infrastructure. Most of all be informed of the imminent threat that you, your family or your company faces as what we thought about Cyberspace in 10 years from now is already happening and it is not a Sci-Fi movie. An example for APT is the Stuxnet worm. This Malware spreads through networks and removable drives and exploits three Windows vulnerabilities. After infecting a system it connects to two URLs to send and receive commands from a malicious user. The virus targets specific SCADA (Supervisory Control And Data Acquisition) system. A SCADA system is an interface between digital and physical worlds thats is used in critical infrastructure such as power stations. These controllers enable the once manual work such as opening valves in pipelines to monitoring traffic signals to be carried out automatically by a master controller.
A good example for attack on a SCADA controller is the attack on Iran’s Natanz nuclear facility. The worm (Stuxnet) was targeting specific SCADA systems doing a specific job. The attack delayed the Iran’s nuclear work by around two years and there appears to be possible loss of life.
Today there are even search engines that enable a user to search for vulnerable controller systems which shows that there is an increasing interest among the hacker/hacktivist community in these systems.
Today the Cyber criminal is not the normal teenager who experiments with code and IT infrastructure but these criminals are organized, persistent and are after huge sums of money or damaging enemy economies, they engage in Cyber warfare they are also skilled enough to commit the crime run away and never get caught. In-order to counter these threats as a end user patch your computer regularly, keep your virus guard up to date and follow procedures mentioned on TechCERT web site. If you are a large or a medium scale Company request help from information security experts to look for vulnerabilities in your Infrastructure. Most of all be informed of the imminent threat that you, your family or your company faces as what we thought about Cyberspace in 10 years from now is already happening and it is not a Sci-Fi movie.
BACK TO RESOURCES & PUBLICATIONS
