Cyber Security Institute

§ Current Worries

Top 3 Worries

  • Regulations
  • Old Firewall Configurations
  • Security Awareness

§ Listening

For the best information

  • The underground
  • Audible
  • Executive Excellence
  • Music (to keep me sane)

§ Watching

For early warnings

  • 150 Security Websites
  • AP Newsfeeds
  • Vendors

Monday, February 27, 2006

Cyberthieves Silently Copy Your Passwords as You Type

Most people who use e-mail now know enough to be on guard against “phishing” messages that pretend to be from a bank or business but are actually attempts to steal passwords and other personal information.  In some countries, like Brazil, it has been eclipsed by an even more virulent form of electronic con—- the use of keylogging programs that silently copy the keystrokes of computer users and send that information to the crooks.  These programs are often hidden inside other software and then infect the machine, putting them in the category of malicious programs known as Trojan horses, or just Trojans.  Two weeks ago, Brazilian federal police descended on the northern city of Campina Grande and several surrounding states, and arrested 55 people—- at least 9 of them minors—- for seeding the computers of unwitting Brazilians with keyloggers that recorded their typing whenever they visited their banks online.The fraud ring stole about $4.7 million from 200 different accounts at six banks since it began operations last May, according to the Brazilian police.  The twist here is that the keylogging programs exploit security flaws and monitor the path that carries data from the keyboard to other parts of the computer.

This is a more invasive approach than phishing, which relies on deception rather than infection, tricking people into giving their information to a fake Web site.

“These Trojans are very selective,” said Cristine Hoepers, general manager of Brazil’s Computer Emergency Response Team, which runs under the auspices of the country’s public-private Internet Steering Committee.

According to data compiled by computer security companies in 2005, the use of “crimeware” like keyloggers to steal user names and passwords—- and ultimately cash—- has soared.  The antivirus company Symantec has reported that half of the malicious software it tracks is designed not to damage computers but to gather personal data.  About one-third of all malicious code tracked by the company now contains some keylogging component, according to Ken Dunham, the company’s rapid-response director.

And the SANS Institute, a group that trains and certifies computer security professionals, estimated that at a single moment last fall, as many as 9.9 million machines in the United States were infected with keyloggers of one kind or another, putting as much as $24 billion in bank account assets—- and probably much more—- literally at the fingertips of fraudsters.

The Federal Deposit Insurance Corporation, responding to the growing threat of cybercrime to the financial industry, stiffened its guidelines for Internet banking in October, effectively ordering banks to do more than ask for a simple user name and password.

“These can be developed by a 12-year-old hacker,” said Eugene Kaspersky, a co-founder of Kaspersky Labs, an international computer security and antivirus company based in Moscow.

Posted on 02/27