Web Security

HED: Report: Spam Profits Down, Cybercrooks Flock to Targeted AttacksDEK: A report from Cisco Systems suggests that cybercriminals are abandoning spamming for targeted attacks, which are more profitable. A new report from Cisco Systems Inc. analyzing illegal activities from spammers and other online scams suggests that cyber criminals are abandoning large spam runs and indiscriminate attacks in search of higher profits doing targeted hacks.  The findings of the report, released at a press and analyst event on Thursday, suggest a precipitous drop in revenue generated by mass spam- and phishing attacks of the last five years, and a shift to lower volume, but more profitable targeted attacks. Cisco estimated that worldwide revenue from high volume spamming has decreased by more than two thirds since last year, from $1 billion a year ago to just $300 million today. During the same period, revenue from scams and other malicious attacks has quadrupled from $50 million to around $200 million, the company reported. Cisco relied on data from its cloud based intelligence services, which aggregate information from across the company’s customer base, to compile the report. Low conversion rates are behind the move away from mass attacks. In addition, private and law enforcement actions to dismantle some of the world’s largest botnets like Rustock and Bredolab in the last year have denied spammers the tools they need to conduct massive campaigns, Cisco said.Targeted attacks are a subset of spam and share many characteristics with mass spam runs, including the use of e-mail messages containing malicious file attachments or Web links. However, targeted attacks rely on extensive planning and research on the likely recipients of the e-mail. Time is taken to craft e-mail messages that seem to be from legitimate sources and directed to the recipient. Targeted spam runs are far smaller than mass spam runs, but have similar block rates. The key difference is a far higher conversion rate among the few users who end up seeing the targeted e-mails. Fully 70% of those who see a targeted e-mail message opened it, Cisco data suggests, and 50% of those clicked through to the malicious Web page or attachment and were “converted.” The average value per victim, for attackers, can be 40 times that of a mass attack and the profit from a spearphishing campaign can be 10 times that of a high volume spam run, Cisco said. Targeted attacks have figured prominently in recent high profile attacks, including a security breach at EMC’s RSA Security division (http://threatpost.com/en_us/blogs/securid-attack-was-work-very-experienced-attackers-061711) and follow-on attacks (http://threatpost.com/en_us/blogs/rsa-warns-customers-targeted-attacks-wake-hack-031811) at L3 Communications (http://threatpost.com/en_us/blogs/report-l3-warns-employees-attacks-using-compromised-securid-tokens-060111), the IMF (http://threatpost.com/en_us/blogs/international-monetary-fund-reportedly-hacked-061111) and others. Studies suggest that the attacks are highly effective. Data from Intrepidus Group suggests that three quarter of corporate employees fall for phishing attacks. (http://threatpost.com/en_us/blogs/expert-three-quarters-employees-duped-phishing-scams-040711)Studies A new report from Cisco Systems Inc. analyzing illegal activities from spammers and other online scams suggests that cyber criminals are abandoning large spam runs and indiscriminate attacks in search of higher profits doing targeted hacks. 

Customers of EMC’s RSA Security division that are worried about being the victim of an attack following the theft of sensitive data relating to that company’s SECURID tokens may not need to rush out and replace those tokens, according to security consulting firm Verizon Business. 

News reports say the FBI has raided a home in Hamilton, Ohio as part of an investigation of LulzSec, the group responsible for a string of attacks on prominent targets in recent months. 

There is a large scale spam campaign underway right now in which attackers are using fairly well-crafted emails that appear to come from the IRS to infect victims with the Zeus bot. The attack has been ongoing for a couple of weeks now, and researchers say that although the attackers have taken some precautions to prevent analysis of the sites and malware being used, they also made some key mistakes.

MALAGA, SPAIN–Botnets have been around for more than 15 years now, and for much of that time they’ve been the favored platform for attackers looking to compromise users on a large scale and monetize those infected machines. But now, as researchers and authorities begin to have more success with botnet takedowns and arrests, the attackers behind malware kits and exploit kits are beginning to work together and learn from one another.

This is the second in a two-part interview with Aaron Barr, the former CEO of HBGary FederalIn the second half of his exclusive interview with Threatpost, former HBGary CEO Aaron Barr – speaking before the arrest of alleged Lulzsec member Ryan Cleary in the UK –  talked about the likely law enforcement reaction to the Anonymous and Lulzsec hacks, the mainstream media’s portrayal of the hack of HBGary, as well as how he was picking up the pieces after the embarrassing hack of his employer.

A 19 year-old UK man was charged on Wednesday for the role he played in attacks on the UK’s Serious Organized Crime Agency (SOCA) as well as UK’s British Phonographic Industry (BPI) and International Federation of the Phonographic Industry (IFPI), according to a statement released by the Metropolitan Police Service’s Police Central e-Crime Unit (PCeU).