Day 140: Cyber-Crime Made Simple

So, I finally got rid of the last of my rellies. Back to business, I guess.

Warning: This post eschews technical accuracy for simplicity and is intended ONLY to give non-techie people a basic understanding of things. Do not attempt to use as an authoritative source—severe embarrassment may result.

"All software has bugs in it". This is the mantra that you will hear any modern software developer chant when questioned over why their software has bugs in it; and—to a large extent—it's true. Theoretically, it's possible to write flawless software, but I can't think of anyone who actually does; not when you're writing anything of any size or complexity, and especially not when you're writing to a deadline. Normally, what happens with software is that it gets released, users use it, they find bugs and report them, and the author of the software releases updates to fix the bugs. This is why your operating system and your web-browser are always asking to be restarted. To give you an idea of how bug-riddled your average piece of software is, Windows XP was released in 2001; it is 16 years old; and people are still finding major bugs in it. A lot of bugs do really annoying things, like corrupting your data, or causing your applications to crash; but today, we're going to be talking about an especially nasty kind of bug; the kind that allows a malicious person to control your computer remotely, over the internet. We're going to call these bugs "exploits".

Over the years, the discovery of exploits has become an industry in its own right. Broadly speaking, there are three main groups who pay people to look for exploits: the makers of the software, who wish to fix the exploits; governments and law enforcement, who wish to access the computers of criminals and rival governments; and criminals, who wish to leverage the exploits to make money. Not only do these three groups employ people to look for exploits, they also buy exploits from third-parties, in what is basically an online marketplace. As you may imagine, the existence of such a marketplace has caused businesses to spring up which essentially specialise in "exploit brokering". Also, it's important to remember that all of these groups are made up of individuals who have their own interests, may move between the different camps, or may have their feet in two or more camps at any one time. So, for instance, a private researcher in Korea may discover an exploit in Windows; he might sell it to a broker in Brazil, who sells it to the CIA; and then someone at the CIA might (illegally) sell it to a Romanian crime syndicate. And of course, since all of these groups know that they all have exploits that the other doesn't, they are all perpetually trying to steal from each other as well.

Governments

Every government that has the ability to hack into the computers of a foreign government or a foreign corporation, does so. No exceptions. However, this is usually for the purpose of information gathering, and examples of governments provably "attacking" each other in this way are rare. Any time you hear a government (usually the USA) accusing another government of a "cyber-attack" (usually China, Russia, Iran, or North Korea) it's more likely that someone is scapegoating someone else for political reasons.

Criminals

Apart from identity/credit-card theft, there are two big money-earners for cyber-criminals; and both of them boil down to extortion.

Ransom-Ware

Ransom-ware involves a malicious piece of software getting onto your system, encrypting all of your files, and then demanding that you pay a ransom to have your files unencrypted. Ransom-ware has only been on the scene for a few years, but has quickly become a favourite revenue source for cyber-crims. Unfortunately, if it's written properly, there's no way of getting your files back, short of paying up. Now, more-so than ever, it's important to keep multiple backups of your important files. And don't leave your external hard-drives plugged in unless you're using them.

DDOSing BotNets

This one takes a little more explaining. Every time you do something on a web-page, your browser sends a message to the web-server where that web-page is hosted, and the web-server sends some information (usually a copy of the web-page) back. Web-servers, and the infrastructure that connects them to the internet, can only handle so-many requests per second. So, if millions of people request a web-page at exactly the same time, most of them aren't going to get a response. Big sites, like Facebook, get around these limitations by having copies of their data duplicated on hundreds of servers spread all over the world, but smaller sites simply can't afford to do that.

So, if you can flood a web-server with millions of requests, you can effectively take a web-site offline. Now, if you did this to a business that makes most of its money through its web-site, it would give you some pretty hefty leverage with which to extort money from said business. The question is, how do you produce enough requests to flood the server; after all, you can't do it from a single computer. Well, the best way to do it, is to write a computer virus, and get it to infect hundreds of thousands of computers all around the world. Then, you can get your network of infected computers (known as a bot-net) to start sending requests to the victim, each individual computer contributing so little to the attack that the owner will probably never realise that their machine is infected, much less that it's being used for nefarious criminal activities. This is known as a DDOS or "Distributed Denial of Service" attack.

Believe it or not, there are some people who actually rent out the use of their bot-nets. So, for instance, if I was running "Alex's Online Shoes" and suddenly I found myself in competition with "Squib's Online Shoes", I could pay a few thousand dollars to have somebody else knock this pesky newcomer off the interwebs for me. This is know as "DDOS as a Service".

The Internet of Turds

"Internet of Things" (IoT) is a marketing buzz-word that describes the recent trend of manufacturers shoving cheap, mass-produced, internet-connected computers into everything from televisions, to video-recorders, radios, air-conditioners, refrigerators, ovens, microwaves, automobiles, web-cams, security-cameras, baby-monitors, walkie-talkies, headphones, picture-frames, light-bulbs, door-bells, toilets (yes toilets), and—of course—desktop routers. As we discussed above, these gizmos—like everything else—come complete with exploits baked into the software. However, unlike your browser or operating system, most of these things never receive security updates; meaning that the internet is now OVERFLOWING with easily-exploitable computers. As you can imagine, what we are now seeing is bot-nets that are exponentially larger than anything we've ever seen before; potentially even big enough to knock a FaceBook or a Google off line. That brief outage we saw last year was a result of one such bot-net.

While there's not much you can do if you're targeted by a DDOS attack, my advice is to avoid buying anything that has the word "smart" in the description. For the most part, "smart" is usually just a synonym for "needlessly and insecurely connected to the internet".

I hope somebody found this informative. Feel free to ask any comments in the questions.