You're being stalked by cyber criminals

UCSD professor Stefan Savage, who is an expert at revealing how cyber crooks electronically break into businesses, stands in a server room at UCSD on Friday in San Diego, California. — Eduardo Contreras

You're being stalked.

Cyber criminals are forever looking for ways to hack businesses, government and personal computers in hopes of stealing valuable information, or to make you spend money to fix the damage they've done by infecting machines with a virus.

Experts have trouble quantifying the financial impact of such crimes, but analysts say it runs into the billions of dollars annually in the United States. And the problem is getting worse, with criminals using an expanding variety of tools and strategies to launch attacks. The National Science Foundation is fighting back, awarding $10 million to University of California San Diego and its collaborators to study how cyber criminals operate and how they think. The study is being co-led by Stefan Savage, a UCSD computer scientist who believes you can blunt such attacks if you disrupt the business plan of key cyber criminals. He discussed the scope of the problem with U-T San Diego.

Q: Defense Secretary Leon Panetta has said the U.S. faces a potential cyber Pearl Harbor due to the ability of hackers to collectively hit and damage banks and other institutions. Is that plausible?

A: One problem in the “Pearl Harbor” trope is that those using it are rarely clear what they mean. Does it mean that you can’t buy books at Amazon for an afternoon or that power goes out across the Northeastern power grid? The capabilities required to do one vs. the other are quite different.

That said, the question of plausibility is probably not limited by technical issues. I don’t have much doubt that a sufficiently educated, funded and patient adversary could do grave damage via electronic means.

Last year, my colleagues and I demonstrated that we could remotely take over an automobile 1,500 miles away, track it, listen into passenger conversations and then, on demand, disable the brakes. Others have shown similar kinds of vulnerabilities in a wide array of critical devices and systems including implantable cardiac defibrillators, ATM machines, insulin pumps, industrial control systems and so on. So, I think such attacks are “technically” plausible.

However, when one thinks about motivation I’m less clear. Strategically, what is the military value of a pure cyberattack? They’re expensive, difficult to control perfectly, are less sensational than kinetic attacks, cause minimal long-term damage, and they lose value over time (one of the odd qualities of cyberweapons is that the same attack may not work twice since once we understand the attack, we can usually fix the underlying problem it relies on).

These kinds of methods are spectacularly good for espionage but, to me, they seem less likely to be used as methods for causing physical damage unless our adversaries have no other choice.

Q: On an average day, how much of a threat does an average business in San Diego face from cybercriminals?

A: There is a background threat that everyone faces — businesses large and small. All computers connected to the Internet are targets and most companies should assume that at least some of the computers are compromised by one attack or another. This is simply the cost of using computers today.

However, not all attacks are created equal because not all attackers are the same. While all attacks typically leverage the same sorts of technical vulnerabilities (we all use the same software and hardware) the level of threat can vary significantly based on what those attackers do once they’ve compromised a machine.

Crimes of opportunity (e.g., stealing credit card numbers on the machine where you find them) are different from crimes of premeditation.

Companies whose computers hold significant value — whether financial value, because they have authority over corporate bank accounts, or intellectual property value, because they hold important trade secrets — are more likely to be targeted by determined attackers and must anticipate these more specific threats.

Q: What are banks and financial institutions worried about?

A: You are a small business, and you are used to dealing with a bunch of suppliers and creditors. You’ll have a merchant account with your bank and do a direct wire transfer, called ACH transfers, out of your bank account that you will authorize via your computer. That allows the money transported in and out.

There are groups of criminals who have become quite good at targeting small business, getting in their computers, and bypassing any kind of authentication protection that’s there. The most sophisticated will simply piggyback their own transactions as you log into the bank to make your own and then will rewrite it to make it look on the screen like nothing has happened. So you will pay off some vendor, and (the cybercriminal) will transfer $100,000 somewhere else, and then they will add $100,000 to what gets printed on the screen, so you don’t know that you’re out $100,000.

To get this money out of the system, criminals use a network of people — called a mule network — where each person receives a small piece of the sum (under $10,000 to avoid the mandatory suspicious activity reporting law) and then they break it up into even smaller pieces and transfer it overseas using Western Union or MoneyGram.

Q: Sounds like there is a lot of creativity in the cybercriminal world.

A: There is. They are very good at looking for where the opportunities are for exacting value online, particularly against consumers and small businesses.

That said, most criminal activities generally break down into two fundamental value-creation strategies: advertising and theft. In the advertising model, criminals try get consumers to knowingly purchase some good or service they advertise (e.g., email spam for cheap Viagra) or by abusing an existing advertising network (e.g., commanding compromised computers to click on Web advertisements you publish to drive additional commissions).

Conversely, the theft model involves covertly stealing credentials from the user, such as credit card numbers, bank account passwords and so on, and using those to transfer the money out. These capitalization strategies in turn fund all the infrastructure, the cost centers, of cybercrime: malware, botnets, viruses, exploit kits, mule networks, phishing kits and so on.

Q: You’ve been looking at the business models that cybercriminals use. Are scientists likely to give police and prosecutors the knowledge they need to greatly reduce such crime?

A: The technical details of these crimes can change extremely quickly. This is precisely why one needs to understand the underlying economics to combat these problems effectively.

For example, when you consider that the market price for a compromised host is between 1 and 10 cents, it’s clear that a strategy of going after infected hosts and cleaning them up is not, by itself, going to be effective.

However, as a rule of thumb, the Achilles heel of many online scams is where they need to touch the real world. To profit, scammers must ultimately monetize their actions, whether through direct consumer payments (e.g., as in spam-advertised pharmaceuticals), by indirect advertising payments (e.g., by exploiting online advertising networks), or by liquidating stolen bank accounts.

In the end, someone needs to take delivery on that money or organize others to do so. The business model and the social structure around monetization tends to create both risk and a bottleneck that can be targeted.

For example, when we looked at email spam, we found that 95 percent of the websites being advertised depended on the services of just three banks to process credit card payments. By targeting that part of the infrastructure, brand holders are having great success in undermining the entire ecosystem.

Q: Do most cybercriminals make significant amounts of money? And is there a way to characterize just how big this “industry” is/

A: Some do, but most don’t. For example, last year we looked at leading affiliates (e.g., spammers) of a major rogue pharmacy for which records had been leaked. The median annual commission for these spammers was only a few hundred dollars. However, a small number were clearing well over $1 million a year and the ringleaders had net revenues around $10 million.

This kind of distribution is common in most groups that we’ve looked at; a select few extract significant profits, while most of the smaller players stay small. Talking about revenues across the entire cybercrime industry is difficult since we rarely have good data (these guys don’t file 10-Qs with the SEC like normal public companies) and even defining which activities we should call cybercrime can be tricky.

This fuzziness can lead to all kinds of crazy numbers that make no sense, like the recent claims that there are trillion-dollar losses to cybercrime each year.

I recently wrote a paper with colleagues at Cambridge University about this question and while our analysis supports the argument that costs are in the billions of dollars, we also found evidence that much of these costs are dominated by defense and indirect costs, rather than direct losses to cybercriminals.