Saturday, March 31, 2001

Mass Victimization Internet Crime Will Happen Before 2003

At least one incident of economic mass victimization of thousands of Internet users will occur by the end of 2002, a new study from Gartner, Inc. (IT and ITB) predicts. In addition, Gartner expects the perpetrator of this world-scale, Internet-based theft to remain undetected due to lack of adequate preparation by international law enforcement officials.

"Converging technology trends are creating economies of scale that enable a new class of cybercrimes aimed at mass victimization," explains Richard Hunter, Gartner Research Fellow. More importantly, Hunter adds, global law enforcement agencies are poorly positioned to combat these trends, leaving thousands of consumers vulnerable to online theft. "Using mundane, readily available technologies that have already been deployed by both legitimate and illegitimate businesses, cybercriminals can now surreptitiously steal millions of dollars, a few dollars at a time, from millions of individuals simultaneously. Moreover, they are very likely to get away with the crime."

The economic value represented by cybercrimes will increase by two to three orders of magnitude, by 1,000 to 10,000 percent, through 2004. This massive cost will result from the combination of inadequate cyber law enforcement, increasing opportunities for cyber-criminal activities, and increasing awareness of those opportunities among criminals at all levels.

The study states that law enforcement funding will likely remain inadequate to police cyberspace through 2004, noting that the annual U.S. budget for funding cybercrime-related training, investigation and enforcement is unlikely to exceed 1 percent of the overall Federal law enforcement budget -- an amount insufficient to fund even necessary cybercrime research. Internationally, Gartner notes, attitudes toward "cyber law enforcement" vary widely and are inconsistent from country to country, further complicating attempts by police to enforce the laws that do exist.

According to Gartner, consumers should take the following steps to protect themselves from Internet crime:

- Install a personal firewall on any computer that has Internet access. With widespread conversion from dial-up Internet access to cable modems, many consumers have not taken this precaution. Consumers may also consider using scan services provided by Internet service providers, if available.

- Take precautions to monitor all financial transactions frequently, staying on the lookout for unauthorized or unexplained purchases, withdrawals or fund transfers. This scrutiny is particularly important around major holidays, such as Christmas. Consumers should be especially careful to detect small transactions, which may be used by an attacker to initiate an assault.

- Disable any active content functionality in your browser (such as ActiveX and Java).

- Disable peer-to-peer networking in any Internet-connected machine.

- Use a credit card with a low credit limit exclusively for use for Web purchases. Do not use a debit card for any online transactions unless the issuer explicitly takes responsibility for unauthorized use.

According to Gartner, there is no common international legal code for cybercrime, nor any organization chartered and authorized by governments worldwide to create one. Because the talent and technology required to execute these crimes is easily exported, lawbreakers can easily jump borders to evade law enforcement or to take advantage of more lax environments. This capability can turn a localized crime into one of global proportions.

A factor that increases the likelihood of mass victimization attacks is the presence of skilled technologists in regions with depressed economies, who may find it difficult or impossible to gain lucrative legal employment. Gartner points out that such skilled technology workers (e.g., from the former Soviet Union) were behind recent attacks against both Microsoft and a number of commercial enterprises in the United States. These thieves systematically looted commercial information, such as credit card numbers, over a 12-month period. Gartner analysts believe that many people who are capable of executing widespread virus-like assaults, or redirecting Web traffic to "spoof" sites, would not turn to such crimes if more lucrative, legitimate employment were available.

"This new generation of perpetrator won't be firing off warning shots," concludes Hunter. "In the event that a mass Internet victimization scenario strikes, none of us -- not even the vendors of anti-virus software, or those of us who regularly perform upgrades to our anti-virus software - will be able to detect malicious code or a virus absent such overt signals. All computer users on a network must take precautions against intruders gaining a foothold." Hunter notes that the commercial enterprises that were victimized by hackers from Eastern Europe had failed to install security updates to the Microsoft Windows NT operating system that had been available for months. "Prevention is the most important defense. Enforcement after the fact is no defense at all."

News Tidbits (appears every day on the front page)
- no new tidbits today.