3rd December, 2013, New Delhi:- This may tend to come across as being quite sensational and at times startling even, but then, revelations of the past year has raised quite a few eyebrows coupled with questions as regards the way People use the Internet nowadays and the type of risks one faces in doing so.
In 2013 cutting-edge threat actors have continued menacingly large-scale operations resulting in the spawning of cyber-mercenaries, specialist APT groups “for hire” which focus on hit-and-run operations unto the very face of the World Wide Web.
“Hacktivists” were constantly making news, along with the term “leak”, which is sure to put fear into the heart of any serious sys-admin out there. In the meantime, cybercriminals were busy conceiving new methods to steal money or Bitcoins.
No ITSec overview of 2013 would be complete without mentioning Edward Snowden and the wider privacy implications of his disclosures. In this context, one of the first visible effects was the shutdown of encrypted e-mail services such as Lavabit and Silent Circle. The reason being their inability to provide such services under pressure from law enforcement and other governmental agencies. Another story or rather a Case study at hand which has had implications over privacy is the NSA sabotage of the elliptic curve cryptographic algorithms released through NIST.
Comments Costin Raiu, Director of the Global Research and Analysis team, Kaspersky Lab:-
“We predicted 2012 to be bare -it – all and 2013 to be eye opening. That forecast seemed to prove correct – as 2013 showed that everybody is in the same boat. In reality , any organization or person can become a victim. Also not all attacks involve high profile targets, or those involved in ‘critical infrastructure’ projects. Those who hold data could be of value to cybercriminals, or they can even be used as ‘stepping-stones’ to reach other targets. This point was amply illustrated by Icefog attacks this year. They were in fact the part of an emerging trend that appeared in 2013 – attacks by small groups of cyber-mercenaries who conduct small hit-and-run attacks. Going forward, we predict that more of these groups will appear as an underground black market when ‘APT’ services begins to emerge.”
It is worthwhile to know that, stealing money – either by directly accessing bank accounts or by stealing confidential data – is not the only motive behind security breaches. They can also be launched to undermine the reputation of the company being targeted, or as a form of political or social protest.
If we look here then we can see that ‘Anonymous’ group undertook responsibility for attacks on the US Department of Justice, Massachusetts Institute of Technology and the web sites of various governments. Those claiming to be part of the ‘Syrian Electronic Army’ claimed responsibility for hacking the Twitter account of Associated Press (AP) and sending a false tweet reporting explosions at the White House – which wiped $136 billion off the DOW. For those with the relevant skills up his fingertips, it became comparatively easier to launch an attack on a web site than it is to co-ordinate the real-world protests. The methods used by cybercriminals to make money from their victims are not always subtle.
Adding more Drama in here, “ransomware” programs have surfaced and have become a popular means of making easy money – cybercriminals block access to a computer’s file system, or encrypt data files stored on the computer. Later, they warn the user to pay in order to recover his or her data. This was the case with the Cryptolocker Trojan. The cybercriminals give their victims only three days to pay up, accepting different forms of payment from their part, including Bitcoin.