Endpoint Protection

 View Only

Because That's Where the Money Is 

May 28, 2007 03:00 AM

“Because that's where the money is” was apparently the reason givenby Willie Sutton when asked why he kept robbing banks. Even though thatstatement may be correct, Willie Sutton never said it like this – as heexplains in his book “Where the Money Was.” Still, it evolved into oneof those urban myths, quoted many times. But there is an even betteranalogy to be made between the life of this bank robber from the 1940sand today’s online crime.

One of his nicknames was “The Actor,” which he gained aftercommitting robberies in broad daylight, impersonating trustedpersonnel. He varied his disguise from telegraph messenger tomaintenance man to policeman. He had realized that an acetylene torchwas not the best way into a safe – it was much easier to abuse people’strust, as no one really expected such assaults from within their ownranks. It was like an insider job, but without actually belonging tothe team in the first place. Those old-school social engineering tricksare comparable with modern-day attacks that try to gain your trust.Just like in Sutton’s time, if skillfully executed, these tricks arestill successful today.

Trusting unknown components in your system can give you nightmares.Even worse, often you don’t know that you have a piece of suspicioussoftware running on your machine, such as a Trojan or rootkit. Thisleads to you thinking you are secure, when in reality you aren’t. Mostsecurity technologies are based on certain assumptions. For example,using common cryptography to send messages from Alice to Bob assumesthat Alice can trust her own typewriter to create the message. Havingan infected computer system affects this axiom. Alice can no longertrust that her typewriter writes what she types. Taking it one stepfurther, she can’t even be sure that the typewriter doesn’t covertlysend this message to anyone else except Bob. In the real world it mightbe easy to verify that what you type appears the same on the paper, butin cyberspace this verification can be very complex and difficult toachieve. How can you be sure that your system is doing exactly what youwant it to do? Can you trust the applications on your system, or besure that Web browser is not a bank robber in disguise?

Knowing that SSL will encrypt the information flow from your systemto the bank’s server is an important part, but it should not trick youinto thinking that your data is now protected at all times. There aremultiple moments where attacks are possible before the information evenleaves your machine. Starting with logging every keystroke when youtype them, hooking the browser’s functionality, down to interceptingnetwork traffic before it gets encrypted with SSL. That is why you needgood protection on your system. Don’t let yourself be fooled intothinking that the Web application uses a panacea to protect you in allcases. Even two-factor authentication will not necessary protect youfrom today’s Trojans, as we have already seen in the wild.

Even if you do trust all the add-ons that you might have installedin your browser that update constantly with new features, there areother risks.So next time you check your account balance online, notonly make sure that your session is SSL protected, but also make surethat your system is protected, or you might end up asking yourself:“Wasn’t that where all my money was?”

Statistics
0 Favorited
0 Views
0 Files
0 Shares
0 Downloads

Tags and Keywords

Related Entries and Links

No Related Resource entered.