The Home and Home Office Security Report(HHOSR), a monthly report released by Symantec, provides a high-leveloverview of Internet security concerns that may be of interest to homeand home office users. March's HHOSR focused largely on Volume XI of Symantec's Internet Security Threat Report.
This HHOSR's hot topic discussed the price of a wide variety ofinformation related to personal identity. The types of information, andthe prices at which they were offered, are outlines in table 1 below.
| Item | Cost in US Dollars |
|---|
| Complete Identity | $14 - $18 |
| US Credit Card | $1 - $6 |
| UK Credit Card | $2 - $12 |
| Compromised Computer | $6 - $12 |
| World of Warcraft Account | $10 |
Table 1: Identity Pricing
According to the report, the reason that prices here are lower thanmight be expected is likely due to a high supply of this type ofinformation. A high supply without a comparatively high demand tends todrive down prices. This high supply of identities underscores thedanger of identity theft to home users, since it indicates that this issomething that really is happening frequently. The fact that World ofWarcraft accounts are being sold on the black market shows that homeusers really are being attacked, the credit card numbers didn't allcome from database breaches.
Another topic covered in this HHOSR was threats to confidentialinformation by malicious code. This section discussed the proportion ofmalicious code (viruses, worms, Trojans, etc.) that attempt to stealpersonal information (passwords, credit card numbers, bankinginformation, etc.) from infected computers. During the second half of2006, 66 percent of the top 50 malicious code threats reported toSymantec attempted to steal confidential information, up from 48percent during the first half. This trend towards stealing personalinformation likely indicates that attackers are attempting to profitfrom their activities, which is a seen throughout the Internet SecurityThreat Report.
The HHOSR also covered the recent increases of spam seen in theInternet Security Threat report. The report states that 59 percent ofemail during the second half of 2006 was spam, up from 54 percentduring the first half of 2006. This increase in spam may be of concernto home users because, in addition to filling their mailboxes, spam canbe used to deliver Trojans, viruses, and phishing attacks.
According to the HHOSR, the two main targets of phishing attackswere financial institutions and online retailers, with 98 percent ofphishing sites resembling one of them. This further demonstrates thatattackers are attempting to profit off their activities. By imitatingeither a financial institution or an online retailer, an unsuspectinguser may be tricked into providing their account details which can thenbe sold on the black market. Users are encouraged to review bank andcredit card information frequently, and to visit Internet FraudComplaint Center (IFCC) website for guidelines on how to avoid Internetscams.
The HHOSR also discussed Web browser vulnerabilities, which are aclass of vulnerabilities that affect users who visit malicious Websites. These vulnerabilities can be used to access a user'sconfidential information or to control their computer remotely. Duringthe second half of 2006, Symantec documented 54 vulnerabilities inMicrosoft
Internet Explorer and 40 vulnerabilities in Mozilla browsers (includingFirefox). Additionally, vulnerabilities were reported in the Safari andOpera browsers. Users are encouraged to protect themselves by keepingtheir Web browsers up to date and by avoiding untrustworthy Web siteswhenever possible.
Finally, the HHOSR report covered the malicious activity by country.Malicious activity is a combination of many factors, including spam andbot network prevalence. The United States had, on average, the mostmalicious activity worldwide, followed by China and Germany. The UnitedStates also has the highest Internet connectivity in the world. Thistendency for more highly-connected countries to have higher proportionsof malicious activity is logical, because there are more computers topotentially commit the malicious acts. On the other hand, it seems likecountries with strong Internet architectures would have better securitypractices, but so far, this doesn't appear to be the case.
All of the topics mentioned here, along with other threats and Internet security news are discussed in more detail in the
Symantec Home and Home Office Security Report for March, 2007. This month’s report, as well as previous reports, can be viewed and/or downloaded from the
homepage.