Security Response

In the last six months of 2006 we saw a pretty sharp decline in thedaily number of denial of service attacks. Although there are likely anumber of factors at play here, I think there is one primary factor:denial of service extortion attacks are no longer profitable.

DoS extortion attacks are usually carried out by a bot-networkowner. Using their bots, the extortionsist has to make a successful DoSattack against a target organization. Following that they have to issuethe extortion request and hope the target organization pays it.

The thing is that DoS attacks are loud and risky. Whenever abot-network owner carries out a denial of service attack they run therisk of losing some of their bots. This could happen either because anattacking computer is identified and disinfected, or if it is simplyblocked by its ISP from accessing the network. Furthermore, if thebot-network owner isn’t careful they could lose their entire botnetwork if their command and control server is...

In a recent blog entry, I talked about creating a strong password. But what are passwords used for? They are, among other things, a mechanism for ensuring that sensitive data is accessed only by authorized persons. Some of that sensitive data may be personal data that can be used to uniquely identify a person, such as their Social Security Number or driver’s license number. If a person obtains sufficient personal data on an individual, they can perform identity theft, impersonating that individual in order to fraudulently open accounts, obtain credit cards, etc. It can take the individual whose identity was stolen a long time to get things straightened out, and during that time their credit history is tarnished.

Personal data is collected during normal business transactions. Even organizations that may not collect personal data from customers will still have personal data for their employees. This data must be protected from unauthorized disclosure. Depending on where you...

Identity theft and phishing have become prominent issues in the lastfew years. In this time, many users have become savvy to phishingschemes and are less likely to fall for traditional phishing attacks.In order to keep the stream of revenue flowing, attackers have had tobegin using more advanced techniques. One of the more recent techniquesis called "context-aware" phishing. A context-aware phishing attackuses specific personal information about intended victims to gain theirtrust. With the right information and implementation, this type ofattack can be very effective. To get the necessary personal informationfor this attack, phishers have become more like private investigators.

In this blog, I'll talk about one of the techniques used byattackers to find the information necessary to carry out effectivecontext-aware phishing attacks. This includes identifying targets,finding which brands can be phished for a given target, and researchingpersonal information to supply the...