Hackers continue to become more professional

An analysis of Internet-based threats by Symantec Corp. shows that hacking continued its two-year trend toward criminalization in the last half of 2006, with data theft fueling a thriving underground economy.

Global networks of compromised computers that are used to launch attacks and harvest data are consolidating and becoming more interoperable, said Dean Tucker, executive editor of the Symantec Internet Security Threat Report. The United States has the highest number of command and control computers driving these bot networks, with 40 percent late last year, and the U.S. government is a primary source of data breaches. Agencies accounted for 25 percent of reported exposures of personal data.

Threats to personal data are cyclical and security professionals predict that, with the growing use of electronic filing for tax returns, the coming tax season will see a sharp upswing in phishing schemes targeting online taxpayers.

'You can absolutely count on it,' said Paul Henry, vice president of strategic accounts for Secure Computing Corp. 'We're seeing more bots used to send spam as well as host phishing sites.'

Symantec tracks threat trends in its semiannual threat report, culling data from 120 million managed customer security devices, as well as 40,000 sensors in its Global Intelligence Network.

Although the overall trend in data theft continued over the period surveyed, there were a number of surprises in the most recent report, Turner said. The number of infected computers used in malicious botnets increased by 29 percent in the last half of 2006 to just more than 6 million, but the number of command and control servers dropped by 25 percent. Symantec speculates that this is because the networks are consolidating.

These fewer but larger networks also are becoming more interoperable, using suites of malicious code that can cooperate with each other. An initial compromise can be followed up with a variety of malicious tools that allow the user to exploit a computer, making the networks more dangerous and more valuable.

In addition to hosting 40 percent of command and control servers, the United States also had 51 percent of the known underground economy servers in late 2006, Symantec reported. These servers offered U.S. credit cards with verification numbers at prices ranging from $1 to $6 each. Identity information was being sold in the same price range.

There are no figures on the size of the underground economy trading in stolen identities, but Turner guessed that the figure would be in the hundreds of millions of dollars, if not billions.

Theft or loss of devices such as laptop computers, backup tapes and USB drives accounted for 54 percent of the personal data lost by government, Symantec found. But government systems also are the targets of attacks that exploit medium severity vulnerabilities in third part applications rather than operating systems. These types of vulnerabilities became more popular with hackers late last year because they receive lower priority in patch management and often remain open longer. Using medium severity vulnerabilities as gateways, hackers often are able to install more dangerous malware.

Phishing, the practice of misdirecting users to malicious Web sites and tricking them into entering personal information, is a seasonal crime that takes advantage of holidays and special events. Tax filing season spurred warnings from the Internal Revenue Service last year of misleading e-mails purporting to be from the IRS.

'People are still falling prey to phishing,' said Secure Computing's Henry. Someone who filed a return electronically and received an e-mail purporting to be from the IRS saying an error was found in the return might well click on the enclosed link and visit a malicious site.

The number of people susceptible to these phishing attacks is growing. More than 73 million returns were filed electronically last year and the IRS expects a record number of e-filings this year. Most of the filings, about 53 million, were filed by third party tax preparers, but a growing number, 20.3 million, filed from their home PCs.

The IRS estimated that 95 million taxpayers will be eligible to use a free IRS electronic filing system this year. The program is a collaboration between the IRS and tax software companies that lets taxpayers with an adjusted gross income of $52,000 or less use free online tax preparation and filing software hosted at the IRS Web site.

Although the IRS e-mails a confirmation that an e-filed return has been received, it uses snail mail to send error notices. Henry had a few recommendations for avoiding phishing snares:

• Treat all e-mail with a high degree of suspicion. Phishing attacks are becoming for personal and better targeted.
  
• Don't click on links embedded in e-mails.
  
• To check on your return online, manually enter the URL you used to file the return into your browser.