Join our Mailing List

"For a happier, more stable and civilized future, each of us must develop a sincere, warm-hearted feeling of brotherhood and sisterhood."

Just one click... and the worm can eat your machine

March 31, 2009

Michael McCarthy
The Independent (UK)
March 30, 2009

It may have been the world's biggest
cyber-conspiracy, but it didn't need to involve
genius (of the evil sort). Just plausibility.

Here's an email from your bank, for example,
asking you to verify your password. Seems routine
enough. Seems authentic. And you're busy. So yeah, do that. Click.

But click and you may be lost. For the basis of
penetration of the vast computer networks of
campaign groups, businesses, armed forces, even
national governments, is often simply "social
engineering" – sending out emails purporting to
be from someone else. And once the recipient
clicks on the attachment, hostile software –
malware, in the jargon – inserts itself into their system.

We've grown more sophisticated and more aware of
internet fraud. There can be few people who are
now excited to receive an email offering 10 per
for use of a personal bank account to transfer
the cash out of a dodgy place. These days, we look at that and laugh.

But cyber-pirates are growing more sophisticated
themselves, and the killer email which worms its
way into a system to do untold damage these days
may look very authentic. In a report published
yesterday, on electronic infiltration of the Free
Tibet movement – part of the major Chinese-based
cyber-conspiracy – computer experts Ross Anderson
from the University of Cambridge and Shishir
Nagaraja from the University of Illinois show
that sometimes hostile hackers can get hold of a
genuine email and add a hostile programme. The
result is a hostile infiltration. In their
report, "The Snooping Dragon: social-malware
surveillance of the Tibetan movement", they
write: "This combination of well-written malware
with well-designed email lures which we call
social malware, is devastatingly effective. Few
organisations outside the defence and
intelligence sector could withstand such an
attack." Governments can mount such an assault,
they say, but so could "a capable motivated individual".

Anderson and Magaraja point out that once hostile
hackers have made an initial breach, once a
single careless employee clicks on the wrong
attachment – they can get inside it and use the
knowledge they gain to disguise future attacks. "Prevention will be hard."

The lesson is twofold. One: always treat emails
from people or organisations you don't know as
suspicious, particularly if they have
attachments. And two: fooling you is easier than you think.
CTC National Office 1425 René-Lévesque Blvd West, 3rd Floor, Montréal, Québec, Canada, H3G 1T7
T: (514) 487-0665
Developed by plank