{"id":66,"date":"2012-05-27T16:04:13","date_gmt":"2012-05-27T09:04:13","guid":{"rendered":"http:\/\/www.ian-tibble.net\/blog\/?p=66"},"modified":"2012-05-27T16:46:00","modified_gmt":"2012-05-27T09:46:00","slug":"interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights","status":"publish","type":"post","link":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/","title":{"rendered":"ZDnet’s Interview with Mikko Hypponen – “The current state of the cybercrime ecosystem” – Highlights"},"content":{"rendered":"

Last week Dancho Danchev interviewed Mikko Hypponen (CSO @ F-Secure) on the subject of CaaS (Cybercrime as a Service), the recent Botnet takedowns, and OPsec within cybercrime “organsations”. The questions from the interviewer occupied 3 times as much real estate as the answers (!), so here is a distillation of some of the more salient points arising from the interview, covered fully in this ZDnet article<\/a> . Also some of the questions provided a lot of information (:)) .<\/p>\n

The lack of OPsec (operational security), whether there is a lack or not, is not how criminals and botnet masters are traced – it’s chiefly because they like to brag about their exploits on forums and chat. This makes them easier to trace than might be expected.<\/p>\n

The traditional cybercrime marketplaces have been illuminated and the DarkMarket as its been called is not so dark any more – indeed some have even claimed that it no longer exists. Mikko Hypponen talks about Tor and Freenet and how services are moving to the “deep web” – and this worries law enforcement, but few details were forthcoming.<\/p>\n

These days, everything from spam<\/a>, phishing<\/a> to launching malware attacks and coding<\/a> custom malware<\/a> is available as a professionally packaged service. Mikko replies there was little the good guys could do to prevent this. “These are not technological problems; they are mostly social problems. And social problems are always hard to fix”.<\/p>\n

“Some criminals are sellings banking trojans and then other hackers are selling tailor-made configuration files for those trojans, targeting any particular bank. Going prices for such config customization seem to be around $500 at the moment.”<\/p>\n

\u201cPartnerka\u201d affiliate networks with rogue AVs and ransom trojans have been highly successful for the bad guys, and this kind of affiliate model also means that the masters behind the schemes don\u2019t need to get their hands dirty anymore.<\/p>\n

Mac OS X and security: Historically the Flashback.K thing is very important – a turning point. Only 2 to 5% of all macs were infected, but this is huge nonetheless. It means that whereas in the past, Mac owners didn’t need anti-virus – now they do need it. However, there is still only one gang behind Mac malware – this is likely to change.<\/p>\n

Despite the multiple claims from many media sources, the cybercrime marketplace does not generate more revenue than sales of hard drugs, but at the same time we do not posses the means to quantify the financial numbers. It is known that individual groups have made tens of millions of dollars. But not hundreds.<\/p>\n

These days malware and trojans are not as much about exploiting Patch Tuesday issues as they are about using browser extensions and plugins. Drive-by-downloads via exploits targeting browser add-ons and plugins are clearly the most common way of getting infected.<\/p>\n

Mozilla’s plugin check<\/a> is quite effective but in practice the Chrome model of sandboxing and replacing third-party add-ons with their own replacements seems to work really well. Chrome has issues with privacy but in terms of security its better than the others. Chrome users get exploited less than the others.<\/p>\n

Opt-in botnets <\/a>have been a growing problem over the past two years – often this is about patriotic hacktivism, where users sometimes deliberately infect themselves with a DDoS agent. These are likely to be around for a very long time, and it’s been reported recently by Akamai that DDoS attacks have been launched from a botnet of mobile phones. We\u2019re likely to see DDoS botnets move to totally new platforms in the future. Think cars and microwave ovens launching attacks. Tools as LOIC and HOIC have brought the \u201cOpt-in botnet\u201d model to the masses, and it works. Unfortunately.<\/p>\n

Android has made malware for Linux a reality, as identified in a F-Secure report<\/a>.\u00a0 Quoting Mr Hypponen: “Old Symbian malware is going away. Nobody is targeting Windows Phone. Nobody is targeting iPhone. And Android is getting targeted more and more. iOS, the operating system in iPhone (and iPad and iPod) was released with the iPhone in the summer of 2007 – five years ago. The system has been targeted by attacker for five years, with no success. We still haven\u2019t seen a single real-world malware attack against the iPhone. This is a great accomplishment and we really have to give credit to Apple for a job well done. Out of all Linux variants, Android is the clear leader in malware.”<\/p>\n

Mobile malware vendors cashing out by sending text messages and placing calls to expensive premium-rate numbers – this will be around for at least the near future – It works and it\u2019s easy to do. Eventually, we\u2019ll probably see more mobile banking trojans and new trojans targeting micropayments.<\/p>\n

Attacks against human rights activists are undeniably coming from China, according to Mr Hypponen. Some of the attacks came from the same source as attacks against defence contractors and governments – although proving it is hard.<\/p>\n

Facebook,\u00a0Twitter<\/a>, Amazon\u2019s EC2<\/a>, LinkedIn<\/a>, Baidu<\/a>, Blogspot and Google Groups have all had criminal groups launching their campaigns from their networks in the past. Some of these are easily able to kick out abusers though, and spot them fairly quickly.<\/p>\n

Anti-virus software and its failings aside…operators are in a key position to move security from a product to service and to protect the masses with both managed security solutions on end-user devices as well as behind-the-scenes monitoring and filtering of malicious traffic.<\/p>\n

In March, 2011 Dancho proposed that all ISPs should quarantine their malware infected users<\/a> until they prove they can use the Internet in a safe way. Mikko agrees this is a good idea, and is currently now being practised successfully with F-Secure’s solutions and several operators.<\/p>\n","protected":false},"excerpt":{"rendered":"

Last week Dancho Danchev interviewed Mikko Hypponen (CSO @ F-Secure) on the subject of CaaS (Cybercrime as a Service), the recent Botnet takedowns, and OPsec within cybercrime “organsations”. The questions from the interviewer occupied 3 times as much real estate … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,30,29,28,27],"tags":[],"class_list":["post-66","post","type-post","status-publish","format-standard","hentry","category-blog","category-botnets","category-caas","category-cybercrime","category-malware"],"yoast_head":"\nZDnet's Interview with Mikko Hypponen - "The current state of the cybercrime ecosystem" - Highlights - Security Macromorphosis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"ZDnet's Interview with Mikko Hypponen - "The current state of the cybercrime ecosystem" - Highlights - Security Macromorphosis\" \/>\n<meta property=\"og:description\" content=\"Last week Dancho Danchev interviewed Mikko Hypponen (CSO @ F-Secure) on the subject of CaaS (Cybercrime as a Service), the recent Botnet takedowns, and OPsec within cybercrime “organsations”. The questions from the interviewer occupied 3 times as much real estate … Continue reading →\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/\" \/>\n<meta property=\"og:site_name\" content=\"Security Macromorphosis\" \/>\n<meta property=\"article:published_time\" content=\"2012-05-27T09:04:13+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2012-05-27T09:46:00+00:00\" \/>\n<meta name=\"author\" content=\"itibble@gmail.com\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@seven_stones\" \/>\n<meta name=\"twitter:site\" content=\"@seven_stones\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"itibble@gmail.com\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/\"},\"author\":{\"name\":\"itibble@gmail.com\",\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/#\\\/schema\\\/person\\\/dd7adbe0152f2279b133661b823e0c28\"},\"headline\":\"ZDnet’s Interview with Mikko Hypponen – “The current state of the cybercrime ecosystem” – Highlights\",\"datePublished\":\"2012-05-27T09:04:13+00:00\",\"dateModified\":\"2012-05-27T09:46:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/\"},\"wordCount\":966,\"commentCount\":0,\"articleSection\":[\"Blog\",\"Botnets\",\"CaaS\",\"Cybercrime\",\"Malware\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/\",\"url\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/\",\"name\":\"ZDnet's Interview with Mikko Hypponen - \\\"The current state of the cybercrime ecosystem\\\" - Highlights - Security Macromorphosis\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/#website\"},\"datePublished\":\"2012-05-27T09:04:13+00:00\",\"dateModified\":\"2012-05-27T09:46:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/#\\\/schema\\\/person\\\/dd7adbe0152f2279b133661b823e0c28\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"ZDnet’s Interview with Mikko Hypponen – “The current state of the cybercrime ecosystem” – Highlights\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/\",\"name\":\"Security Macromorphosis\",\"description\":\"Ian Tibble's Security Blog\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.seven-stones.biz\\\/blog\\\/#\\\/schema\\\/person\\\/dd7adbe0152f2279b133661b823e0c28\",\"name\":\"itibble@gmail.com\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4efc9caa4c914912bcf9dd199b33f34a0d42e56752f4f713cd8d0c5416733603?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4efc9caa4c914912bcf9dd199b33f34a0d42e56752f4f713cd8d0c5416733603?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/4efc9caa4c914912bcf9dd199b33f34a0d42e56752f4f713cd8d0c5416733603?s=96&d=mm&r=g\",\"caption\":\"itibble@gmail.com\"},\"description\":\"Author of Security De-engineering, CTO at Seven Stones (Indonesia)\",\"sameAs\":[\"http:\\\/\\\/www.seven-stones.biz\"]}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"ZDnet's Interview with Mikko Hypponen - \"The current state of the cybercrime ecosystem\" - Highlights - Security Macromorphosis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/","og_locale":"en_US","og_type":"article","og_title":"ZDnet's Interview with Mikko Hypponen - \"The current state of the cybercrime ecosystem\" - Highlights - Security Macromorphosis","og_description":"Last week Dancho Danchev interviewed Mikko Hypponen (CSO @ F-Secure) on the subject of CaaS (Cybercrime as a Service), the recent Botnet takedowns, and OPsec within cybercrime “organsations”. The questions from the interviewer occupied 3 times as much real estate … Continue reading →","og_url":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/","og_site_name":"Security Macromorphosis","article_published_time":"2012-05-27T09:04:13+00:00","article_modified_time":"2012-05-27T09:46:00+00:00","author":"itibble@gmail.com","twitter_card":"summary_large_image","twitter_creator":"@seven_stones","twitter_site":"@seven_stones","twitter_misc":{"Written by":"itibble@gmail.com","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/#article","isPartOf":{"@id":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/"},"author":{"name":"itibble@gmail.com","@id":"https:\/\/www.seven-stones.biz\/blog\/#\/schema\/person\/dd7adbe0152f2279b133661b823e0c28"},"headline":"ZDnet’s Interview with Mikko Hypponen – “The current state of the cybercrime ecosystem” – Highlights","datePublished":"2012-05-27T09:04:13+00:00","dateModified":"2012-05-27T09:46:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/"},"wordCount":966,"commentCount":0,"articleSection":["Blog","Botnets","CaaS","Cybercrime","Malware"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/","url":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/","name":"ZDnet's Interview with Mikko Hypponen - \"The current state of the cybercrime ecosystem\" - Highlights - Security Macromorphosis","isPartOf":{"@id":"https:\/\/www.seven-stones.biz\/blog\/#website"},"datePublished":"2012-05-27T09:04:13+00:00","dateModified":"2012-05-27T09:46:00+00:00","author":{"@id":"https:\/\/www.seven-stones.biz\/blog\/#\/schema\/person\/dd7adbe0152f2279b133661b823e0c28"},"breadcrumb":{"@id":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.seven-stones.biz\/blog\/interview-with-mikko-hypponen-the-current-state-of-the-cybercrime-ecosystem-highlights\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.seven-stones.biz\/blog\/"},{"@type":"ListItem","position":2,"name":"ZDnet’s Interview with Mikko Hypponen – “The current state of the cybercrime ecosystem” – Highlights"}]},{"@type":"WebSite","@id":"https:\/\/www.seven-stones.biz\/blog\/#website","url":"https:\/\/www.seven-stones.biz\/blog\/","name":"Security Macromorphosis","description":"Ian Tibble's Security Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.seven-stones.biz\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.seven-stones.biz\/blog\/#\/schema\/person\/dd7adbe0152f2279b133661b823e0c28","name":"itibble@gmail.com","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/4efc9caa4c914912bcf9dd199b33f34a0d42e56752f4f713cd8d0c5416733603?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/4efc9caa4c914912bcf9dd199b33f34a0d42e56752f4f713cd8d0c5416733603?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4efc9caa4c914912bcf9dd199b33f34a0d42e56752f4f713cd8d0c5416733603?s=96&d=mm&r=g","caption":"itibble@gmail.com"},"description":"Author of Security De-engineering, CTO at Seven Stones (Indonesia)","sameAs":["http:\/\/www.seven-stones.biz"]}]}},"_links":{"self":[{"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/posts\/66","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/comments?post=66"}],"version-history":[{"count":4,"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/posts\/66\/revisions"}],"predecessor-version":[{"id":71,"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/posts\/66\/revisions\/71"}],"wp:attachment":[{"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/media?parent=66"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/categories?post=66"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.seven-stones.biz\/blog\/wp-json\/wp\/v2\/tags?post=66"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}