Cyberheist Ch00 FM Finalv2.Indd Ii 4/12/11 7:58 AM the Biggest fi Nancial Threat Facing American Businesses Since the Meltdown of 2008
Total Page：16
File Type：pdf, Size：1020Kb
CyberHeist_Ch00_FM_FINALv2.indd ii 4/12/11 7:58 AM The biggest fi nancial threat facing American businesses since the meltdown of 2008 Stu Sjouwerman CyberHeist_Ch00_FM_FINALv2.indd iii 4/12/11 7:58 AM Publisher/Lead Author CYBERHEIST: The biggest fi nancial threat facing American Stu Sjouwerman businesses since the meltdown of 2008 Contributing Authors Copyright © 2011 KnowBe4. Naomi Alpern Justin Korelc All rights reserved. No part of this book may be reproduced or transmitted in Kim Lindros any form or any manner, electronic or mechanical, including photocopying, Jeff T. Parker James Pyles recording or by any information storage and retrieval system, without permis- Ed Tittel sion in writing from the publisher. Michelle Zavala Trademarks Trademarked names appear throughout this book. Rather than list the names Developmental Editor Kim Lindros and entities that own the trademarks or insert a trademark symbol with each mention of the trademarked name, the publisher states that it is using the names for editorial purposes only and to the benefi t of the trademark owner, Copyeditor with no intention of infringing upon that trademark. Kitty Wilson Warning and Disclaimer Every effort has been made to make this book as complete and as accurate Technical Editor as possible, but no warranty of fi tness is implied. The information provided Darril Gibson is on an “as is” basis. The authors and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss or damages Compositor and Graphic Artist arising from the information contained in this book. Kim Eoff This book is also published in a variety of electronic formats. Some content that appears in print may not be available in electronic books. Proofreader Kim Lindros KnowBe4 601 Cleveland Street Indexer Suite 930 Liz Cunningham Clearwater, FL 33755 Toll Free: 855-KNOWBE4 (566-9234) Cover Design www.KnowBe4.com David Brier, DBD International ISBN: 978-0-9834000-0-4 Cover Art Photographer Library of Congress Control Number: 2011904807 Alan Poulson Cover and Interior Printing and Published in North America by KnowBe4 Binding 10 9 8 7 6 5 4 3 2 1 Globus Printing CyberHeist_Ch00_FM_FINALv2.indd iv 4/12/11 7:58 AM This book is dedicated to all the sleepless cybercrime fi ghters in the world. You know who you are. Thanks very much for what you do. CyberHeist_Ch00_FM_FINALv2.indd v 4/12/11 7:58 AM CyberHeist_Ch00_FM_FINALv2.indd vi 4/12/11 7:58 AM Acknowledgments This project was a true team effort. My sincere thanks to all the people who helped bring my ideas to a tangible, cohesive book. This includes the following contributors: Naomi Alpern, Justin Korelc, Kim Lindros, Jeff T. Parker, James Pyles, Ed Tittel, and Michelle Zavala. Ed Tittel also designed and reviewed this book’s entire contents. The production team included these fi ne people: Kitty Wilson, copy editor; Darril Gibson, technical editor; Kim Eoff, layout design, compositor, and artist; Liz Cun- ningham, indexer; and Kim Lindros, who wore several hats, including proofreader and project manager. David Brier, DBD International, did the cover design, and the cover art photographer was Alan Poulson. My sincere thanks to everyone who ever worked at Sunbelt Software and who helped to make us the Inc. 500 Success that we were. That was a great run! vii CyberHeist_Ch00_FM_FINALv2.indd vii 4/12/11 7:58 AM About the Author Stu Sjouwerman (pronounced “shower-man”) has been in Information Technology for 30+ years, the last 9 of which were in IT Security. As a co-founder of Inc. 500 company Sunbelt Software, he has been specializing in antispyware products since 2003. A few years later, Sunbelt developed antivirus software, integrated a fi rewall, and at the same time developed antispam software for both consumers and enterprises. In 2010, Sunbelt was sold to GFI software, a portfolio company of Insight Partners, a $3 billion Boston-based hedge fund. This is Stu’s fourth book. He has co-authored three books about Windows system admin- istration, the fi rst being Windows NT Power Toolkit. Released in October 1999, this book reached #4 on Amazon.com’s USA bestseller list the fi rst week of its release and #1 in the UK. In 2003, a new book about Windows XP was published. The second and third books also reached Amazon’s Top 10 List. Since 1996, Stu has been the Editor-in-Chief of WServerNews, an email newsletter that goes to 100,000 IT system administrators and helps them to keep their systems secure, and up and running. Stu is now serving as publisher and editor of GFI Media Services, a division of GFI that produces four major online newsletters, including WServerNews, WXPnews, Win7News, and GFISecurityNews. These newsletters are tailored to deliver up-to-date tech- nology information to both consumers and enterprises. After having been on the software side of security, and still seeing workstations getting infected by malware, Stu realized that the human element of security was being neglected. He decided to start a new company called KnowBe4 that helps organizations train their employees to stay secure on the Internet. He lives in the Tampa Bay, Florida, area with his wife Rebecca and their three cats. viii CyberHeist_Ch00_FM_FINALv2.indd viii 4/12/11 7:58 AM Table of Contents Part 1 The Business of Cybercrime 1 Chapter 1 What Drives Cybercrime? ..................................3 What Exactly Is Cybercrime? ...............................................................4 Who’s a Target for Cybercrime? ......................................................5 A Million Stories for a Million Scams .....................................................8 A Case of Criminal Culture ..................................................................9 Cybercrime Learning and Lore ......................................................10 Variations on a Scamming Theme ..................................................11 Internet, and the Money Is Easy ..........................................................12 Offshore Has Defi nite Virtues—and Vices .......................................12 Avoiding Exposure to Avoid Losses ................................................13 Chapter 2 How and Why Scams Survive, Thrive, and Succeed .................................................. 15 The More You Try to Scam, the Better the Odds of Succeeding ...............16 Persistence and Variety .................................................................16 A Successful Scam Spawns Countless Imitations ...................................17 Old Scams Finding New Victims....................................................17 Simple Technology Tricks Reap Major Results .......................................19 Trust Few, Share Little ...................................................................19 A Little Knowledge Is Indeed Very Dangerous .......................................20 Taking Advantage of Human Nature and Gullibility ..............................21 Common Traits of Fraud Victims.....................................................22 Chapter 3 Types and Methods of Attacks .........................23 The Social Side of Attacks ..................................................................23 You’ve Been Engineered … Socially, That Is! ...................................24 Social Engineering Tools and Tricks................................................25 Anatomy of a Blatant Phishing Attack ..................................................25 Examining the Source Code ..........................................................27 ix CyberHeist_Ch00_FM_FINALv2.indd Sec1:ix 4/12/11 7:58 AM x Table of Contents The Technical Side of Attacks .............................................................28 Disguise and Conquer ..................................................................29 Hidden and Malicious Payloads ....................................................29 The Mechanics of Drive-by Downloads ...........................................30 Information Harvesting ......................................................................30 Chapter 4 Phishing Explored and Explained .....................33 The Basic Laws of Phishing .................................................................34 Imitate ........................................................................................34 Motivate .....................................................................................34 Take Action Now! ........................................................................34 Attack Anatomy 2: A Well-Done Phish .................................................35 The First Surprise: Steganography .................................................35 The Second Surprise: A Malicious Attachment .................................37 Telltale Signs in a Sophisticated Attack ...........................................38 URL Shortening: The Good and Bad ....................................................39 Surefi re Ways to Avoid Phishing .........................................................40 Chapter 5 Variations on the Phishing Theme: Smishing and Vishing ...................................... 41 The Basic Mechanics of Phishing ........................................................41 What Criminals Want from Victims ................................................42 How Criminals Lure Victims ...........................................................42 How Criminals Profi t from Data Theft ..............................................42 Anatomy of a Smishing Attack ............................................................43