The carefree life of cyber criminals

Johannesburg, 13 Jun 2000

If you sometimes wonder why the occasional virus slips through, consider this: Trend Micro, an anti-virus vendor, receives over 500 new viruses a month, or 6 000 a year! The specific numbers of new viruses so far this year are:

January: 466 - 15 new viruses/day
February: 631 - 21 new viruses/day
March: 385 - 13 new viruses/day
April: 610 - 20 new viruses/day
May: 414 - 14 new viruses/day

Cyber crime history is being made. Jason Garon, a 46-year-old from California, used the computer systems of Max Vision, a New York state company, to send millions of e-mail advertisements for porn sites. He has been arraigned on charges of forgery and computer tampering. He could be sentenced to up to seven years in prison. This is the first case involving online forgery in the US.

Or take the example of an online thief who stole credit card numbers from CD Universe. He is still at large but even if tracked down, it is unlikely he could be prosecuted. The evidence collected in the case was not handled properly; it seems the chain of custody was broken. Network Associates, Kroll O`Gara and Infowar.com were all involved in the investigation of CD Universe`s network. Good procedural police work is indispensable, whether in the real or virtual world.

If we can`t prosecute people for highly visible and preventable PC virus action, how are we going to take action when the instrument being targeted is the ubiquitous cellphone?
Ian Melamed, ITWeb columnist

On the other side of the world, lawmakers are finding they have no leg to stand on when it comes to arresting virus writers, let alone prosecuting or jailing them. The 27-year-old bank employee suspected in the Love Bug virus case has been freed because there is no law there under which he could be prosecuted. Despite the enormous damage he caused in the Philippines and across the world, he did nothing illegal. This highlights again the inadequacy of existing legislation in trying to deal with the new type of crime being perpetrated around the world. South African law does make provision for prosecution along the lines of malicious damage to property, but it has yet to be tested in court.
If we can`t prosecute people for highly visible and preventable PC virus action, how are we going to take action when the instrument being targeted is the ubiquitous cellphone? Last week we had the Timofonica worm raise its head in Spain. A virus author - apparently upset with the telephone monopoly in Spain (and who isn`t upset with telephone monopolies?) - reached out and touched cellphone users. The first text-paging worm started spamming users of the cellphone system operated by the Spanish phone company Telefonica. Timofonica didn`t infect cellphones, but it`s only a matter of time before we will see viruses that do.

Of even greater concern is the fact that we are about to begin relying on Wireless Application Protocol (WAP) and its successors for mobile business. Mobile phones aren`t powerful enough yet to receive executable attachments and therefore support viruses. However, this may change as WAP grows and mobiles grow in processing capability. The whole e and m pyramid is starting to look as if it`s built on rather shaky foundations.
If we look at some world leaders` reaction to the issue of cybercrime, we begin to understand just what`s going on. Consider the following report from online news bureau Silicon.com. The agency reports that recently a number of top people from the most important nations in the world gathered in Paris to discuss cybercrime. After three days of meetings, these men from the G8 countries agreed to swap e-mail addresses. A delegate was interviewed and responded: "Hacking is a very serious civil and criminal issue. But no, we have not made plans on how to tackle it, but it is on the agenda and we`ve all exchanged e-mail addresses."
But help is on its way so don`t fret. Microsoft has produced a patch for Outlook which should prevent any further Love Bug-style attacks. The patch will restrict access to .vbs, .exe and other types of files that could contain malicious code, and will block unauthorised access to Outlook`s address books.

Security Patrol snippets were gleaned from Associated Press, Fox News, CNN, MSNBC, Silicon.com and Hacker News Network.