7 ms·

The low, low cost of committing cybercrime

125 points by freedude 3y ago

kwant_kiddo 3y ago
A bigger problem for me personally is the high cost of reducing developer productivity and increasing operational risk just for the sake of cyberponies trying to defend their job. Also I am not so sure the cost is that low. Well for phishing attacks maybe, but what is the return here?? Many skilled people had been caught doing 'cybercrime'. I just think if you compare this to e.g. tax-fraud then I would expect the risk/reward to be much higher than doing phishing attacks.
- pixl97 3y ago
  >A bigger problem for me personally is the high cost of reducing developer productivity and increasing operational risk just for the sake of cyberponies trying to defend their job. This is why programmers are not licensed engineers, and I have my doubts about being a serious engineering profession. "Oh, the bridge fell down and killed 15 people, but it was worth it because I built a lot of bridges this week"
  - cdchn 3y ago
    Lower stakes having looser tolerances is an engineering trade-off.
    - xmprt 3y ago
      I think programmers should re-evaluate the stakes that they're playing with. Even seemingly inconsequential things can have pretty large impacts at the scale that programmers operate. For example, if a form that you write doesn't properly support unicode characters then you might have just locked out millions of people from non western countries from using your software. And even worse, if you're building a "tiny low stakes" piece of a much larger software then you might end up accepting money from those paying customers who can no longer use your software because your form doesn't work for them. (I've had this happen to me personally). And then people don't bother fixing it because it's only 0.01% of the userbase.
      - noirbot 3y ago
        But isn't that part of the poor comparison with other sorts of engineering? If I build a bridge or design a machine, I have a pretty good idea of who will use it and for what, and it's engineered for those use cases, and some reasonable edge cases. Plenty of medical and chemical engineering isn't tested on anything close to the breadth of humanity that could be harmed or excluded from using it. There's plenty of "engineered" products that are designed in ways that don't support unicode or international electrical systems, or other factors that exclude "millions of people from non western countries", but they also just don't sell those products outside of western countries. Just because I put something on the internet doesn't mean I'm thus required to support literally the entire planet's use of it, and I don't think that's "stakes". Sure, if your company has a Korean division and you forget to have Unicode support, that's a problem, but if you work for a regional company in Virginia, it doesn't seem like some failing of professional responsibility to not support Unicode in my forms.
        xmprt 3y ago
        So wouldn't you agree that in a sense, the stakes for programming is much higher? Because you can have a global impact just by putting something on the internet, I think programmers should take more care into the work that they do and not less.
        Kamq 3y ago
        > So wouldn't you agree that in a sense, the stakes for programming is much higher? That doesn't mean the stakes are higher. It means the potential upsides are higher. The potential downsides are also much lower (a bad website will rarely kill someone). The combination of these two incentivize bringing in as many people as possible, even if standards suffer because there's almost no downside (civilizationally speaking, companies do occasionally lose quite a bit of money).
        xmprt 3y ago
        > A bad website will rarely kill someone That's probably true although I think eventually, that kind of callous line of thinking might actually get someone indirectly killed because programmers don't worry about the impact of their code. A less severe (although in my opinion still live changing) problem is having an unusual name making it harder to book flights. Another example where having a NULL license plate got someone thousands of tickets [1]. Or IP addresses getting mapped to locations where they actually don't come from and now someone's house is getting searched because "their IP had illicit activity". Coding probably won't kill someone but I still don't think it's low stakes. [1] https://www.wired.com/story/null-license-plate-landed-one-hacker-ticket-hell/ https://www.wired.com/story/null-license-plate-landed-one-ha...
    - Avamander 3y ago
      Those stakes are often misjudged or simply ignored. Nobody cares if a thing takes 10000x more time than it could if it works, right? Boom, you just wrote Windows Update that wastes centuries of human time each day. And we haven't even gotten to all the effort that is wasted due to insecure software, hacked devices and leaked data.
    - mannykannot 3y ago
      It is, but if you get it wrong, you can really screw things up. Not trying to get it right is not engineering, and just hoping you get it right is not trying.
    - alpaca128 3y ago
      Software can have high stakes very quickly even if you don't expect it. Like that time hundreds of UK post office workers were fired (and worse) because higher-ups decided the faulty IT system was more trustworthy than hundreds of people. And that's still rather harmless compared to what's possible.
  - Kamq 3y ago
    > I have my doubts about being a serious engineering profession. It's not. If it were, vaguely talented amateurs wouldn't run circles around people with degrees. But to get it to that level, we'd have to figure out 1. how to teach it, and 2. how to measure it. 1 is probably more important, but you can't really have a licensed profession when the students being educated don't actually know how to do the job that you're licensing. You would have to set the standards so low that it would be a useless license.
    - flakeoil 3y ago
      I don't think the standards have to be low, but the software engineering field would have to be narrowed down. Only teach and use a certain few languages, only use certain tools, only use certain patterns, only use a specific few frameworks etc. That's basically what construction engineering is. There are many ways to build a house, but only a few that are approved and accepted. It could maybe work, although new inventions would be slow to catch on. A bit like in construction engineering today. Maybe for some security related tasks it should be a requirement in some cases. A bit like software for airplanes and trains etc.
      - Kamq 3y ago
        > I don't think the standards have to be low Based on what you've described, I disagree. Most colleges have already winnowed things down to teaching in only one or two languages. Usually java and python. And from what I've observed, most students still don't learn much. We, as a field, don't know how to teach people to code. The closest we've gotten is showing people what an if statement and a loop are, show them a couple examples, and then tell them to screw around for a while until it clicks. And for some of them it does. If you want standards to be higher than a random teenager who screws around for a summer, this has to change. Or you have to accept that ~75% of college graduates are not going to be able to go into their profession.
  - Nursie 3y ago
    > "Oh, the bridge fell down and killed 15 people, but it was worth it because I built a lot of bridges this week" Not everything non-software engineers do is life or death either, and there are plenty of software people who do work in critical areas that don't have that attitude. This oft-repeated view is a caricature. Licensed engineers make all sorts of crappy consumer goods that fail all over the place. Conversely, there are software engineers involved in medical devices, defence and various other spheres that follow very risk-averse, formalised coding, verification and release procedures. The fact that a lot of consumer-oriented software is insecure, flakey crap is a consequence of time pressure and risk tolerance, as well as nebulous or amorphous requirements. Should I release this now, and try to capture the market, move fast and break things, adapting functionality as I go, with quality important but not that important? Or should I spec out a complete and formal design, maybe formally verify it, implement to that spec and thoroughly validate it all afterwards? There'll be no product for five years but that's OK. This latter category does exist, but isn't especially visible because it's not very sexy, it doesn't have 'hero' engineers, and there are few techbros getting rich off it.
  - exclusiv 3y ago
    > This is why programmers are not licensed engineers, and I have my doubts about being a serious engineering profession. You're conflating two different things. Coding and programming does not make one an engineer. Just like assembling a bridge does not make one an engineer. Or building a house, an architect. On the other hand, actual software engineering can be a serious engineering profession. As serious as any other engineering form.
    - almostnormal 3y ago
      Bridges don't usually fail because some worker layered some reinforcement wrong before covering it in concrete, but by issues on the engineering side. Some software issues are caused by engineering, but most of them are just some implementation detail like an "!" in the wrong place.
      - exclusiv 3y ago
        > Some software issues are caused by engineering, but most of them are just some implementation detail like an "!" in the wrong place. Yes most of them (by the numbers) because software is more complicated than a bridge which has been a solved problem for a long time and because even the worker bees that write code have a more serious relationship with the software than someone pouring concrete in construction, which is also already a solved problem and for the most part - has one true way to do it, unlike software. If you have proper quality control and budgets for that, then we'd have a lot less bugs that you are talking about. I don't get your point though. You are saying software is so easy it's not real engineering and software fails because some coder screwed up? I don't buy that. The success of every project comes down to quality engineering which encompasses a lot of things that are outside of just the part of the job called coding (budget, schedule, requirements gathering, build, quality control, risk mitigation, redundancy, ongoing monitoring, hosting/infrastructure, maintenance, etc). A civil engineer is more of an engineer than a coder (which isn't an engineer) which is the conflation that caused my prior post. However, a civil engineer is NOT more of an engineer than a real software engineer. I'd submit the opposite and the market agrees. And if you don't believe that then you will eventually when there are more catastrophic failures in critical software. Probably AI or self driving cars when the stakes are higher. If it's a dumb bug as you allude to, that won't make it less of an engineering discipline. It would make it more. I can't even believe there is debate about software engineering being a thing with all the incredible things that have been built.
  - Attrecomet 3y ago
    Software engineers shouldn't be, and shouldn't want to be, licensed engineers. Being licensed a pain in the ass, a huge bureaucracy (have fun learning about thousands of ISO standards for trivial stuff for your license) and stifles innovation. We accept certain jobs requiring bureaucratic oversight because the effects of too low standards are unacceptable to us, but repeat with me, "licensing is a necessary evil, not a good in itself". It's ridiculous to demand that every library author or writer of a corporate website be licensed.
- gustavus 3y ago
  And a bigger problem for me is the high cost of losing my job when some code cowboy leaks a bunch of people's data and passwords because "md5" was already in the standard library and easy to use. Or someone replaced all the pictures on the website with hentai because a developer found this "really cool GitHub project" that saved him the hassle of "having to learn regex" or decided to outsource a bunch of customer analytics to "this really cool startup I saw on ycombinator. No I just paid with the company pcard, no I didn't read the privacy and data documents those are boring." It's a funny worl like that. EDIT Or the developer who put the CORS to '*' because that was the only way to make it work on my machine. Or "Why is this random Serbian guy currently admin in our AWS account?" "Oh that's gavrilo great guy he was one of the front end guys we brought in back a couple of months ago to finish a project. We couldn't figure out the permissions to the s3 bucket though so we just gave him admin rights. Should probably get around to removing his access. Cool dude though although he had problems with the Asutrians for some reason."
  - thriftwy 3y ago
    Love the WWI reference.
  - guhidalg 3y ago
    Great username BTW
- bezier-curve 3y ago
  I can get on board with education about social engineering hack attempts, but the amount of spyware on my work machine feels like institutionalized cyber crime. I have work that is I/O intensive, and the third party AV makes sure that's as slow as possible.
- rufus_foreman 3y ago
  What's a cyberponie?
  - Anthony-G 3y ago
    I tried using different different search engines as I’m not always hip to Internet slang but nothing useful shows up: https://duckduckgo.com/?t=ftsa&q=%22cyberponie%22&ia=web https://duckduckgo.com/?t=ftsa&q=%22cyberponie%22&ia=web That commenter doesn’t seem to have put much effort into articulating their thoughts clearly.
- deleted 3y ago
  [deleted]
- MattPalmer1086 3y ago
  Right. That's why we see almost no successful malware or cybercrime these days, and all the cyber criminals are going out of business /s.
- red-iron-pine 3y ago
  All security is a balance between risks and costs, in this case productivity. If I believe the Verizon DBIR reports -- and I do -- around 20% of breaches are straight up errors, screw-ups, and accidental disclosures. After that it's hacking web applications, at around 30% of the breaches. Keeping these things from happening starts on the developer level, and if I find out a software suite that I'm using in the Enterprise ain't doing their security due-diligence then they're fucking gone, like ASAP; security for highly vetted, well-protected systems is hard enough, and those people are trying. > Many skilled people had been caught doing 'cybercrime' There is getting in, getting out, and getting in and out cleanly. Just cuz they didn't get out cleanly and got arrested -- eventually; could be 4 years later -- it doesn't mean they can't do massive damage until then. Shutting down work, destroying data, exposing secrets, whatever. And these are the ones that you can arrest, cuz plenty of them won't be in countries that will extradite.
sublimefire 3y ago
The title is misleading. It should be called "The low, low effort of ...". There is no dollar value expressed in conducting such a simple attack. One needs to buy emails, then setup dns and host the files on some servers. How do you pay for those servers? There are a bunch of interesting parts of this that were just not covered in the article nor there was any attempt to show the actual cost, nor did it prove it is actually cheap. The cost would be dictated by the amount of valuable emails you have and the ability to squeeze them into one campaign (minus the effort).
- CharlesW 3y ago
  > There is no dollar value expressed in conducting such a simple attack. "Cost" encompasses things like effort, loss, and sacrifice too.
  - john-radio 3y ago
    For crimes where the criminal's "happy path" result is to take somewhere from $50 to $50,000, you'd expect that the most important cost element would be risk of getting caught and punished, although I have the impression that enforcement is not actually that strict.
    - thayne 3y ago
      That risk is practically zero, especially if you are operating out of a country that won't extradite to the country of your targets.
      - throwaway290 3y ago
        Remember Ukrainian cybercriminal that was caught when he crossed into Poland? Yeah you will need to remember to never go to any of those countries for the rest of your life. If criminal wants ever to live a nice lifestyle (which is probably why become criminal right?) then getting caught is high cost
- placebo 3y ago
_8j50 3y ago
A handful if times, I was able to track down the guy distributing (not authoring) the malware via social media, youtube,discord, github and more (even opened a github issue respectfully asking them to stop distributing malware) and I was able to find the country they live in as well as their name (even a home address and cellphone in one case). I mention this because even with all that info there isn't much I can do that would be worth doing to take action against them. I have filed IC3 FBI complaints for far worse and they don't even so much as reply. I can get an "industry contact" to get me to relay that to an actual special agent but it would have to be something highly impactful like a ransomware, I can't do that for every small time crimeware I find. Jurisdictions like Russia have a policy of looking the other way as well so long as you look the other way and in some countries, just having actual cybercrime laws and then the diplomatic relation strong enough to cooperate with their cops can be rare to find. But focusing on the cost alone is a mistake, threat actor cost-benefit analysis is key here. In the 80s and early 90s for example, big cities were a crime horror show because cops couldn't catchup enough and the reward, relative to potential reward of law abiding life was dismal compared to today (well, that and lead babies!). I don't believe stop-and-frisk or "broken windows" policing made a difference nowhere near as much as better opportunities, entertainment, education and economy as well as "the internet" and tech making it harder to get away with crime did.
cowsup 3y ago
Absolute art for the article itself to have comments, and for those comments to all be spam.
- Andrex 3y ago
  Spam isn't necessarily cyberly-criminal.
  - nine_k 3y ago
    But it's the epitome of mass low-cost evil.
- deleted 3y ago
  [deleted]
sublinear 3y ago
Off topic, but the stylesheet for this page is just a couple of tweaks away from not being unreadable trash on mobile. I don't understand how in 2023 some sites still insist on using fixed minimum values instead of just adjusting the layout for narrow viewport widths in a media query. The images just need properly scaling thumbnails, and the gutters around the single column of text need to go away.
- deleted 3y ago
  [deleted]
metaphor 3y ago
The actual blog post: https://isc.sans.edu/diary/The+low+low+cost+of+committing+cybercrime/30176 https://isc.sans.edu/diary/The+low+low+cost+of+committing+cy...
- emmelaich 3y ago
  Thanks. The submission url is "Poisoning the Honeypot Download Logs"
- dang 3y ago
  We've switched to that from https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0. Thanks! I think the problem was that the OP contains https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0 as its canonical URL.
  - r721 3y ago
    I think that's currently a problem with all isc.sans.edu URLs: https://news.ycombinator.com/from?site=sans.edu https://news.ycombinator.com/from?site=sans.edu
    - metaphor 3y ago
      Naw, it just looks like the same submitter, freedude, has been submitting the same temporal top-level over the past month rather than linking to each blog post's static address directly.
      - pvg 3y ago
        You can see that it's happened to other users plus the wrong canonical URL (which HN fishes out of the HTML) is on all of their individual pages.
      - r721 3y ago
        I just recalled that I had a similar problem with HN autoreplacing isc.sans.edu URL to wrong one (though the error was different then, in 2022): https://news.ycombinator.com/item?id=29917559 https://news.ycombinator.com/item?id=29917559
paulpauper 3y ago
it's not that cheap. a good botnet will run you thousands of dollars a day. good proxies in bulk not cheap either.
- ozim 3y ago
  People run crimeware as service and getting it for some time is not that expensive. You don’t have to have your own botnet.
two_in_one 3y ago
BTW, I suspect there is a new (to me) type of scum in US. Nonames are trying to 'collect' debts pretending to have some rights. They get fresh info on possible targets on black market.
- gmerc 3y ago
  Definitely not new.
  - H8crilA 3y ago
    And it even works against corporations, sometimes.
- rambambram 3y ago
  > trying to 'collect' debts pretending to have some rights How? By sending letters? By coming to your door?
  - indymike 3y ago
    By tricking people into affirming a paid off, non-existent or expired debt and then attempting to collect it.
  - two_in_one 3y ago
    Going to court, probably, if it's enforceable. Otherwise only online/offline harassment.
- red-iron-pine 3y ago
  they don't need to get them off the black market; banks, credit card companies, etc. will sell the debt and info to debt collectors, openly. no need to fire up tor, you can buy this info for reasonably cheap. presumably someone hacked it and tossed it on Dread or something?
darkclouds 3y ago
> they target pretty much everyone, and nothing demonstrates this better that generic, “un-targeted” phishing e-mails. Had to stop there, this is written like its a given, that there is no way to avoid phishing emails when there is. There's plenty of ways and alot of the criminality is maintained by those who dominate the sector, via standards or solutions. >either immediately or very soon after they are delivered to their first recipients – detected and blocked by any security solution worth the name I've always been taught ignorance of the law is no defence of the law, so unwarranted data sharing is ignoring various laws. "Articles 13 and 14 of the GDPR require you to tell data subjects who you share the personal data with (the recipients or categories of recipients of the personal data)." The email systems and associated security products, namely anti spam and anti virus software/services are knowingly breaking the law with a recipient that chooses to employ said service to scan their emails. Everybody on the planet who has an email address and an AS/AV scanner is breaking the law, but I guess hypocrisy can be overlooked even in the best educational establishments, whilst ignoring the ill thought out nature of law in a global world. >JavaScript loaded from the external domain was not as simple as the rest of the attack (it was heavily obfuscated and "weight in" at 155 kB) I guess dialup is still an issue for some. >Proving that the cost of committing cybercrime can be really low. I'll agree on that.
grodes 3y ago
Horrible website format, it just uses like 25% of my screen width to render text
- popcalc 3y ago
  Almost as bad as the new Github.
mbwgh 3y ago
I am probably going to get flak for this, but this "scam flow" including a forged Microsoft login, is pretty much the problem I had when I first encountered OAuth and the "Login with XY" concept. Aside from the fact that I can't keep the way the auth flow works in my head for longer than 2 days before my understanding of it becomes fuzzy again, a layman is not supposed to understand what's going on at all. Because if they were, they would ask "does this service get my XY password if I enter it here?" and unfortunately, trying to get this answer will lead them down a rabbit hole of auth flows, OAuth2 vs. OpenIDConnect and whatnot, because it's only ever documented for implementers. The normal user is to just believe in its trustworthiness, which may on a technical level be warranted or not, that's not the point. If you keep logging in with XY to different services, you become conditioned to not question anymore whether it's correct to enter your password right now, and where the login form, which always looks the same across different services, comes from. But oh well, I don't know what the solution should be here, maybe mandatory 2FA yet again, or passkeys. The market will decide.
- rightbyte 3y ago
  > I don't know what the solution should be here A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Google" is spyware. I want 2FA for my bank only.
  - larsla 3y ago
    "Login with X" is OAuth, not 2FA. 2FA is a great addition on top of a password per site. Neither a FIDO device nor an Authenticator app provides the site with any extra PI. Edit: SMS would give them your phone number, but SMS is a really bad 2FA and should not be used
  - indymike 3y ago
    I'm not so sure this is the case. Even less safe 2FA like SMS and email seems to prevent a whole host of cheap attacks. TOTP is much better and can be as anonymous as your login is. What is sad is that misuse of 2FA data is rampant and causes people to think (rightfully so) as you do.
keiferski 3y ago
One of the more interesting aspects of early sci-fi that hasn’t made it into reality (yet) is ICE, or security systems that “bite back” with physical feedback, pain, and potentially death. If body interfacing tech continues to develop and cybercrime becomes increasingly prevalent, this does seem like a possibility in a few decades. https://en.wikipedia.org/wiki/Intrusion_Countermeasures_Electronics https://en.wikipedia.org/wiki/Intrusion_Countermeasures_Elec...
- pingou 3y ago
  How would that work? Why would a hacker ever enable those features on his local hardware?
  - saiya-jin 3y ago
    Maybe with direct neyrosynaptic link they would have no way to block their hacked hardware behavior. Assumes ICE will be more advanced/faster than hacker itself
    - deleted 3y ago
      [deleted]
  - keiferski 3y ago
    Presumably the Net would somehow require physical feedback in order to browse and participate. Or, the functionality would be available (but not required) and ICE would counter-hack the hacker and overpower his local hardware settings and enable the feedback. A more contemporary example might be something like headphones: as far as I know, limits on sound output are software-based, not hardware. Theoretically a hacker could modify these software limits and output extremely loud sounds. > Gadgets can be hacked to produce 'dangerous' sounds, says researcher https://www.bbc.com/news/technology-49291665 https://www.bbc.com/news/technology-49291665
    - dale_glass 3y ago
      > A more contemporary example might be something like headphones: as far as I know, limits on sound output are software-based, not hardware. Theoretically a hacker could modify these software limits and output extremely loud sounds. Seems pretty much impossible. True, my headphones could be modified for it. In fact I once looked into the firmware of a previous model, and apparently there was 16MB RAM, 2 cores, and sqlite in there. The darn thing could run DOOM if there was a display attached. But an application doesn't get to talk Bluetooth to my headphones, it only gets to submit audio. Besides that, audio is logarithmic. If the internal amplifier can produce 2X of the software limit, that only adds 3db. Maybe annoying, but nowhere near bad enough to do serious harm.
aetherspawn 3y ago
Can’t wait for everything to be FIDO2 and security keys (phishing proof) and for these people to go get real jobs flipping burgers or something where their employers withhold their taxes…
- anonymousDan 3y ago
  Not too au fait with FIDO2 details. How exactly would i help in this instance if the the user believes they are entering their details into a valid MS form? Is it that the attacker would only be able to log in once?
  - Dachande663 3y ago
    AFAIK webauthn uses the domain as passed from the browser. So user might see micorsoft.com, but to the device it's a different domain so it won't pass on the keys.
mschuster91 3y ago
> To my mind, the old proverb “opportunity makes the thief” describes the main issue with cybercrime quite well – the internet is a very “target-rich” environment, and it is incredibly easy/cheap to create a simple piece of malicious code or launch a basic attack. It's also consequence-free. You can do on the Internet whatever the fuck you want, but unless you anger the wrong people (e.g. you hack a mega corporation or a hospital) nothing will be done. A large part of the "cheapness" of cybercrime is that even though we know where a lot of the bad agents are coming from: - enemy nation states like Iran, North Korea, Russia and China where the government itself has hacker groups or tolerates their activity - neutral nations like India or Turkey where local law enforcement is bought off by scammers and other criminals so the masterminds get warned of raids in time - domestic agents like ISPs who don't give a shit about abuse reports if there is no legal liability attached to them (i.e. everything but CSAM and copyright) because they don't bother to hire enough qualified staff to follow up on reports and get bad actors (e.g. people with compromised IoT or other devices) cleaned up or disconnected ... absolutely nothing is done against them, even if identified. And on top of that: if you drive an unsafe car on the road, you'll get fined for being a danger to other motorists. If you have an Exchange server not patched in years reachable from the Internet, you're a danger to other systems on the Internet, and yet nothing can be done against you. Our collective governments need to get their act together: nation states must be told to either clean up their act or get disconnected from the Internet and the global financial system, ISPs must face regulation requiring at most 6h response time for abuse reports and evidence of corrective action taken, and people being grossly negligent in keeping up with patches must feel consequences. It's time for the laxness towards criminals and bad actors to end once and for all. We don't tolerate gangs of bullies intimidating grandmas on the street into extortion schemes, we shouldn't allow their cyber equivalents to do the same.
- red-iron-pine 3y ago
  > It's also consequence-free. You can do on the Internet whatever the fuck you want, but unless you anger the wrong people (e.g. you hack a mega corporation or a hospital) nothing will be done. definitely not consequence free if you don't know how to cover your tracks, and only consequence free if you're in a country that doesn't extradite. Iran / Russia / NK / China / etc. can play dirty because they're moving on a nation-state level and geo-politics, up to and including nuclear weapons, are a discussion topic. The average kidde re-using Indrik Spider code is gonna get some easy wins but will eventually get nailed.

125 points by freedude 3y ago

A bigger problem for me personally is the high cost of reducing developer productivity and increasing operational risk just for the sake of cyberponies trying to defend their job. Also I am not so sure the cost is that low. Well for phishing attacks maybe, but what is the return here?? Many skilled people had been caught doing 'cybercrime'. I just think if you compare this to e.g. tax-fraud then I would expect the risk/reward to be much higher than doing phishing attacks.

pixl97 3y ago
>A bigger problem for me personally is the high cost of reducing developer productivity and increasing operational risk just for the sake of cyberponies trying to defend their job. This is why programmers are not licensed engineers, and I have my doubts about being a serious engineering profession. "Oh, the bridge fell down and killed 15 people, but it was worth it because I built a lot of bridges this week"
- cdchn 3y ago
  Lower stakes having looser tolerances is an engineering trade-off.
  - xmprt 3y ago
    I think programmers should re-evaluate the stakes that they're playing with. Even seemingly inconsequential things can have pretty large impacts at the scale that programmers operate. For example, if a form that you write doesn't properly support unicode characters then you might have just locked out millions of people from non western countries from using your software. And even worse, if you're building a "tiny low stakes" piece of a much larger software then you might end up accepting money from those paying customers who can no longer use your software because your form doesn't work for them. (I've had this happen to me personally). And then people don't bother fixing it because it's only 0.01% of the userbase.
    - noirbot 3y ago
      But isn't that part of the poor comparison with other sorts of engineering? If I build a bridge or design a machine, I have a pretty good idea of who will use it and for what, and it's engineered for those use cases, and some reasonable edge cases. Plenty of medical and chemical engineering isn't tested on anything close to the breadth of humanity that could be harmed or excluded from using it. There's plenty of "engineered" products that are designed in ways that don't support unicode or international electrical systems, or other factors that exclude "millions of people from non western countries", but they also just don't sell those products outside of western countries. Just because I put something on the internet doesn't mean I'm thus required to support literally the entire planet's use of it, and I don't think that's "stakes". Sure, if your company has a Korean division and you forget to have Unicode support, that's a problem, but if you work for a regional company in Virginia, it doesn't seem like some failing of professional responsibility to not support Unicode in my forms.
      - xmprt 3y ago
        So wouldn't you agree that in a sense, the stakes for programming is much higher? Because you can have a global impact just by putting something on the internet, I think programmers should take more care into the work that they do and not less.
        Kamq 3y ago
        > So wouldn't you agree that in a sense, the stakes for programming is much higher? That doesn't mean the stakes are higher. It means the potential upsides are higher. The potential downsides are also much lower (a bad website will rarely kill someone). The combination of these two incentivize bringing in as many people as possible, even if standards suffer because there's almost no downside (civilizationally speaking, companies do occasionally lose quite a bit of money).
        xmprt 3y ago
        > A bad website will rarely kill someone That's probably true although I think eventually, that kind of callous line of thinking might actually get someone indirectly killed because programmers don't worry about the impact of their code. A less severe (although in my opinion still live changing) problem is having an unusual name making it harder to book flights. Another example where having a NULL license plate got someone thousands of tickets [1]. Or IP addresses getting mapped to locations where they actually don't come from and now someone's house is getting searched because "their IP had illicit activity". Coding probably won't kill someone but I still don't think it's low stakes. [1] https://www.wired.com/story/null-license-plate-landed-one-hacker-ticket-hell/ https://www.wired.com/story/null-license-plate-landed-one-ha...
  - Avamander 3y ago
    Those stakes are often misjudged or simply ignored. Nobody cares if a thing takes 10000x more time than it could if it works, right? Boom, you just wrote Windows Update that wastes centuries of human time each day. And we haven't even gotten to all the effort that is wasted due to insecure software, hacked devices and leaked data.
  - mannykannot 3y ago
    It is, but if you get it wrong, you can really screw things up. Not trying to get it right is not engineering, and just hoping you get it right is not trying.
  - alpaca128 3y ago
    Software can have high stakes very quickly even if you don't expect it. Like that time hundreds of UK post office workers were fired (and worse) because higher-ups decided the faulty IT system was more trustworthy than hundreds of people. And that's still rather harmless compared to what's possible.
- Kamq 3y ago
  > I have my doubts about being a serious engineering profession. It's not. If it were, vaguely talented amateurs wouldn't run circles around people with degrees. But to get it to that level, we'd have to figure out 1. how to teach it, and 2. how to measure it. 1 is probably more important, but you can't really have a licensed profession when the students being educated don't actually know how to do the job that you're licensing. You would have to set the standards so low that it would be a useless license.
  - flakeoil 3y ago
    I don't think the standards have to be low, but the software engineering field would have to be narrowed down. Only teach and use a certain few languages, only use certain tools, only use certain patterns, only use a specific few frameworks etc. That's basically what construction engineering is. There are many ways to build a house, but only a few that are approved and accepted. It could maybe work, although new inventions would be slow to catch on. A bit like in construction engineering today. Maybe for some security related tasks it should be a requirement in some cases. A bit like software for airplanes and trains etc.
    - Kamq 3y ago
      > I don't think the standards have to be low Based on what you've described, I disagree. Most colleges have already winnowed things down to teaching in only one or two languages. Usually java and python. And from what I've observed, most students still don't learn much. We, as a field, don't know how to teach people to code. The closest we've gotten is showing people what an if statement and a loop are, show them a couple examples, and then tell them to screw around for a while until it clicks. And for some of them it does. If you want standards to be higher than a random teenager who screws around for a summer, this has to change. Or you have to accept that ~75% of college graduates are not going to be able to go into their profession.
- Nursie 3y ago
  > "Oh, the bridge fell down and killed 15 people, but it was worth it because I built a lot of bridges this week" Not everything non-software engineers do is life or death either, and there are plenty of software people who do work in critical areas that don't have that attitude. This oft-repeated view is a caricature. Licensed engineers make all sorts of crappy consumer goods that fail all over the place. Conversely, there are software engineers involved in medical devices, defence and various other spheres that follow very risk-averse, formalised coding, verification and release procedures. The fact that a lot of consumer-oriented software is insecure, flakey crap is a consequence of time pressure and risk tolerance, as well as nebulous or amorphous requirements. Should I release this now, and try to capture the market, move fast and break things, adapting functionality as I go, with quality important but not that important? Or should I spec out a complete and formal design, maybe formally verify it, implement to that spec and thoroughly validate it all afterwards? There'll be no product for five years but that's OK. This latter category does exist, but isn't especially visible because it's not very sexy, it doesn't have 'hero' engineers, and there are few techbros getting rich off it.
- exclusiv 3y ago
  > This is why programmers are not licensed engineers, and I have my doubts about being a serious engineering profession. You're conflating two different things. Coding and programming does not make one an engineer. Just like assembling a bridge does not make one an engineer. Or building a house, an architect. On the other hand, actual software engineering can be a serious engineering profession. As serious as any other engineering form.
  - almostnormal 3y ago
    Bridges don't usually fail because some worker layered some reinforcement wrong before covering it in concrete, but by issues on the engineering side. Some software issues are caused by engineering, but most of them are just some implementation detail like an "!" in the wrong place.
    - exclusiv 3y ago
      > Some software issues are caused by engineering, but most of them are just some implementation detail like an "!" in the wrong place. Yes most of them (by the numbers) because software is more complicated than a bridge which has been a solved problem for a long time and because even the worker bees that write code have a more serious relationship with the software than someone pouring concrete in construction, which is also already a solved problem and for the most part - has one true way to do it, unlike software. If you have proper quality control and budgets for that, then we'd have a lot less bugs that you are talking about. I don't get your point though. You are saying software is so easy it's not real engineering and software fails because some coder screwed up? I don't buy that. The success of every project comes down to quality engineering which encompasses a lot of things that are outside of just the part of the job called coding (budget, schedule, requirements gathering, build, quality control, risk mitigation, redundancy, ongoing monitoring, hosting/infrastructure, maintenance, etc). A civil engineer is more of an engineer than a coder (which isn't an engineer) which is the conflation that caused my prior post. However, a civil engineer is NOT more of an engineer than a real software engineer. I'd submit the opposite and the market agrees. And if you don't believe that then you will eventually when there are more catastrophic failures in critical software. Probably AI or self driving cars when the stakes are higher. If it's a dumb bug as you allude to, that won't make it less of an engineering discipline. It would make it more. I can't even believe there is debate about software engineering being a thing with all the incredible things that have been built.
- Attrecomet 3y ago
  Software engineers shouldn't be, and shouldn't want to be, licensed engineers. Being licensed a pain in the ass, a huge bureaucracy (have fun learning about thousands of ISO standards for trivial stuff for your license) and stifles innovation. We accept certain jobs requiring bureaucratic oversight because the effects of too low standards are unacceptable to us, but repeat with me, "licensing is a necessary evil, not a good in itself". It's ridiculous to demand that every library author or writer of a corporate website be licensed.
gustavus 3y ago
And a bigger problem for me is the high cost of losing my job when some code cowboy leaks a bunch of people's data and passwords because "md5" was already in the standard library and easy to use. Or someone replaced all the pictures on the website with hentai because a developer found this "really cool GitHub project" that saved him the hassle of "having to learn regex" or decided to outsource a bunch of customer analytics to "this really cool startup I saw on ycombinator. No I just paid with the company pcard, no I didn't read the privacy and data documents those are boring." It's a funny worl like that. EDIT Or the developer who put the CORS to '*' because that was the only way to make it work on my machine. Or "Why is this random Serbian guy currently admin in our AWS account?" "Oh that's gavrilo great guy he was one of the front end guys we brought in back a couple of months ago to finish a project. We couldn't figure out the permissions to the s3 bucket though so we just gave him admin rights. Should probably get around to removing his access. Cool dude though although he had problems with the Asutrians for some reason."
- thriftwy 3y ago
  Love the WWI reference.
- guhidalg 3y ago
  Great username BTW
bezier-curve 3y ago
I can get on board with education about social engineering hack attempts, but the amount of spyware on my work machine feels like institutionalized cyber crime. I have work that is I/O intensive, and the third party AV makes sure that's as slow as possible.
rufus_foreman 3y ago
What's a cyberponie?
- Anthony-G 3y ago
  I tried using different different search engines as I’m not always hip to Internet slang but nothing useful shows up: https://duckduckgo.com/?t=ftsa&q=%22cyberponie%22&ia=web https://duckduckgo.com/?t=ftsa&q=%22cyberponie%22&ia=web That commenter doesn’t seem to have put much effort into articulating their thoughts clearly.
deleted 3y ago
[deleted]
MattPalmer1086 3y ago
Right. That's why we see almost no successful malware or cybercrime these days, and all the cyber criminals are going out of business /s.
red-iron-pine 3y ago
All security is a balance between risks and costs, in this case productivity. If I believe the Verizon DBIR reports -- and I do -- around 20% of breaches are straight up errors, screw-ups, and accidental disclosures. After that it's hacking web applications, at around 30% of the breaches. Keeping these things from happening starts on the developer level, and if I find out a software suite that I'm using in the Enterprise ain't doing their security due-diligence then they're fucking gone, like ASAP; security for highly vetted, well-protected systems is hard enough, and those people are trying. > Many skilled people had been caught doing 'cybercrime' There is getting in, getting out, and getting in and out cleanly. Just cuz they didn't get out cleanly and got arrested -- eventually; could be 4 years later -- it doesn't mean they can't do massive damage until then. Shutting down work, destroying data, exposing secrets, whatever. And these are the ones that you can arrest, cuz plenty of them won't be in countries that will extradite.

sublimefire 3y ago

The title is misleading. It should be called "The low, low effort of ...". There is no dollar value expressed in conducting such a simple attack. One needs to buy emails, then setup dns and host the files on some servers. How do you pay for those servers? There are a bunch of interesting parts of this that were just not covered in the article nor there was any attempt to show the actual cost, nor did it prove it is actually cheap. The cost would be dictated by the amount of valuable emails you have and the ability to squeeze them into one campaign (minus the effort).

CharlesW 3y ago
> There is no dollar value expressed in conducting such a simple attack. "Cost" encompasses things like effort, loss, and sacrifice too.
- john-radio 3y ago
  For crimes where the criminal's "happy path" result is to take somewhere from $50 to $50,000, you'd expect that the most important cost element would be risk of getting caught and punished, although I have the impression that enforcement is not actually that strict.
  - thayne 3y ago
    That risk is practically zero, especially if you are operating out of a country that won't extradite to the country of your targets.
    - throwaway290 3y ago
      Remember Ukrainian cybercriminal that was caught when he crossed into Poland? Yeah you will need to remember to never go to any of those countries for the rest of your life. If criminal wants ever to live a nice lifestyle (which is probably why become criminal right?) then getting caught is high cost
placebo 3y ago

_8j50 3y ago

A handful if times, I was able to track down the guy distributing (not authoring) the malware via social media, youtube,discord, github and more (even opened a github issue respectfully asking them to stop distributing malware) and I was able to find the country they live in as well as their name (even a home address and cellphone in one case). I mention this because even with all that info there isn't much I can do that would be worth doing to take action against them. I have filed IC3 FBI complaints for far worse and they don't even so much as reply. I can get an "industry contact" to get me to relay that to an actual special agent but it would have to be something highly impactful like a ransomware, I can't do that for every small time crimeware I find. Jurisdictions like Russia have a policy of looking the other way as well so long as you look the other way and in some countries, just having actual cybercrime laws and then the diplomatic relation strong enough to cooperate with their cops can be rare to find. But focusing on the cost alone is a mistake, threat actor cost-benefit analysis is key here. In the 80s and early 90s for example, big cities were a crime horror show because cops couldn't catchup enough and the reward, relative to potential reward of law abiding life was dismal compared to today (well, that and lead babies!). I don't believe stop-and-frisk or "broken windows" policing made a difference nowhere near as much as better opportunities, entertainment, education and economy as well as "the internet" and tech making it harder to get away with crime did.

cowsup 3y ago

Absolute art for the article itself to have comments, and for those comments to all be spam.

Andrex 3y ago
Spam isn't necessarily cyberly-criminal.
- nine_k 3y ago
  But it's the epitome of mass low-cost evil.
deleted 3y ago
[deleted]

sublinear 3y ago

Off topic, but the stylesheet for this page is just a couple of tweaks away from not being unreadable trash on mobile. I don't understand how in 2023 some sites still insist on using fixed minimum values instead of just adjusting the layout for narrow viewport widths in a media query. The images just need properly scaling thumbnails, and the gutters around the single column of text need to go away.

deleted 3y ago
[deleted]

metaphor 3y ago

The actual blog post: https://isc.sans.edu/diary/The+low+low+cost+of+committing+cybercrime/30176 https://isc.sans.edu/diary/The+low+low+cost+of+committing+cy...

emmelaich 3y ago
Thanks. The submission url is "Poisoning the Honeypot Download Logs"
dang 3y ago
We've switched to that from https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0. Thanks! I think the problem was that the OP contains https://isc.sans.edu/diary/0 https://isc.sans.edu/diary/0 as its canonical URL.
- r721 3y ago
  I think that's currently a problem with all isc.sans.edu URLs: https://news.ycombinator.com/from?site=sans.edu https://news.ycombinator.com/from?site=sans.edu
  - metaphor 3y ago
    Naw, it just looks like the same submitter, freedude, has been submitting the same temporal top-level over the past month rather than linking to each blog post's static address directly.
    - pvg 3y ago
      You can see that it's happened to other users plus the wrong canonical URL (which HN fishes out of the HTML) is on all of their individual pages.
    - r721 3y ago
      I just recalled that I had a similar problem with HN autoreplacing isc.sans.edu URL to wrong one (though the error was different then, in 2022): https://news.ycombinator.com/item?id=29917559 https://news.ycombinator.com/item?id=29917559

paulpauper 3y ago

it's not that cheap. a good botnet will run you thousands of dollars a day. good proxies in bulk not cheap either.

ozim 3y ago
People run crimeware as service and getting it for some time is not that expensive. You don’t have to have your own botnet.

two_in_one 3y ago

BTW, I suspect there is a new (to me) type of scum in US. Nonames are trying to 'collect' debts pretending to have some rights. They get fresh info on possible targets on black market.

gmerc 3y ago
Definitely not new.
- H8crilA 3y ago
  And it even works against corporations, sometimes.
rambambram 3y ago
> trying to 'collect' debts pretending to have some rights How? By sending letters? By coming to your door?
- indymike 3y ago
  By tricking people into affirming a paid off, non-existent or expired debt and then attempting to collect it.
- two_in_one 3y ago
  Going to court, probably, if it's enforceable. Otherwise only online/offline harassment.
red-iron-pine 3y ago
they don't need to get them off the black market; banks, credit card companies, etc. will sell the debt and info to debt collectors, openly. no need to fire up tor, you can buy this info for reasonably cheap. presumably someone hacked it and tossed it on Dread or something?

darkclouds 3y ago

> they target pretty much everyone, and nothing demonstrates this better that generic, “un-targeted” phishing e-mails. Had to stop there, this is written like its a given, that there is no way to avoid phishing emails when there is. There's plenty of ways and alot of the criminality is maintained by those who dominate the sector, via standards or solutions. >either immediately or very soon after they are delivered to their first recipients – detected and blocked by any security solution worth the name I've always been taught ignorance of the law is no defence of the law, so unwarranted data sharing is ignoring various laws. "Articles 13 and 14 of the GDPR require you to tell data subjects who you share the personal data with (the recipients or categories of recipients of the personal data)." The email systems and associated security products, namely anti spam and anti virus software/services are knowingly breaking the law with a recipient that chooses to employ said service to scan their emails. Everybody on the planet who has an email address and an AS/AV scanner is breaking the law, but I guess hypocrisy can be overlooked even in the best educational establishments, whilst ignoring the ill thought out nature of law in a global world. >JavaScript loaded from the external domain was not as simple as the rest of the attack (it was heavily obfuscated and "weight in" at 155 kB) I guess dialup is still an issue for some. >Proving that the cost of committing cybercrime can be really low. I'll agree on that.

grodes 3y ago

Horrible website format, it just uses like 25% of my screen width to render text

popcalc 3y ago
Almost as bad as the new Github.

mbwgh 3y ago

I am probably going to get flak for this, but this "scam flow" including a forged Microsoft login, is pretty much the problem I had when I first encountered OAuth and the "Login with XY" concept. Aside from the fact that I can't keep the way the auth flow works in my head for longer than 2 days before my understanding of it becomes fuzzy again, a layman is not supposed to understand what's going on at all. Because if they were, they would ask "does this service get my XY password if I enter it here?" and unfortunately, trying to get this answer will lead them down a rabbit hole of auth flows, OAuth2 vs. OpenIDConnect and whatnot, because it's only ever documented for implementers. The normal user is to just believe in its trustworthiness, which may on a technical level be warranted or not, that's not the point. If you keep logging in with XY to different services, you become conditioned to not question anymore whether it's correct to enter your password right now, and where the login form, which always looks the same across different services, comes from. But oh well, I don't know what the solution should be here, maybe mandatory 2FA yet again, or passkeys. The market will decide.

rightbyte 3y ago
> I don't know what the solution should be here A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Google" is spyware. I want 2FA for my bank only.
- larsla 3y ago
  "Login with X" is OAuth, not 2FA. 2FA is a great addition on top of a password per site. Neither a FIDO device nor an Authenticator app provides the site with any extra PI. Edit: SMS would give them your phone number, but SMS is a really bad 2FA and should not be used
- indymike 3y ago
  I'm not so sure this is the case. Even less safe 2FA like SMS and email seems to prevent a whole host of cheap attacks. TOTP is much better and can be as anonymous as your login is. What is sad is that misuse of 2FA data is rampant and causes people to think (rightfully so) as you do.

keiferski 3y ago

One of the more interesting aspects of early sci-fi that hasn’t made it into reality (yet) is ICE, or security systems that “bite back” with physical feedback, pain, and potentially death. If body interfacing tech continues to develop and cybercrime becomes increasingly prevalent, this does seem like a possibility in a few decades. https://en.wikipedia.org/wiki/Intrusion_Countermeasures_Electronics https://en.wikipedia.org/wiki/Intrusion_Countermeasures_Elec...

pingou 3y ago
How would that work? Why would a hacker ever enable those features on his local hardware?
- saiya-jin 3y ago
  Maybe with direct neyrosynaptic link they would have no way to block their hacked hardware behavior. Assumes ICE will be more advanced/faster than hacker itself
  - deleted 3y ago
    [deleted]
- keiferski 3y ago
  Presumably the Net would somehow require physical feedback in order to browse and participate. Or, the functionality would be available (but not required) and ICE would counter-hack the hacker and overpower his local hardware settings and enable the feedback. A more contemporary example might be something like headphones: as far as I know, limits on sound output are software-based, not hardware. Theoretically a hacker could modify these software limits and output extremely loud sounds. > Gadgets can be hacked to produce 'dangerous' sounds, says researcher https://www.bbc.com/news/technology-49291665 https://www.bbc.com/news/technology-49291665
  - dale_glass 3y ago
    > A more contemporary example might be something like headphones: as far as I know, limits on sound output are software-based, not hardware. Theoretically a hacker could modify these software limits and output extremely loud sounds. Seems pretty much impossible. True, my headphones could be modified for it. In fact I once looked into the firmware of a previous model, and apparently there was 16MB RAM, 2 cores, and sqlite in there. The darn thing could run DOOM if there was a display attached. But an application doesn't get to talk Bluetooth to my headphones, it only gets to submit audio. Besides that, audio is logarithmic. If the internal amplifier can produce 2X of the software limit, that only adds 3db. Maybe annoying, but nowhere near bad enough to do serious harm.

aetherspawn 3y ago

Can’t wait for everything to be FIDO2 and security keys (phishing proof) and for these people to go get real jobs flipping burgers or something where their employers withhold their taxes…

anonymousDan 3y ago
Not too au fait with FIDO2 details. How exactly would i help in this instance if the the user believes they are entering their details into a valid MS form? Is it that the attacker would only be able to log in once?
- Dachande663 3y ago
  AFAIK webauthn uses the domain as passed from the browser. So user might see micorsoft.com, but to the device it's a different domain so it won't pass on the keys.

mschuster91 3y ago

> To my mind, the old proverb “opportunity makes the thief” describes the main issue with cybercrime quite well – the internet is a very “target-rich” environment, and it is incredibly easy/cheap to create a simple piece of malicious code or launch a basic attack. It's also consequence-free. You can do on the Internet whatever the fuck you want, but unless you anger the wrong people (e.g. you hack a mega corporation or a hospital) nothing will be done. A large part of the "cheapness" of cybercrime is that even though we know where a lot of the bad agents are coming from: - enemy nation states like Iran, North Korea, Russia and China where the government itself has hacker groups or tolerates their activity - neutral nations like India or Turkey where local law enforcement is bought off by scammers and other criminals so the masterminds get warned of raids in time - domestic agents like ISPs who don't give a shit about abuse reports if there is no legal liability attached to them (i.e. everything but CSAM and copyright) because they don't bother to hire enough qualified staff to follow up on reports and get bad actors (e.g. people with compromised IoT or other devices) cleaned up or disconnected ... absolutely nothing is done against them, even if identified. And on top of that: if you drive an unsafe car on the road, you'll get fined for being a danger to other motorists. If you have an Exchange server not patched in years reachable from the Internet, you're a danger to other systems on the Internet, and yet nothing can be done against you. Our collective governments need to get their act together: nation states must be told to either clean up their act or get disconnected from the Internet and the global financial system, ISPs must face regulation requiring at most 6h response time for abuse reports and evidence of corrective action taken, and people being grossly negligent in keeping up with patches must feel consequences. It's time for the laxness towards criminals and bad actors to end once and for all. We don't tolerate gangs of bullies intimidating grandmas on the street into extortion schemes, we shouldn't allow their cyber equivalents to do the same.

red-iron-pine 3y ago
> It's also consequence-free. You can do on the Internet whatever the fuck you want, but unless you anger the wrong people (e.g. you hack a mega corporation or a hospital) nothing will be done. definitely not consequence free if you don't know how to cover your tracks, and only consequence free if you're in a country that doesn't extradite. Iran / Russia / NK / China / etc. can play dirty because they're moving on a nation-state level and geo-politics, up to and including nuclear weapons, are a discussion topic. The average kidde re-using Indrik Spider code is gonna get some easy wins but will eventually get nailed.