When it began: Impossible to tell, but the first real large-scale attacks on financial institutions and gambling sites began gathering steam in the late '90s One recent development, reported in January by security vendor RSA, is the existence of a universal man-in-the-middle phishing kit being sold and used online by fraudsters. The distribution of such packages has broken down the last barrier to widespread online fraud: computing skills. Download the kit and you're ready to go.

What it is: Organized crime has driven up demand for easy-to-use software tools that even non-expert users can employ to carry out sophisticated online attacks. As a result, according to security consultants and vendors, the hacking community has evolved into an efficient supply chain in which specialists contribute specialized software.

Examples: The report The Crimeware Landscape: Malware, Phishing, Identity Theft and Beyond, produced by the Anti-Phishing Working Group, the U.S. Department of Homeland Security and the SRI International Identity Theft Technology Council, identifies the tools and methods of professional online fraudsters. (See a PDF document of the report here.) These tools include:

Keyloggers and Screenloggers
Keyloggers are programs that install themselves either into a web browser or as a device driver. They monitor data that is input and send it to a phishing server.

E-mail and Instant Messaging Redirectors
E-mail redirectors are programs that intercept and relay outgoing emails, then send an additional copy to an address to which an attacker has access. Instant messaging redirectors monitor instant messaging applications and transmit transcripts to an attacker.

Session Hijackers
Session hijacking refers to an attack in which a legitimate user session is commandeered. In a session hijacking attack, a user’s activities are monitored, typically by a malicious browser component. When the user logs into an account or initiates a transaction, the software takes over the session to perform criminal actions, such as transferring money.

Transaction Generators
Unlike many of the other types of crimeware, a transaction generator targets not an end-user’s computer but a computer inside a company’s transaction processing center.. The software generates fraudulent transactions for the benefit of the attacker from within the payment processing system. Additionally, transaction generators often intercept and compromise legitimate credit card data.

Responses: IP address blacklists; Bayesian content filters; content heuristics engines; content fingerprinting schemes augmented by sender authentication; anti-virus software; network monitoring and intrusion detection; teaching computer users not to click on communications or software that they are not expecting to receive.