Boomtime for Malicious Hackers

CSO — It’s a good time to be a malicious hacker. That’s because even though it’s not a time of revolutionary new techniques in hacking for profit, business is booming for the established methods. Despite increased investment in information security defenses, the good guys continue to lag badly behind. According to one report by Sophos, which called the recent uptick in malware a “deluge,” by April 2007, more than 250,000 websites were hosting malicious code and more than 8,000 were being added to that total every day.

A sample of the deluge:

Hackers compromised Google AdWords so that links on certain sponsored ads were redirected to the attackers’ website first, where an attempt was made to install a keylogging bot.

Zero-day exploits in Windows were discovered, including a critical flaw in animated cursor files that would allow an attacker to commandeer a PC.

Incidents of iFrame malware —code that lives in an invisible-to-the-eye frame on a website and delivers bots onto the PCs of people visiting the site —have increased.

Credential-stealing bots like Gozi and Torpig continued to troll for personal banking information on infected computers.

A hacker won $10,000 breaking into a Mac through the Safari browser, which was followed by Apple (AAPL) releasing a patch for 25 vulnerabilities.

A researcher announced she is planning to demo ways to install rootkits and perform encryption attacks on Microsoft’s (MSFT) new Windows Vista product at this summer’s Black Hat conference.

A 17-year-old was charged with hacking into AOL, using a phishing scheme against AOL employees and using unauthorized instant messaging accounts, with the intent to transfer confidential data.

The only response for many information security professionals is to stay on top of the latest developments and prioritize response according to need. But that’s getting harder to do with the sheer volume of information on new attacks.

Many are also met by apathy or skepticism when trying to shed light on the problems. “It is hard to discuss solutions when no one believes there is a problem,” says Eric Hacker, a CISSP who works for a technology company. “The culture cannot mix security and business for whatever reason.”