Forum libero

While diving around on the Internet I came across the following articles on various topics about IT security:

The Zeus Toolkit and the “Rock Phish” Russian crew:

Zeus is a piece of malicious software that infects windows PC on the internet to steal financial and private data, it's actively developed,maintaned and sold like any other commercial software and originates in Eastern Europe or Russia.
It's creators actively enforce their customer to pay for the software and it's modules and have implemented licensing technology in the malware like those used by Microsoft.

http://www.secureworks.com/research/threats/zeus/?...

This Threat Analysis from the SecureWorks CTUSM provides a brief overview of the current version of ZeuS and its modules, along with the market pricing. We will then see how ZeuS is actively being used and the irony of how the criminals themselves can sometimes be the victims.

There are numerous competing groups selling crime software, there have been crime wars.

http://blogs.hackerscenter.com/2010/02/spy-eye-too...


Legitimate Academic IT specialist and Black Hat hackers crew "fight" each other with hacking tools

"Your botnet is My botnet"
www.cs.ucsb.edu/~seclab/projects/torpig/torpig.pdf

Botnets, networks of malware-infected machines that are controlled
by an adversary, are the root cause of a large number of security
problems on the Internet. A particularly sophisticated and insidi-
ous type of bot is Torpig, a malware program that is designed to
harvest sensitive information (such as bank account and credit card
data) from its victims.
In this paper, we report on our efforts to take
control of the Torpig botnet and study its operations for a period of
ten days

The reason why they hikacked it only for ten days and didn't tookit down is because they couldn't. Confused
As they started to hack it the original botnet creator engaged in countermesures.
It's all detailed in the paper


Industrial machines exploits and nationals grids vulnerability to software and Internet attacks

Industrial technology has been heavily developed and embedded with IT technology before the advent of the Internet without realizing the conundrum of Security liability Vs. Network effect benefits that arise from interconneting such system.

http://www.businessweek.com/technology/content/oct...

Liam O Murchu, a researcher with the computer security firm Symantec (SYMC), used a simple air pump connected to an industrial computer to pop a balloon. The computer's program called for the pump to stop before the balloon burst. But O Murchu had loaded the Stuxnet worm onto the machine, which let him order the pump to keep going.

http://articles.cnn.com/2007-09-26/us/power.at.ris...

http://unix.nocdesigns.com/aurora_white_paper.htm

Aurora is a vulnerablity to cyber attacks that could sabotage critical systems that provide electricity including the nationwide power grid. This vulnerability effects control systems that operate rotating machinery such as pumps, turbines and so on. The vulnerability of the nation's electrical grid to computer attack is due in part to steps taken by power companies to transfer control of generation and distribution equipment from internal networks to supervisory control and data acquisition, or SCADA, systems that can be accessed through the Internet or by phone lines.





So doesn't it all sounds like countless such things first imagined in cp literature?

My take on this association I made is that there is one major thing that is missing from the cp literature, the role of "openness" of such phenomena.
And I mean it in both an "open source" way as in linux and encryption algorithm intrinsic security and in a "social" way, how much we actually are willing and desire/demand/crave to adopt such technology in our daily life.

Accordingly to hans rosling and tim berner lee open data, there is to say data availability, is the pivotal element that make such technology so effective.

I think they're right and that the archetips that have been created within the cp literature are becoming usefull to interpret and "name" such real world dynamics, such as those descirbed in the links. but that they're missing the pivotal element.
-----------------------------------------------------------
Modificato dall' autore il 19 dicembre 2010 16.28
-----------------------------------------------------------