Cybercrime is a fantastic business

Research clearly shows that cybercriminals' profits are greater than profits coming from the drug trade. CERT at Orange Polska works around the clock to ensure that all risks are kept to a minimum and consumer accounts are kept safe

By Robert Kwaśniewski

Long gone are the times of spectacular hacker break-ins into highly secured systems just for the satisfaction of having done so or as a prank. Financial reward has become the main motive of such groups today, often at the cost of precisely targeted victims. Such violation can come about in a few ways – through interception of vital data or by utilizing the victim's computer or internet connection for criminal activity.

All methods come down to the acquisition of important information, which can be used directly to steal money, or to elicit pressure and extortion on the way to demanding ransom. Such activity was sought by the infamous “Polish Police” malware, which blocked one's computer until the user paid money to receive a code to unblock the system. The virus oftentimes comes unexpectedly through the mediation of totally trustworthy websites, which were infected by cybercriminals using security loopholes (e.g. in ad banner generator systems).

Cumbersome and Dangerous

Taking into consideration the amount of threats; spam, malware and DDoS (Distributed Denial of Service) attacks are the most cumbersome. DDoS aims to block communication with a victim's website or its applications.

Nonetheless, the weight of the threats has an inverse relation to their number. Attacks that use the victim's broadband connection and IP address, in order to connect to a botnet, are of primary concern. The botnet is a network of subordinate computers, which allow the cybercriminals to make subsequent attacks, while maintaining anonymity. This is the way that DDoS attacks work: sending multiple requests to various servers, “ordering” them to flood the victim with great amounts of traffic. As a result, this leads to unavailability of the victim’s system and sometimes even to its failure. It is easy to imagine the harm such an attack may pose for financial institutions, among others.

The theft of vital information – passwords and logins of bank accounts or credit card numbers – is possible through the use of a malicious programing (malware) that may use keyloggers (programs which collect and send information that has been entered through the keyboard or mouse).

Thanks to this, the attacker can attain access to a bank account, e-mail account or social media services, which may contain important information about the victim, their workplace or lifestyle and thus might lead to a carefully crafted phishing attack.

Not only are computers at risk, but also, all the more popular, tablets and smartphones, of which tens of millions are already in use in Poland. They work non-stop and are usually connected to an internet network at home or at work, serving as an ideal gateway for the offenders. People are still not aware that these are basically computers, so it's not uncommon for cybercriminals to break into a smartphone due to the owner’s carelessness.

Increasing risk awareness

In the last few years, the definition of security has changed. The sharp upsurge of electronic communication between clients, suppliers and partners increases the level of risk in companies.

In spite of the confidence of entrepreneurs in having effective anti-breach and advanced malware interception security in place, the risk of loss of sensitive data is still high.

The cloud computing model of IT services is gaining in popularity, although clients' questions about its security persist. Therefore, guaranteeing security in cloud and mobile platforms and tools continue to be areas that need to be improved the most.