Crimeware: Understanding New Attacks and Defenses

There was a time when viruses and worms were written primarily for the purposes of creating chaos and getting 15 minutes of fame in the malware underworld. Script-kiddies could crank out exploits that spread like wildfire and interrupted computer and network productivity, but with little impact or implication beyond the annoyance factor in most cases. That time is gone. It has been gone for a while now. Professional criminals and crime syndicates eventually figured out that these same attacks and exploits, if properly crafted, could represent a windfall of ill-gotten cash. Rather than trying to have the greatest impact and notoriety, today's attacks seek to find a balance between compromising as many machines as possible while also staying under the radar and remaining undetected by users or security software. The authors of Crimeware: Understanding New Attacks and Defenses have put together a comprehensive and thorough guide to current malware- which they call crimeware- and how to defend against it. Rather than go on about the scope of the book, I will just list the chapters and let you judge for yourself. 1.Overview of Crimeware 2.A taxonomy of Coding Errors 3.Crimeware and Peer-to-Peer Networks 4.Crimeware in Small Devices 5.Crimeware in Firmware 6.Crimeware in the Browser 7.Bot Networks 8.Rootkits 9.Virtual Worlds and Fraud 10.Cyberware and Politics 11.Online Advertising Fraud 12.Crimeware Business Models 13.The Educational Aspect of Security 14.Surreptitious Code and the Law 15.Crimeware and Trusted Computing 16.Technical Defense Techniques 17.The Future of Crimeware This book is not just another compendium of malware and defensive countermeasures. This book provides that, but goes beyond that to educate the reader and provide tremendous insight about how and why crimeware works.

First off, to be fair I should point out that I am a co-author of one of the chapters (Chapter 5), but I still read the remainder of the book like everyone else, and I don't receive any benefit from sales, so I think the review is fairly objective. This is the first book to describe the mounting problem of crimeware in a manner that is both accessible to a general readership and helpful to the expert reader. Written by expert contributors in the field of security, it details how cyber crooks are launching attacks on businesses and society, and predicts the trends in Internet security. In contrast to most security books, this book covers not only technical aspects, but also social and legal aspects of security. The book has descriptions of the current and predicted threat pictures, and discussions of meaningful countermeasures, including possible educational campaigns to support other countermeasures. It is a book that is difficult to put down once you have started reading, at the same time as it is likely to remain a useful reference for quite a while. As has been commented previously, each chapter is more or less self-contained, and so readers can skip to chapters of interest. Further, rather than just considering the technical problems and solutions of online crime, it considers the broader holistic problem of security and crime. I strongly recommend this book to those that want to understand the current and future online threats.

Five stars to Jakobsson & Ramzan for a most useful guide to understanding the underbelly of the internet. The strength exhibited by this book lies within the all-star lineup of contributors and the thorough dissection of the numerous forms of crimeware. Their book is a must read for anyone who has responsibility or an interest in protecting Personal Identifying Information (PII), Private Consumer Information (PCI) or Intellectual Property (IP). As a self-described technological Neanderthal, I encountered only a few portions of the book which caused me to enter the world of "technological overload," anyone with a modicum of information technology understanding will have no problem cruising through the chapters and fully comprehending the various data points. The highpoint of each being the *countermeasures* presented at the end of each chapter. Some items which I would like to highlight, as they resonated with me: o Whether you are fully familiar or a nascent understanding of crimeware and its many manifestations, Chapter 1 alone provides a concise overview. This introduction gets your mind in swing, and puts you in the zone, if you have only time to read one chapter - this is it. You'll finish with a working knowledge and familiarity of crimeware. o Crimeware's business model hit the sweet-spot. The explanation is clear. The monetization requirement of the perpetrators is accurate, and from my own perspective (i.e., that of one who invests heavily in the "why" side of these discussions), the content provides meaningful grist for future discussions. o Education as a means to thwart crimeware makes imminent sense. Again the points advanced are spot-on, as the audience receiving *Security Training* must be exposed to the "why" before you try and project the "what" or the "do" upon them. I would add, that messaging, regardless of vehicle, be it cartoons, video, hoardings or print media, should be aligned to project the positive actions of a given scenario. The rationale being, individuals align with positive behaviors and outcomes and disassociate with a negative exemplar. o The endnotes are in reality an extraordinary extensive bibliography on the topic of crimeware, which alone is worthy of review. In sum, Jakobsson/Ramzan have it right - crimeware is here, and it is here to stay. Perhaps if we collectively work together we may be able to hold back those investing in the development of crimeware. This collaborative guide is a great stepping-stone to the next level of trust and engagement. Christopher Burgess Co-Author: Secrets Stolen, Fortunes Lost: Protecting Intellectual Property in the 21st Century (Syngress, March 2008).

Attackers usually choose the most vulnerable points as their targets. Thus, every computer user should be aware of the common tricks used by attackers. Crimeware investigate the attacks and defenses of malware from a variety of angles. It is the most complete book to introduce malware and the corresponding anti-measures. The first author, Markus Jakobsson, is one of the best researchers I know in cyber-security.

Crimeware by Jakobsson and Ramzan sets a new standard for security books. It is both eminently pragmatic and at the same time, a scholarly work. I thought I knew a bit about malware, but I learned tons from the book. I struggled a bit with 16.2 Crimeware-Resistant Authentication and encourage the authors to take another look at that when they do second edition and this book simply must have a second edition. It will also be interesting to see if the taxonomy, chapter 2 takes hold. It would seem like we need a bit more of a classification system than Joanna Rutkowska's type 1 - 3 for our community. The book gets right down to it, most authors waste the first few chapters with background information. Now to be sure, this is background, but it is pretty deep background. My favorite chapter is 7, botnets, but 6.3 JavaScript is very well done and immediately useful information to know. For a high speed pass, chapter 8 rootkits will get you up to speed, but that needs a whole lot more material to really cover the topic. As this is an election year, and a crazy one at that, chapter 10 is a must read, it details a number of ways the election could be impacted, I think a bit about evoting machines might make a scary chapter even scarier. As soon as I finish this review, I need to send a note to a friend of mine concerned about click fraud, the authors do a great job on that in chapter 11. And the best thing, the authors do not just tell you how bad things are, they spend a lot of time talking about defense. And if I can offer a thank you to the fifty or so researchers that helped with the book, thank you very much, the defensive information community is far better off for your efforts. A must own, must read, must read soon if there ever was such a thing. Order it now!