The Myths of Security

Chapter 4. It’s Good to Be Bad

In this chapter we’ll look at what motivates bad guys to break in to computers, and what’s going on inside their heads. It used to be that people created viruses and worms for silly reasons: perhaps just to prove to themselves or their friends that they are clever, or perhaps because they want to cause misery. There aren’t too many people like that in the world.

No, most people on the dark side of the force are there for one reason: easy money!

Let’s say you’re a bad guy and you get some bad software onto somebody’s machine. What kinds of things could you do to make money? Here’s a short list that is by no means exhaustive:

• You could collect credit card numbers and the data associated with it (such as the CVV validation code). You could collect the data as users enter it into e-commerce shopping sites, then sell it off to other bad guys. Eventually someone might use the credit card information for a day or maybe just for the occasional single transaction, in hopes the credit card holder will never notice the fraud.

• You could wait until people use their online banking sites, then sniff important account information (such as username, password, account number, and so on), or even take over the connection when the machine goes idle so that you can move money around.

• You could collect any kind of account information. If you collect valid credentials to large corporate networks, for instance, you might suspect that there’s a black market for that kind of thing. ...