Computers have become such a big part of everyday life—both at work and at home—for many people around the world. These days, computers are an essential part of practically every type of business, from small, home-based businesses to large multinational corporations. In the business world, companies use computers to store information, design and manufacture products, run complex calculations, etc. On a personal level, many people rely on their home computers to store important information, watch movies, play games, communicate with others, and shop over the Internet.
Because so much valuable information is stored on computers, a new type of criminal has emerged in recent years. These criminals, sometimes called "hackers" or "scammers," use their computers to "break in" to companies' or other people's computers to steal information, such as credit card numbers. The incidence of identity theft is on the rise as computer criminals find increasingly sophisticated ways to obtain personal information and use it in malicious ways. However, not all hackers are interested in stealing information. Instead, some send viruses through websites or email to damage the receivers' computers.
Information stored in a computer system is subject to a variety of threats. It was not long ago that the biggest concern about computer data was protecting it from physical disasters such as floods and fires, technology failures, and human errors. Most organizations develop contingency plans whereby they examine the possibilities of losing computer operations, and formulate procedures for minimizing damage. A disaster recovery plan is typically adopted to outline how the organization will carry on business in the event of a catastrophic loss. Data backup is an essential element of disaster recovery and involves the regular, systematic backing up of data to media that may include floppy disks, removable hard disks, CD-ROMs, or magnetic tape. Ideally, the backup files are then stored in a safe that is fireproof, heatproof, waterproof, and preferably protected at an off-premise location.
While the threat to computer files from disasters is real, research shows that employees are frequent culprits in the destruction or alteration of company information. Customer information, new-product plans, company financial information, and legal information can be stolen and sold to other organizations. Former or disgruntled workers who want revenge on their employer or supervisor have been known to resort to computer crime. The victim of information theft rarely learns of the problem until afterward, since copying information does not alter the original in any way. For this reason, prosecution is rare and frequently results in mild treatment. In some cases, perpetrators have taken new jobs as security consultants after receiving minor punishments.
Although records protection is still of concern today, there are many more concerns about the safety of computer data, both at work and at home. Because so much business is now conducted over the Internet, computer criminals have discovered ways to steal that information. Terms such as spyware, phishing, pharming, viruses, firewalls, and spam are practically household words among computer users, especially those who use the Internet.
Spyware is a term used to describe a program that is put on a computer without the user's permission, and usually without the user's knowledge. A spyware program runs in the background and keeps track of the programs the user runs and the websites the user visits. Some spyware tracks the user's keystrokes and extracts passwords and other information as they type. It then uses the information gathered to display certain advertisements or forces the user's browser to display certain websites or search results. Most spyware is written for the Windows operating system.
Spyware can be installed on an unsuspecting user's computer in any of the following ways:
Not only does spyware infringe upon users' privacy, but it can also slow down their computers. Many spyware programs use up most of the computer's random access memory (RAM) and processor power, preventing other applications from using these resources. In addition, many spyware programs generate popup advertisements that slow down the user's web browser, reset the user's homepage to display advertisements every time she opens the web browser, and redirect the user's web searches. Some spyware programs even modify the user's Internet settings for modem connections to dial out to expensive, pay telephone numbers. Some of the more malicious spyware programs modify the user's firewall settings, increasing the opportunities for more spyware and viruses to enter the user's computer.
Spyware has become such a problem that many states are taking action to explicitly ban spyware. Several federal laws deal with spyware. These include the Computer Fraud and Abuse Act, which covers any unauthorized software installations; The Federal Trade Commission Act, which deals with deceptive trade practices; and the Electronic Communications Privacy Act, which makes it illegal for companies to violate the security of customers' personal information. Unfortunately, these laws are very hard to enforce.
Phishing is a term used to describe email scams that attempt to trick consumers into disclosing personal and/or financial information. The email messages appear to be from legitimate sources, such as banks, credit card issuers, or well-known Internet sites (such as America Online, Paypal, and eBay). The content of the messages varies, but often they tell the consumer that he needs to update personal information or that there is a problem with the consumer's account. The messages usually contain links to fake websites. When the user clicks the link, they are taken to websites that look official, and may even include images from the legitimate websites. These fake websites often instruct the unsuspecting user to enter credit card numbers, social security numbers, bank personal identification numbers (PINs), and other valuable information. Once the user enters that information, the violators use it or sell it. This leads to what is known as identity theft. The scammers use this information to assume the identity of the victims to make purchases in that person's name.
It is estimated that between July and October of 2004, the number of new phishing websites grew approximately 25 percent per month. The amount of money that phishers collected from victims in a twelve-month period (April 2003 through April 2004) is estimated to be $1.2 billion.
In an effort to stop phishing, U.S. Senator Patrick Leahy introduced the Anti-Phishing Act of 2005, which allows law enforcement officials to prosecute scammers before the actual fraud takes place. The bill also addresses pharming, which occurs when scammers redirect a user's browser to a fake banking or e-commerce site that asks for personal information. According to Leahy, "Some phishers and pharmers can be prosecuted under wire fraud or identity theft statutes, but often these prosecutions take place only when someone has been defrauded. For most of these criminals, that leaves plenty of time to cover their tracks. Moreover, the mere threat of these attacks undermines everyone's confidence in the Internet. When people cannot trust that websites are what they appear to be, they will not use the Internet for their secure transactions."
In December 2004 several financial institutions, Internet service providers (ISPs), online auctions, IT vendors, and law enforcement agencies came together to form an anti-phishing consortium. This group, called the Digital PhishNet group, includes big names such as Microsoft Corp.; America Online, Inc.; VeriSign, Inc.; EarthLink, Inc.; the Federal Bureau of Investigation (FBI); the Federal Trade Commission; and the U.S. Secret Service; the U.S. Postal Inspection Service. According to the consortium's website (< http://www.digitalphishnet.org >), it is a "joint enforcement initiative between industry and law enforcement" designed to catch phishing perpertrators.
The Anti-Phishing Working Group (APWG) also formed in response to the growing number of phishing complaints. According to the APWG website (< http://www.antiphishing.org >), the group is "the global pan-industrial and law enforcement association focused on eliminating the fraud and identity theft that result from phishing, pharming and email spoofing of all types." The APWG has more than 1,200 members, including nearly 800 companies and agencies, eight of the top ten U.S. banks, four of the top five U.S. Internet service providers, hundreds of technology vendors, and national and provincial law enforcement agencies worldwide.
Spam is a term used to describe unsolicited email messages that usually contain an advertisement for some product or service, such as mortgage loans, pornography, or prescription drugs. Spammers send the messages to email addresses on wide-scale mailing lists, which could mean that each message is sent to thousands of people. Spam has become such an annoying problem for so many people that software programmers have developed spam filters to block or delete some email messages before they reach the recipient's email account. Most ISPs offer some level of spam filtering to their customers. However, even with these filters, hundreds of spam messages get through.
Practically everyone with a public email address receives spam every day. According to BusinessWeek Online (June 10, 2003), "in a single day in May [2003], No. 1 Internet service provider AOL Time Warner (AOL) blocked 2 billion spam messages—88 per subscriber—from hitting its customers' e-mail accounts. Microsoft, which operates No. 2 Internet service provider MSN plus e-mailbox service Hotmail, says it blocks an average of 2.4 billion spams per day."
Where do spammers get email addresses? Hundreds of companies compile lists of email address and put them on CDs, which they sell to anyone who is willing to pay for them. Each CD can contain millions of email addresses. These companies use programs to pull out screen names and email addresses from newsgroups and chat rooms or the Internet itself. Some spammers use spambots, which are programs that go through the web and look for the @ symbol and pull the email addresses associated with each one. Another method spammers use to obtain email addresses is to create websites specifically designed to attract web surfers. These websites may ask you to enter your email address to see what the site has to offer (for example, large amounts of money).
And finally, perhaps the most common method spammers use to get email addresses is to conduct a dictionary search of the mail servers and large ISPs. Dictionary searches use a program that establishes a connection with the target mail server and then submits millions of random email addresses. Often they will vary these email addresses very slightly (such as by adding a number somewhere in the address). The program then collects the email addresses for which the message actually goes through.
There are hundreds of companies around the world that have formed specifically to cater to spammers. They offer services for sending bulk email. Some of the larger companies can send billions of messages a day. Many of these companies are set up outside the United States to avoid U.S. laws. Some claim to be "spam free." This means that the email addresses they use are taken from the list of users who requested to receive bulk email, or "opt-in" email. A user's email address can be placed on an opt-in list when ordering something online. Many online stores include a checkbox near the bottom of the order page that asks the user to clear the checkbox if they do not want to receive email offers from their partners. If a user does not see that or misinterprets the checkbox, they may be placed on an opt-in list.
As mentioned above, there are many different spam filtering software programs on the market. These filters check email as it arrives in the user's electronic mailbox. The user can set up the filter to check for specific words or specific email addresses or specific types of attachments. If the filter detects any of these, it will either delete the message or place it in a separate folder. Unfortunately, spammers often find ways around these filters. Another problem with filters is that they sometimes filter out legitimate messages.
In 1998, Spamhaus.org was formed to track and stop spammers around the world. Australian-based Spamhaus (< http://www.spamhaus.org >) calls itself "an international non-profit organization whose mission is to track the Internet's Spam Gangs." Spamhaus.org also says it seeks to provide "dependable realtime anti-spam protection," works with law enforcement agencies to "identify and pursue spammers worldwide," and lobbies for "effective anti-spam legislation."
Today, Spamhaus continues to fight spam. The group publishes the Register Of Known Spam Operations (ROKSO), which lists the Internet Protocol (IP) addresses of the 200 worst spam gangs worldwide. ISPs can use this list to avoid signing up known spammers, and Law Enforcement Agencies can use the list to help target and prosecute spam gangs. Spamhaus also publishes two spam-blocking databases—the Spamhaus Block List (SBL) and the Exploits Block List (XBL).
Computer viruses are programs that spread from one computer to another, causing problems on each computer it touches. As viruses propagate, they use up so much memory that it can slow down computer systems to the point that they are unusable. Some viruses actually attack files on the computer by deleting them or modifying them in some way that renders the computer unusable.
The extent of damage caused by a virus varies. Some affect a relatively small number of computers. Others have been so devastating that they can even cripple large companies. For example, in March 1999, when the Melissa virus hit, it was so destructive that it forced Microsoft and other large companies to completely shut down their email systems until the virus could be contained.
There are four general types of computer viruses:
Because viruses have the potential to wreak havoc on computer networks and individual computers, many virus-protection products have been developed to prevent this. Most virus-protection software scans the computer when it is first turned on and looks for known viruses. As new viruses are discovered, virus protection providers have to update their virus definitions.
A firewall is basically a barrier that prevents damaging files or programs from reaching the user's computer. Many operating systems now include a built-in firewall. There are also many after-market firewall products available for purchase. Firewalls filter the data that comes through an Internet connection. If the firewall detects any suspicious information, it does not allow that information through. Most companies and many individuals who have Internet access use firewalls to protect their computers and networks. Although some firewalls protect against computer viruses, many experts recommend that companies and individuals invest in a separate anti-virus software package.
Firewalls control the flow of network traffic using one or more of the following methods:
Several criteria that firewalls use to compare incoming and outgoing data are listed below:
As more people buy computers and connect to the Internet, the number of potential computer theft victims grows. However, as users become more well-informed about the dangers that exist, they will take precautions to avoid becoming a victim. And as governments and law enforcement agencies around the world are learning more about these crimes and how to deal with them, they are taking action to prosecute the perpetrators.
SEE ALSO: Computer Networks ; Technology Management
Rhoda L. Wilburn
Black, Jane. "Before Spam Brings the Web to Its Knees." BusinessWeek Online, 10 June 2003. Available from < http://www.businessweek.com/technology/content/jun2003/tc20030610_1670_tc104.htm >.
Boutin, Paul. "Slammed! An Inside View of the Worm that Crashed the Internet in 15 Minutes." Wired Magazine, July 2003.
Coustan, Dave. "How Spyware Works." How Stuff Works, Inc., 2005. Available from < http://computer.howstuffworks.com/spyware.htm >.
Gross, Grant. "U.S. Senator Introduces Phishing Penalties Bill." IDG News Service, 4 March 2005. Available from < http://www.infoworld.com/article/05/03/04/HNphishingbill_1.html >.
Jaikumar, Vijayan. "Fight Against Phishing Moves to a New Level: Consortium Brings Together Companies, Law Enforcement to Target e-Mail Scams." Computerworld, 13 December 2004, 10.
"Phishing Fraud." Available from < http://securities-fraud.org/phishing-attacks.htm >.
Tyson, Jeff. "How Firewalls Work." How Stuff Works, Inc., 2005. Available from < http://computer.howstuffworks.com/firewall.htm >.