Last February, an undercover agent working for the FBI was engaged in online conversations with a suspected hacker. The agent was playing the role of a site administrator for a cyber crime website specializing in credit card fraud. The hacker, Jarand Romtveit from Norway, was bragging about a program he could use to defeat the type of encryption that banks and other financial institutions use to protect information resources in their databases. Ironically, in sharing screen shots of the decryption program in use, the hacker inadvertently also displayed a window that featured his own real-life name. Even more amazing was the fact that the hacker actually admitted that his name had been on-screen and proceeded to share his Facebook wall with the agent.
The hacker himself had fallen prey to an impulse that leads many legitimate computer users into difficulties: he had shared information best kept private with someone he believed worthy of his trust at the time. When ordinary computer users do the same thing, they sometimes open themselves and the companies they work for to network security vulnerabilities.
Romtveit's online chats with the FBI agent working on his case have also illuminated some of the practices and procedures that hackers and other cyber criminals engage in as they attempt to defeat the security measures that businesses have adopted, including at times small and medium businesses. He explained, for example, that he had made use of a malware tool called SpyEye, which is a commercial computer program that uses Trojan horses in order to steal the username and login information from banks.
Another technique Romtveit used was to ‘inject’ malware directly into some of the pages making up a banking website. This technique yielded Romtveit an alarming array of information about a single account including the customer's name, his password, and the answers to his security questions as well as the email address associated with the account. With this information at hand, a cyber criminal could easily impersonate a given customer and gain access to his account, after which it might be a simple matter to pilfer all the funds deposited with that particular bank.
Romtveit was only able to inject malware because the site in question was not completely locked down. For more information about how an IT security expert can provide on-site service to help you secure your information assets, contact iCorps and ask to speak to a representative specializing in the company's managed programs model.