Profile

Wednesday, it was reported that VP candidate Sarah Palin's Yahoo account was hacked by a perpetrator wishing to find incriminating information in her emails. It was not done using some strange computer security vulnerability. It was not done by guessing her password. It was done just in the same way as Paris Hilton's T-Mobile account was hacked some time ago: by guessing the answers to security questions. For Paris Hilton, it was the name of her dog. For Sarah Palin, it was her zip code, date of birth, and where she met her husband.

…

Malware, like real-world epidemics, has the strange property that it does not only matter to your health how well protected you are, but also, how well average people "out there" are. The more machines that are infected, the higher is your risk of also becoming infected. But that is not all: You are at risk even if you are well protected!

Once upon a time, malware authors wrote code to infect thousands of machines for entertainment and intellectual stimulation. Today, it's all about the money, and the greatest threat may lie in the silence, making a far more dangerous landscape.

Do you use the same password all over the place? Yes, you probably do -- whether you know it or not.

…

Federal prosecutors have charged 11 people with stealing 41 million credit cards, obtained by wardriving. (Read news story here.) The criminals drove around and scanned wireless networks for vulnerabilities, then installed sniffers that stole credit card information. Was this kind of attack inevitable? I believe it was.

…

Search engines and ISPs know who you are and where you've been. Phishers and advertisers do too. But can the average Joe learn this about you? Yes -- for good and bad.

Look at these three URLs: www.accountonline.com, www.democratic-party.us, www.wachovia.pin-update.com.

…

Online fraud is rampant, and the trends are sinister. However, law enforcement, in collaboration with affected service providers, is making substantial progress in going after criminals. The good guys are now routinely capturing drop boxes (the machines used by phishers to collect stolen user credentials), and are often able to trace attacks back to the likely offenders. Newspapers occasionally run stories about busted crime rings. Crimeware writers spend time in jail. Hopefully, increasing risk of being caught will deter many would-be criminals. But to some extent, it is also changing the nature of the crimes.

…

Consider a world in which increasingly advanced and impressive consumer electronics are free to the consumer. For example, the electronics might be subsidized by service providers in the business of understanding consumer behavior -- purchase preferences, location, activities -- in order to provide better search, advertising and fraud detection. It is not so hard to believe that we will be there in just a few years. Then what?

…