Spies in the system

By PAUL BRISLEN

For the first half of the year, anti-virus research company Symantec reported 1237 new online security vulnerabilities - an average of 48 a week.

Nearly all those vulnerabilities, about 97 per cent, were considered moderate or highly severe, and 70 per cent were considered easy to exploit.

There is a growing online threat to businesses, their intellectual property and their good name if they don't take the appropriate security measures.

Any company running an e-commerce application is specifically targeted by these threats, with "phishing" and "spyware" attacks gaining in popularity.

Phishing attacks consist of emails being sent to customers or potential customers.

They contain a fake warning that the customer's personal details have been lost and that they should be re-entered.

Customers may unwittingly give away bank account details, credit card numbers, dates of birth and so on.

Banks in New Zealand have been targeted in such a manner, including ANZ and Westpac.

But phishing expeditions are not limited to financial institutions and this year the Government was the target of an attempted phishing attack.

However, just as customers become aware of the issue - and become less likely to be fooled by an email purporting to be from their bank - the perpetrators, in turn, are becoming cleverer.

Overseas' reports suggest that attackers link to genuine websites and use a keystroke logger to watch the customer's movements.

So when an email asking for donations for charity arrives in a customer's inbox they could well follow instructions to go to a particular legitimate website and make a donation - yet still lose their details to a fraudster.

The national manager of the police e-crimes labs, Maarten Kleintjes, says that of all the dangers online, keystroke logging is one of the most dangerous.

Kleintjes and his team have seen a worldwide rise in the number of infected PCs, with loggers able to monitor every touch on a keyboard.

Kleintjes said a survey in Holland of 2000 PCs found that more than half were infected with keystroke loggers and other forms of spyware.

Spyware is this year's big issue. Users who are adept at avoiding virus-riddled email and can even keep their PC operating systems up to date are finding that, nevertheless, their machines riddled with spyware.

What is worse, most spyware is particularly tricky to get rid of.

Spyware is a term that covers a range of nasty applications which monitor the user's PC and then report back to the creator. For example, some spyware might monitor only the user's online movements, which websites were visited, and for how long.

However, some of it also logs keystrokes, watches for passwords and user names, and even copies credit card or account details.

Some spyware is installed by users without them being aware of the problem.

Kleintjes said one of his staff downloaded a movie trailer and found four different kinds of spyware had been installed in the process.

Fortunately, spyware removal tools are becoming more commonplace as users band together to try to remove these pests.

Spybot is one such tool. It's free to download and users should update it regularly and use it as often as once a week. It searches the PC for particular signatures it associates with spyware and then allows the user to decide whether to remove them.

Another popular removal tool is Ad-Aware (Lavasoft) which uses a similar process to Spybot but finds a different set of nasties.

Between the two, users would be assured of being rid of almost all the spyware on the market.

Both applications require users to upgrade regularly. Users are spending more time taking care of their PCs instead of taking care of business.

However, these days it's rare to find a company that doesn't have an online presence and which doesn't need to consider all the security risks that brings.

Firewalls and anti-virus protection are no longer enough to keep confidential information out of the hands of competitors or fraudsters.

Companies need to consider automatically updating operating systems to patch the latest security holes, to install anti-spyware tools and to keep anti-spam solutions up to date.

Kleintjes says that both hacking and spam are becoming tools of organised crime and that the days of kids in their basements hacking for the fun of it are gone.

Instead, professional criminals are entering the fray and, for small to medium-sized companies, that spells danger.

Perhaps the final word should go to Richard Clarke, the cyber-security adviser appointed by former US President Bill Clinton.

Clarke, who toured New Zealand recently, said he has managed to protect his computer from more than 99 per cent of all known viruses, worms, network attacks and spyware.

He runs an Apple, not a Microsoft PC, and says that does the job nicely.


Combating viruses


THE PROBLEMS

* Phishing expeditions becoming a major risk

* Spam and virus attacks becoming more frequent

* Crime syndicates getting involved in online crime

* Businesses need to be more aware of online security

THE SOLUTIONS

* Viruses - businesses should install and maintain anti-virus software

* Network attacks - businesses should install firewalls

* Operating system flaws - keep operating systems, applications up to date

* Spam - costs to business of unwanted email spiraling out of control

* Identity theft becoming a major issue online

* Spyware - install anti-spyware software and update regularly

Symantec

Special Report: Turbocharging Your Business

(to be continued throughout this week)