Tag: RiskIQ

DCA’s New Report on Enabling Malware

Enabling Malware

Andrew Orlowski reports at The Register that last week Google quietly suspended its legal action to “muzzle” an investigation by Mississippi Attorney General Hood into whether or not the search giant was abiding by the terms of its 2012, non-prosecutorial settlement with the government over illegal online sales of prescription drugs.  Any explanation of Google’s change in strategy or the future of that investigation are subjects for another day.  But the fact that AG Hood was ultimately not stymied—either by litigation or by a brazen attempt in the State House of Representatives to legislatively tie his hands—is probably good news for American consumers because State Attorneys General “often act as the de facto consumer protection arm in their respective states,” notes a new report published yesterday by Digital Citizens Alliance.

Following up on its December report, which presented a look into the scope of the malware hazard for consumers who visit content-theft sites, DCA and RiskIQ have again collaborated to begin looking at the hosting services that either inadvertently or knowingly support illegal sites, which then endanger consumers.  The hosting services in this regard are particularly relevant because they are not shadowy operators based in hard-to-reach geographies but are legal corporations with offices in the United States.  As such, the news that Google will now look to “cooperate with AG Hood” rather than remain on the offensive comes at a good moment for consumers.  This is because DCA notes that state AGs will be the first authorities who may choose to investigate US-operating hosting services to determine their role in fostering the dissemination of malware.

The December report called Digital Bait revealed the likelihood (about 30% in some cases) that users of content theft sites would infect their devices with malware, and the report also identified the various types of malware being deployed in order to steal information and/or assets from consumers.  Digital Bait also presented a glimpse into the dark web-based economy where criminals engage in transactions like selling the IP addresses of a girl’s computer or even a cybercriminal paying content-theft site owners to deliberately host malware on their sites.  The report contains some eye-opening statistics like the one from the DOJ, which states that 16.2 million American consumers have been victims of identity theft, incurring financial losses of more than $24.7 billion.

The report released yesterday, Enabling Malware, looks at two hosting companies, each of which responded very differently when DCA contacted them with their findings.  The first was CloudFlare, which is “known for its willingness to support, or at least overlook, illicit activities,” the report states.  CloudFlare is a hosting service that is specifically designed to mask the identity of site owners and of the true hosting site of any content, whether the content is legal or not.  The site’s blog reads, “Signing up for CloudFlare is like taking your number out of the phone book, and putting in CloudFlare’s number under your name.”

This type of service can be (and is) used by journalists or bloggers operating in locations with authoritarian governments or other hazards to free speech and reportage.  But it is also a natural hosting choice for content-theft site owners, thus earning the service the nickname “CrimeFlare” among cyber-security experts. DCA contacted CloudFlare with regard to its hosting sites like Putlocker and Animex, both of which were identified in the Digital Bait report as delivering malware to users.  CloudFlare did not respond until a day or two before the release of this new report and wrote the following:

“CloudFlare’s service protects and accelerates websites and applications. Because CloudFlare is not a host, we cannot control or remove customer content from the Internet. CloudFlare leaves the removal of online content to law enforcement agencies and complies with any legal requests made by the authorities. If we believe that one of our customers’ websites is distributing malware, CloudFlare will post an interstitial page that warns site visitors and asks them if they would like to proceed despite the warning. This practice follows established industry norms.”

In other words, CloudFlare is not going to do anything unless authorities make them.

The other hosting service DCA and RiskIQ looked at was HawkHost, whose support includes watchfreemoviesonline.top, which was found to have a 32% malware exposure rate in the research conducted for the Digital Bait report. When DCA contacted HawkHost, the company’s response was very different from CloudFlare’s, stating that the sites identified by DCA would be taken down because they “clearly violate our TOS/AUP,” according to CTO Cody Robertson. Additionally, executives at HawkHost have agreed to meet with DCA to discuss findings linking malware with content theft sites and to look for ways to better protect consumers.  DCA commends HawkHost, stating that they find the company’s response “an encouraging sign.”

DCA and RiskIQ will continue to study the link between content-theft sites and malware, as well as the legal hosting services that operate in the United States, which may be supporting malware-infested sites. These findings will be presented to State Attorneys General, who then have the authority to investigate the extent to which a particular hosting service may or may not be willfully turning a blind eye to illegal enterprise that is directly harming American consumers.  So, as mentioned, beyond any implications regarding the Google investigation itself, last week’s affirmation of AG Hood’s authority in that case is likely a good sign for protecting consumers in general from the chronic I-Didn’t-Know-Defense too-often employed by various OSPs.

Piracy is increasingly hazardous, says Digital Citizens.

I imagine most people, whether they’re users of pirate sites or not, haven’t paid much attention to the growing number of safety warnings associating content theft with identity theft and related crimes against consumers.  For one thing, the whole idea of media piracy itself has, for too long, enjoyed undeserved credibility as a so-called victimless crime performing a social good broadly described as “sharing.” Or it’s been framed in economic terms by various pundits as a natural market reaction to outdated distribution and pricing models. And more than a few notable Internet activist organizations have either explicitly or implicitly evangelized the notion that piracy is fundamentally free speech, which enables said activists to label various efforts to mitigate piracy as “chilling speech.”

But over the last year or so, several studies have been conducted—I believe I have cited most of them—which demonstrate that piracy is one thing for sure:   dangerous.   Anyone with a computer, a bank account, a business, children, etc. should probably set aside both their preconceived attitudes and their ambivalence on the subject of piracy and read this new report commissioned by Digital Citizens Alliance (DCA) and conducted by RiskIQ.  Here’s just one hypothetical scenario that can happen to anybody:

You don’t visit pirate sites yourself, but your kid might without your knowledge, or even without necessarily knowing what he’s doing. Maybe he was just looking for mods for Minecraft or innocently trying to watch some anime cartoon, and you’ve never worried much whether he’s visiting legal or illegal sites.  But simply by stumbling onto a pirate site, this new DCA report indicates that your kid is at least 28 times more likely to infect the family computer with malware that can be used to drain your bank account, slave your computer for ad fraud (as described in my recent post citing the IAB report), or seize control of your computer to hold for ransom with a 72 hour window to pay several thousand dollars or kiss your data goodbye.

The DCA/RiskIQ report is aptly named Digital Bait in that it studies a growing sophistication among cybercriminals in the use of content theft sites—and presumably even misleading “free content” links—to hook users by downloading truly insidious malware to their devices. Businesses and entrepreneurs are particularly vulnerable to Denial of Services attacks in which the hacker takes down a website and demands a considerable ransom in order to restore the site to public visibility (y’know in the name of free speech and all).

RiskIQ estimates, just from the sites within the scope of this study, that 12 million U.S. users per month are being exposed to malware attacks, and DCA says this is merely the tip of the iceberg.  According to the U.S. Department of Justice 16.2 million consumers have been victims of identity theft representing financial losses totaling more than $24.7 billion. And the problem is currently growing in both scope and sophistication in the cybercriminals’ ability to use malware to scam their victims.

For instance, one of the more disturbing developments in malware is that a user no longer has to click on an infected link to contract the virus. Called “drive-by-downloads,” the Digital Bait report estimates that 45% of the malware in the scope of its study can be delivered invisibly without requiring the user to click on anything.  The report also indicates that more than half of the malware being delivered are Trojans, and many of these are Remote Access Trojans (RATs), which I discussed in this post after DCA published a report on this relatively unsophisticated form of hacking. Individuals can buy any of several RAT software kits for a few hundred dollars and start controlling a victim’s computer with an easy-to-use graphic interface that requires little-to-no coding skill.  RATs can be used to harvest financial information or to spy on victims, including turning on webcams and microphones. Personal data can then be used for ransom; or IP addresses,  particularly of young girls, may be sold in a black market exchange.

Not surprisingly, the report identifies that all of this growing malware activity is supported by a mature, underground “crimeware economy” operating on the Dark Web.  To quote the report:

“The DarkNet allows individual hacking groups to specialize in specific categories and to earn money for delivery of goods and services to other criminals. For example, one organization may specialize in developing the malware that is installed on consumer devices and sell it on the web. Another organization will be responsible for distributing and installing the malware on consumer PCs or mobile devices. A third group that runs a forum might also purchase stolen consumer credentials and resell them in the DarkNet.”

For years, copyright owners have focused on advertising, which remains the primary revenue source for many of the most popular sites dedicated to providing unlicensed “free” content.  But as the advertising community continues to collaborate on fixing the flaws in digital advertising ecosystem, which cause financial loss and harm to brand value, this  will likely motivate cybercriminals to more aggressively dangle the lure of “free” content to draw consumers into malware traps.

On the other hand, a likely silver lining in this growing relationship between mass copyright infringement and serious harm to consumers is that copyright holders and Internet companies should find common cause in seeking both voluntary and law-enforcement remedies to the problem.  After all, the spread of malware harms the entire Internet economy, and it as much in Google’s interests as it is in the creative industries’ interests to seek solutions.

2_Infographic JPEG