Facebook has donated $250,000 to The Center for Information Assurance and Joint Forensics Research, location at the University of Alabama at Birmingham. That’s CIA|JFR at UAB, for short.

CIA|JFR is a “multidisciplinary research center with a broad focus on Information Assurance, and how our modern connected society impacts that information.” They first focus on research and development, and then use those tools in outreach to law enforcement, governmental agencies, and companies (like Facebook). They say that they are working to “ensure a safer, more productive world for citizens of the 21st century.”

According to Facebook, the donation was partly inspired by the program’s work in helping to track the criminals behind social media botnet Koobface, among other spammers and cyber criminals. Apparently, the money is “recovered” money, coming from various spammers around the globe.

Facebook Security13 minutes ago

The Center for Information Assurance and Joint Forensics Research at the University of Alabama at Birmingham has received a $250,000 donation from Facebook in recognition of the center’s role in tracking international criminals behind social-media botnet Koobface as well as other spammers. The donation, which comes from money Facebook has recovered from spammers located around the world, will be used to expand the new CIA|JFR headquarters. Learn more:

Facebook donates recovered money to UAB cybercrime group
The Center for Information Assurance and Joint Forensics Research at the University of Alabama at Birmingham has received a $250,000 donation from Facebook.

Powered by socialditto  321 likes ·  23 comments

“As a result of numerous collaborations over the years, Facebook recognizes the center as both a partner in fighting Internet abuse, and as a critical player in developing future experts who will become dedicated cybersecurity professionals,” said Joe Sullivan, chief security officer at Facebook. “The center has earned this gift for their successes in fighting cybercrime and because of the need for formal cybersecurity education to better secure everyone’s data across the world.”

According to UAB, the money will be used to expand the CIA|JFR headquarters on the school’s campus. They expect the “Facebook suite” to be ready to go by February of 2013, where it will be unveiled to the world at their second-annual Cyber Summit.

Last week, Facebook also announced a partnership with seven new partners in order to help beef up their Anti-Virus Marketplace.

The 2012 Cost of Cyber Crime Study, conducted by the Ponemon Institute and sponsored by HP, found that the average annual cost of cybercrime for U.S. organizations was $8.9 million in 2012. That amount is 6% more than the $8.4 million average costs of cybercrime in 2011, and a 38% increase over the 2010 average of $6.5 million.

The report also shows a 42% increase in the number of cyberattacks in 2012. This year, organizations experienced an average of 102 successful attacks per week, compared to 72 attacks per week in 2011 and 50 attacks per week in 2010.

“A successful attack is one that infiltrates or infects an enterprise system,” said Larry Ponemon, chairman and founder of the Ponemon Institute, who spoke with WebProNews. “We’re really looking at things that stick, rather than bounce off a company’s firewall or other perimeter protections.”

Ponemon has served on the Advisory Committee for Online Access & Security for the U.S. Federal Trade Commission and was appointed by the White House to the Data Privacy and Integrity Advisory Committee for the Department of Homeland Security.

Though the total average cost of cybercrime is on the rise, the report shows that companies incur costs differently according to their size and the industry they are associated with. Ponemon shows that while organizations they classify as small have lower annual cybercrime costs, their per capita cybercrime costs ($1,324) are much higher than larger organizations ($305). Organizations in the defense, utilities & energy, and financial services industries have higher costs associated with cybercrime than those in other industry segments, such as retail, hospitality, and consumer products.

This is the first year the report has expanded past U.S. companies, looking at businesses in the U.K., Germany, Japan, and Australia. According to Ponemon, the U.S. and Germany were much more likely to be hit with cyberattacks, and a larger percentage of their external costs due to cybercrime came from information loss. The majority of the U.K.’s and Australia’s external costs came from business disruption, meaning their internal costs largely consisted of recovering from cyberattacks, while the U.S. and Germany spent more internally on detection.

Several security solutions are advised by the Ponemon report. It shows that a “strong security posture” based on the Security Effectiveness Score (SES) metric can mitigate the average cost of cyberattacks. Strong security governance practices are encouraged as well, with the report showing that organizations that invest adequately in security resources, appoint a high-level security leader, and employ experts can reduce their cybercrime costs.

The report also found that, unsurprisingly, deployment of security intelligence systems can make a difference in the costs companies incur as a result of cybercrime. It shows that organizations that deploy security intelligence technologies saved an average of $1.6 million compared to those that did not.

“The purpose of this benchmark research is to quantify the economic impact of cyberattacks and observe cost trends over time,” said Ponemon. “We believe a better understanding of the cost of cybercrime will assist organizations in determining the appropriate amount of investment and resources needed to prevent or mitigate the devastating consequences of an attack.”

HP believes its security services are just the sort of resources companies need to safeguard their network infrastructures. The company recently updated its enterprise security solutions, focusing on proactively protecting customers rather than reacting to cyberattacks. HP will also sponsor a series of live webinars, presented by Larry Ponemon, starting later this month. The webinars will detail the findings of the Ponemon report for the individual countries in which the study was conducted.

“Organizations are spending increasing amounts of time, money and energy responding to cyberattacks at levels that will soon become unsustainable,” said Michael Callahan, vice president of Worldwide Product and Solution Marketing, and Enterprise Security Products at HP. “There is clear evidence to show that the deployment of advanced security intelligence solutions helps to substantially reduce the cost, frequency and impact of these attacks.”

Varun Kohli, director of Product Marketing for Enterprise Security Products at HP told WebProNews that the Ponemon report provides conclusive data for security teams trying to sell their worth to executives, who often don’t see value in comprehensive preventative security solutions. His advice to organizations is to “bake-in” security to their solutions by making the solutions “intelligent” and “protecting what matters.”

“If it doesn’t neet to be on the internet, don’t put it on the internet,” said Kohli.

Unfortunately, many of the rules that help protect people from cybercrime go out the window as soon as we bring social or mobile into the picture. Both areas are still largely unexplored with hackers creating new malware all the time. It’s hard to keep up with the ever evolving social and mobile scene, and it shows in Norton’s statistics.

Norton recently published their annual Cybercrime Report and the results are a little terrifying. It shows that hackers are getting smarter with how they use social or mobile to their advantage. It’s sometimes hard to differentiate a scam versus a legitimate request when on a mobile phone.

Of course, our first problem lies in something very simple. The study found that two-thirds of adults use a mobile device to browse the Internet. The same number of adults don’t have mobile security software installed on their device. It’s especially problematic when 31 percent of respondents claim to have received a text message from a stranger that contained a link. A mobile anti-virus would normally be able to scan the link before you clicked on it to make sure it was safe.

It gets scarier when it comes to the more personal nature of social networks. Four out of 10 people have reported being a victim of cybercrime while using a social network. Out of that, one of out of six users found that somebody hacked into their profile and posted as them.

That last statistic is by far the most frightening as attacks can now come from people you normally trust. You may see that your friend is linking to something like, “You won’t believe what this man did to save his dog.” It sounds like a good story and you’re more than willing to install the Facebook to read just a single story. Before you know it, you’re infected with malware that came about through a simple social engineering Facebook hack.

Once again, it’s important to remember the number one rule when dealing with potential malware – use common sense. Never allow a Facebook application to install anything on your browser unless it’s from a trusted source. Such applications could still be malware in disguise regardless of who sent it. Your best friend could have had their profile taken over by a reprehensible Internet bandit.

If anything, Norton’s study shows that we must always be vigilant. Norton is obviously wanting you to buy their anti-virus software, but most anti-viruses, even the free ones, do a pretty good job of keeping your PC secure. As for mobile and social attacks, use a mobile anti-virus app and stay vigilant.

I won’t go into the ins and outs of how Bitcoins work since I covered that pretty extensively last month, but here’s the Cliff’s notes version: Bitcoin is a decentralized, virtual currency that operates on a peer-to-peer network. You will never hold a bitcoin as it exists only only online. Use of Bitcoins is mostly anonymous. There is a finite amount of Bitcoins that will ever be produced, which is how the market is regulated from over-production. Currently, the exchange rate of Bitcoins to U.S. dollars is about 1 Bitcoin to $4 or $5.

The FBI report highlights some insightful details about the current economy of Bitcoins. For any Doubting Thomases who had written off Bitcoins as a fad, the report details some lucrative highlights:

As of 18 April 2012, the third-party bitcoin trading platform Mt. Gox recorded more than $8 million in transactions conducted over the past 30 days through Mt. Gox trading, an average of more than $276,000 per day.

According to Bitcoin as of April 2012, there were more than 8.8 million bitcoins in circulation. With the average market price in
April 2012 between $4 and $5 per bitcoin, the FBI estimates the Bitcoin economy was worth $35 million to $44 million.

The report goes on to detail the ways in which Bitcoins have already been manipulated to conduct illegal activity, such as a money laundering scheme via an online role-playing game or how Bitcoins have been thieved from third-party services by hackers. Indeed, if you’re using Bitcoins you probably should fear the threat of getting hacked a bit more than the feds, but if the multi-signature security that Gavin Andresen, the Lead Core Developer of Bitcoin, is working on, that threat will be less, well, threatening.

One of Bitcoins’ greatest appeals is how it mostly keeps the identity of the user anonymous, although this isn’t fail-proof, either. In a classic example of cutting off one’s nose to spite the face, the FBI lists ways in which Bitcoin users can be identified, which should be a tip-off for Bitcoins users on what not to do if they really want to avoid being tracked down (hint: according to the report, it involves laundering Bitcoins through third-party services registered outside the U.S). Wired actually went a step further and compiled a to-do list gleaned from the FBI report on other steps Bitcoin users can take to ensure their anonymity:

Create and use a new Bitcoin address for each incoming payment.

Route all Bitcoin traffic through an anonymizer.

Combine the balance of old Bitcoin addresses into a new address to make new payments.

Use a specialized money-laundering service.

Use a third-party eWallet service to consolidate addresses. Some third-party services offer the option of creating an eWallet that allows users to consolidate many bitcoin address and store and easily access their bitcoins from any device.

Individuals can create Bitcoin clients to seamlessly increase anonymity (such as allowing users to choose which Bitcoin addresses to make payments from), making it easier for non-technically savvy users to anonymize their Bitcoin transactions.

Although, given that the FBI knows how Bitcoin users can improve anonymity, you should probably assume that the agency is already working on ways to work around these steps, so caveat emptor, Bitcoiners.

The teen had allegedly attempted to blackmail Russian businessman Suleiman Kerimov, who is worth roughly $7.8 billion, by sending him emails claiming that he was a hitman ordered to kill the oligarch, but would stop with the killing for $10 million. Kerimov, #146 of Forbes world’s richest, wasn’t playing around, and apparently rallied a task force from Moscow to fly in to St. Petersburg to drop in on the teen at 6 AM last Tuesday. In Russia, one has to have a bit of pull to command this sort of operation, as the government doesn’t mobilize in regards to all crimes. The kid had recently tried to threaten St. Petersburg City Hall’s energy department chief Vladislav Petrov, who was able to track his IP, but was not in the position to rally law enforcement to do anything about it, besides set up a bit of surveillance. When Kerimov received the threats, the operation against the teen became fully orchestrated from the Moscow headquarters, which is said to be a rarity.

While cybercrime in Russia is commonplace, it would seem that one runs into problems if Russian, while trying to extort other Russians. It is evident that after the teen began threatening Kerimov, the billionaire likely got into contact with “someone equal to him in status. It must have been either head of the Federal Security Service, Alexander Bortnikov, or the Interior Minister Rashid Nurgaliev.”

Either way, the teen, who apparently had no idea what he was doing, was deemed to never have been an actual threat. After confessing to the entire thing, he was charged with extortion, and claimed that he actually thought he was going to get the money. He is currently under house arrest – his offense carries up to four years in a Russian prison.

Shanzhai, the Chinese outfit that copies Apple products, and maker of the D-Pad and the E-Pad, is blamed for taking part in cutting into 2.1 million U.S. jobs, at a loss of $48 billion in legitimate sales. So far, 22 completely fake Apple stores have been uncovered in China, featuring employees that actually believe their paychecks are coming from Cupertino, and there is no word on whether the fronts are selling real iOS products, Shanzhai knock-offs or straight counterfeits. And, the fact that Chinese counterfeiters operate so freely goes to show that the country’s intellectual property laws are a bit more loose than those in the U.S.

Chinese users of its version of Facebook presently outnumber the entire population of the United States, and cybercrime is rampant – The U.S. Chamber of Commerce was hacked in 2010, promopting many companies to disallow employees visiting China from bringing mobile devices along, for fear of information being compromised.

Hat tip to Web Hosting Geeks

While technically still a form of cybercrime, hacktivism — the breaching of digital security systems, usually accompanied by the breaking of anti-hacking laws, as a form of political protest — is largely crime in the way that other forms of civil disobedience is a crime. Proponents of the activity claim that they’re following the tradition of thinkers like Thoreau, Gandhi, and Martin Luther King Jr, only they’re playing out their disobedience on today’s most relevant political stage (the Internet). Of course, some actual participants in hacktivism shy away from allegations too pure intentions. Sure, they deface corporate websites with manifestos, track down and assail child porn rings, and leak sensitive information in the name of transparency, but hacktivists are also in it for the lulz (laughs, pranks), and sometimes even for free pr0n (porn). When asked why it chose to break into porn site Digital Playground, hacking group @Th3 Consortium (an affiliate of the Anonymous movement) tweeted: “We are pirates, what did you expect?” Still morally ambiguous, but increasingly used as a form of legitimate dissent, hacktivism is a burgeoning online activity.

If you want a quick rundown of the rise of and principles behind hacktivism, check out the infographic below, which comes to you graciously via Frugal Dad.

I enjoyed infographic’s mention of the first overtly political attack, the “WANK Worm,” by Australian hackers Electron and Phoenix. Launched in 1989 over the DECnet and affecting NASA and the U.S. Department of Energy, the worm was playful in nature, tricking employees into thinking their files were being deleted. The line “You talk of times of peace for all, and then prepare for war,” found under the worm’s logo, is from the Midnight Oil song Blossom and Blood.

One thing that surprises me is the stats on the top 5 countries hackers reside in. First of all, should I be proud of the rebellious-to-criminal nature and technical prowess of my compatriots, who (according to this infographic) make up two-thirds of all hackers? Second, I’m surprised not to see Russia in the top 5, given the country’s reputation as a hacker’s haven. Finally, how do you get data like this? Is it based on reported crimes, tracing anonymous attacks back to their source, or the number of arrests? Moreover, does it count major attacks, every instance of computer fraud, or every script kiddie on the Web? Given the secretive nature of cyber attacks, I’d take these figures at best as approximations, and at worst with several grains of salt. And, of course, data about cybercrime is constantly in flux.

All told, this is a well-done infographic that gives you a concise and fairly accurate rundown of the state and nature of hacking — and especially hacktivism — today. Frugal Dad suggests that to “avoid getting caught in the crossfire of the virtual wars,” you “stay alert online and report phishing scams and sites that compromise personal information.” To that I’ll add: keep your antivirus software up-to-date, think twice before downloading freeware and attachments, and minimize the amount of personal information you post to the Web.

Of course, if you really want to protect yourself, learn to code, run Linux, and trust no one.

Source: frugaldad.com

[Via Frugal Dad, Image Source: InfoBarrel]

The men arrested are suspected of being members of a Moscow-based gang that was going after the bank accounts Russian Nationals, bringing in about $2 million since October 2011. The scheme involved using malware to steal login creditionals for victims’ accounts, to transfer funds to accounts controlled by the gang. About 90 accounts were compromised, and money was also withdrawn from various Moscow ATMs, according to the Russian Interior Ministry.

Police suspect the that ringleaders of the gang are two brothers, aged 29 and 32. They had rented an office under the guise of a legitimate computer business, using it as a front to skim off of the bank accounts. In a raid, police recovered computer equipment, bank cards, roughly $250,000 in cash and various forged documents. The men were charged with theft, computer hacking and malware distribution, and await trial while on house arrest. They all face up to ten years in prison.

Russia and the Ukraine are said to be safe havens for cybercrime. Perhaps the gang wouldn’t have been apprehended if they’d went for the accounts of outsiders, and didn’t target Russian Nationals.

In related legal news in the region, it has been reported that a Russian court has upheld a ban on Scientology literature.

Anonymous PR Wing @YourAnonNews announced its suspicions on Twitter last night. If there’s anything to their claims, this is some serious spy-versus-spy stuff:

Earlier today the group published this timeline of #AntiSec, highlighting perceived correlations between LulzSec leader Sabu’s (Hector Xavier Monsegur) arrest and legal proceedings, his acquisition and sharing of security data with Anonymous affiliates, the formation of #AntiSec, and last week’s arrest of five suspected hackers.

Timeline of ANTISEC as Created and Operated Under FBI Supervision

#AntiSec was first announced on Twitter, the timeline asserts, at nearly the same time that Sabu was arrested

The same day, an #AntiSec release statement was posted on pastebin, encouraging widespread advertising the of “AntiSec” brand on both the digital and physical landscape:

Welcome to Operation Anti-Security (#AntiSec) – we encourage any vessel, large or small, to open fire on any government or agency that crosses their path. We fully endorse the flaunting of the word “AntiSec” on any government website defacement or physical graffiti art. We encourage you to spread the word of AntiSec far and wide, for it will be remembered. To increase efforts, we are now teaming up with the Anonymous collective and all affiliated battleships.

And a specific call was made to acquire sensitive government information:

Top priority is to steal and leak any classified government information, including email spools and documentation. Prime targets are banks and other high-ranking establishments.

A week later, LulzSec announced its disbandment and Sabu announced his allegience to #AntiSec.

YourAnonNews cites these correlations as evidence that #AntiSec was formed by Sabu after his turning federal informant, and thus that #AntiSec was a creation of the U.S. Government. You can examine the rest of the alleged evidence for yourself in the pages above.

While it will be nearly impossible to verify the validity of this timeline (and thus, the culpability of federal investigators in instigating #AntiSec and its attacks), the above timeline at least makes for some interesting reading with even more interesting implications (provided it’s accurate). If #AntiSec was a government creation, then that would make federal authorities at least marginally culpable for attacks carried out under the #AntiSec banner, especially any attacks that were instigated by their informant, or that were the result of information leaked by authorities. With strong enough evidence, this could even be a case for entrapment in the defense trials of alleged hackers recently arrested for #AntiSec-related crimes. Again, however, to prove such direct culpability of federal investigators would be a herculean task.

FBI involvement or no, the #AntiSec banner has grown far beyond the control of its creators, whoever they may be. But my head is spinning. I’m going to go write about something simple for a while.

YourAnonNews also published a 506-page pdf archive of all of Sabu’s tweets since November 2011. While we didn’t include it in this post, you can peruse it here if you’re feeling nosy.

As a part of the pastebin dump, Agent_Anon accused the Vatican and the Catholic church of a centuries-long history of crimes, including a list of nineteen specific grievances relating to crimes against humanity, archaic policies toward reproductive issues, and opposition to scientific progress. “This theocracy needs to either enter the real world with modern ideals, or fall behind an become part of history,” the Anonymous operative asserted in his pastebin manifesto.

I won’t include the entire list of grievances, many of which included allegations of severe crimes or ethical breaches by the church, but I will mention the final grievance on the list, which I found amusingly worded:

The church fucked with Galileo. No one fucks with Galileo. He’s my bro.

Here’s a screen cap from pastebin. Warning to sensitive readers: it contains some offensive language.

As a part of the attack, members of Anonymous claim Catholic.va is currently under DDoS attack. At the time of writing, my browser couldn’t find the server, though a search of both Google and Yahoo revealed no record of the site in question. The similarly named Catholic.org was, however, operational.

Last week’s arrest and indictment of several Anonymous-affiliated hackers may have been a heavy legal blow to the movement. But if authorities were hoping the arrests would demoralize Anonymous members worldwide, I’m not so sure they achieved their goals. The recent frequency of Anonymous attacks suggests that, if anything, previously dormant hackers are mobilizing, and new groups are forming quickly to fill old shoes.