Surf Wiki
Save to docs
general/types-of-malware

From Surf Wiki (app.surf) — the open knowledge base

Crimeware

Class of malware designed specifically to automate cybercrime

Class of malware designed specifically to automate cybercrime

Crimeware is a class of malware designed specifically to automate cybercrime.

Crimeware (as distinct from spyware and adware) is designed to perpetrate identity theft through social engineering or technical stealth in order to access a computer user's financial and retail accounts for the purpose of taking funds from those accounts or completing unauthorized transactions on behalf of the cyberthief. Alternatively, crimeware may steal confidential or sensitive corporate information. Crimeware represents a growing problem in network security as many malicious code threats seek to pilfer valuable, confidential information.

The cybercrime landscape has shifted from individuals developing their own tools to a market where crimeware, tools and services for illegal online activities, can be easily acquired in online marketplaces. These crimeware markets are expected to expand, especially targeting mobile devices.

The term crimeware was coined by David Jevans in February 2005 in an Anti-Phishing Working Group response to the FDIC article "Putting an End to Account-Hijacking Identity Theft".

Examples

Criminals use a variety of techniques to steal confidential data through crimeware, including through the following methods:

  • Surreptitiously install keystroke loggers to collect sensitive data—login and password information for online bank accounts, for example—and report them back to the thief.
  • Redirect a user's web browser to a counterfeit website controlled by the thief even when the user types the website's proper domain name in the address bar, also known as pharming.
  • Steal passwords cached on a user's system.
  • Hijack a user session at a financial institution and drain the account without the user's knowledge.
  • Enable remote access into applications, allowing criminals to break into networks for malicious purposes.
  • Encrypt all data on a computer and require the user to pay a ransom to decrypt it (ransomware).

Delivery vectors

Crimeware threats can be installed on victims' computers through multiple delivery vectors, including:

  • Vulnerabilities in Web applications. The Bankash.G Trojan, for example, exploited an Internet Explorer vulnerability to steal passwords and monitor user input on webmail and online commerce sites.
  • Targeted attacks sent via SMTP. These social-engineered threats often arrive disguised as a valid e-mail message and include specific company information and sender addresses. The malicious e-mails use social engineering to manipulate users to open the attachment and execute the payload.
  • Remote exploits that exploit vulnerabilities on servers and clients

Concerns

Crimeware can have a significant economic impact due to loss of sensitive and proprietary information and associated financial losses. One survey estimates that in 2005 organizations lost in excess of $30 million due to the theft of proprietary information. The theft of financial or confidential information from corporate networks often places the organizations in violation of government and industry-imposed regulatory requirements that attempt to ensure that financial, personal and confidential.

United States

US laws and regulations include:

  • Sarbanes-Oxley Act
  • Health Insurance Portability and Accountability Act (HIPAA)
  • Gramm-Leach-Bliley Act
  • Family Educational Rights and Privacy Act
  • California Senate Bill 1386 (2002)
  • Payment Card Industry Data Security Standard

References

References

  1. (6 April 2008). "Crimeware: Understanding New Attacks and Defenses". Addison-Wesley Professional.
  2. Gad, Mamoud. (2014). "Crimeware Marketplaces and Their Facilitating Technologies". Technology innovation management review.
  3. (5 January 2004). "Putting an End to Account-Hijacking Identity Theft". Federal Deposit Insurance Corporation.
  4. "[https://www.nytimes.com/2006/02/27/technology/27hack.html?ex=1163998800&en=5599d5982c64f082&ei=5070 Cyberthieves Silently Copy Your Password]", ''[[The New York Times]]''
  5. Swinhoe, Dan. (2020-04-23). "Pharming explained: How attackers use fake websites to steal data".
  6. ''Symantec Internet Security Report'', Vol. '''IX''', March 2006, p. 71
  7. "[http://www.avinti.com/download/market_background/whitepaper_email_crimeware_protection.pdf Protecting Corporate Assets from E-mail Crimeware]" {{webarchive. link. (January 21, 2012 Avinti, Inc., p.1,)
  8. Sood, Aditya. (2013). "Crimeware-as-a-service—A survey of commoditized crimeware in the underground market". International Journal of Critical Infrastructure Protection.
  9. CSI/FBI ''Computer Crime and Security Survey 2005'', p.15
Info: Wikipedia Source

This article was imported from Wikipedia and is available under the Creative Commons Attribution-ShareAlike 4.0 License. Content has been adapted to SurfDoc format. Original contributors can be found on the article history page.

types-of-malware cybercrime
Want to explore this topic further?

Ask Mako anything about Crimeware — get instant answers, deeper analysis, and related topics.

Research with Mako

Free with your Surf account

Content sourced from Wikipedia, available under CC BY-SA 4.0.

This content may have been generated or modified by AI. CloudSurf Software LLC is not responsible for the accuracy, completeness, or reliability of AI-generated content. Always verify important information from primary sources.

Report