Online criminals are increasingly preying on Canadians as professional, for-profit attacks on computers grow — and young people are swelling their ranks, experts told CBC News Online on Monday.

"Criminals go where the money is," Dave Marcus, a senior security strategist at McAfee Inc., said during a visit to Toronto to present the company's 2007 North American criminology report on organized crime and the internet.

Marcus, based in Davidsonville, Md., said as Canadians spend more time online and conduct more of their lives' daily activities — such as banking — online, they are becoming an increasingly attractive target to digital criminals.

JARGON

BOTNETS are networks of computers that have been hijacked by malicious groups or individuals to do their bidding. Their owners are usually unwitting victims who have no idea their machines have been infected and turned into so-called "zombies" or "bots." The zombie computers are typically used to distribute spam or phishing e-mails, or viruses and Trojans that are used to hijack other computers. Botnet operators often rent time or bandwidth on their networks to spam e-mail marketers and phishing scam artists. MALWARE is a catch-all term for malicious software such as computer viruses or spyware that compromise the security or function of personal computers. PHISHING is a technique criminals use to try to trick people into disclosing sensitive information, such as online banking names and passwords. It is often conducted through e-mails.

Of 1.1 billion internet users worldwide, some 250 million are in North America — 22 million of them in Canada, or 67.8 per cent of the country's population. In the U.S., 211.1 million people or 69.9 per cent of the population, are online.

Those kinds of figures make North Americans an attractive target.

"Just today, I received a phishing e-mail designed to look like it was from a Canadian bank — and I know it was a phishing e-mail because I don't have a Canadian bank account," said James Lewis of the Center for Strategic and International Studies in Washington, D.C.

 

JARGON

PHARMING is an attack in which malicious individuals try to redirect traffic from one website to a false one. This is sometimes done to collect a person's login or password information. TROJANS are programs that appear to perform one function in order to hide a malicious one. Like the mythological Trojan horse such programs are named after, the deception tricks people into granting criminals access to a computer. ZOMBIES are computers that have been hijacked to perform commands and functions issued to them by the attackers, often without the owners' knowledge. They are typically infected by Trojans, a type of software that enable attackers to use them in a botnet. An infected computer is sometimes referred to as a bot — short for robot.

The internet crime researcher said in Toronto that the landscape for online threats has changed dramatically over the last few years but is no less challenging for security professionals trying to fend off attackers.

"It's a problem that isn't going away, but it's certainly getting more exciting [for security workers]," Lewis said.

The big developments in online crime include:

• Its increasingly professional nature.
• Criminals emulating online social trends.
• The entrenchment of networks of zombie computers as their weapon of choice.

"We still think of teenagers doing this for fun," Lewis said. "Those people are still out there," but the malicious software and hacking trade is now largely a professional enterprise, he said.

"You can find them in Brazil, you can find them in Asia, and — I'm sorry to say — in Canada," he explained, noting regions that are at high risk of attack.

Another trend is the rise of social communities of online criminals, Lewis said.

"The social communities on the internet like MySpace and YouTube — there are also communities about security" for malware authors and malicious hackers, he said.

Criminals recruiting young people

And just as social networking sites like MySpace and Facebook are popular with teenagers, professional computer criminals are exploiting technology-savvy teens through underground online social networks to maximize profits, said Danielle Fournier, general manager of McAfee Canada.

"The age and demographics are interesting," Fournier said. "A few years ago it was all fun for them," she said of the teenagers. "Now at the age of 15, they can make a lot of money [by working for online criminals, writing malware or hacking].

"It raises interesting questions. How do I as a mother make it difficult for them to do that? They are now recruiting more and more children for criminal acts."

The professionalization of online crime is directly contributing to that recruitment, Fournier said, noting the economic and legal advantages criminals see in children.

"If you offer a younger person the same amount [of money for a job] as an older person, you can get three times as much work out of them, she said.

'They are now recruiting more and more children for criminal acts.'— Danielle Fournier, McAfee Canada GM on internet crime

The children often have a legal leg up on adult counterparts since they may be immune to or protected from severe criminal prosecution if they get caught.

Security researchers have previously observed a rise in online crime in the summer months, which correlates with the period during which many schools break for vacation and students are looking for work.

"School's out for summer — how'd you like to make an easy 10 grand?" Fournier mimicked the sales pitch professional online criminals give technologically adept teens. "We are finding more and more interest [in these activities] in the younger generation."

Zombie botnets growing

But the biggest trend in online crime is the establishment of botnets as the vehicle of choice to deliver all manner of online attacks, from spam and phishing e-mail to viruses and more.

"Botnets are the new big thing," Lewis said. "The botnet is the wave of the future."

Yet, unlike the past, the tool is being used less for massive attacks, and increasingly as a means to steal profitable data from businesses and consumers alike.

"In 2006, how many global outbreaks were there?"  Marcus asked. "None. But there were 29,000 new pieces of malware."

Online crime is flourishing because of the difficulty of finding and successfully prosecuting the criminals behind it, Lewis said.

"The risk of getting caught if you commit a cybercrime is … close to zero," Lewis said.

'The botnet is the wave of the future.'—James Lewis, Center for Strategic and International Studies

The reasons? The activity tends to cross international boundaries and police don't have the time, funding or legal avenues to pursue the criminals, he said.

"You could stand on the corner in the rain waiting to mug someone or you could do a cybercrime" and make tens of thousands of dollars in minutes or even seconds, Lewis said. "You can attack in seconds and be gone in seconds."

That potential for low risk and high reward makes internet crime exceptionally attractive, Marcus said: "It's all about the numbers."

Tips to stay safe

The best way for people to protect themselves is to keep their security software up-to-date and avoid risky behaviour online, Marcus said.

"Thirty-five per cent of music shared through peer-to-peer applications is infected by malware," Marcus said as an example. "It's very effective [as a malware delivery vehicle]."

McAfee found that internet searches for filesharing services yielded a high degree of risky results. Searches for "Bearshare" returned 45.9 per cent risky links; "Limewire" gave a 37.1 per cent rate of risk; and "Kazaa" delivered a 34.9 portion of suspect search results.

Similarly, searches for adult content online had a high proportion of suspect links at 9.4 per cent — a 17.5-per-cent rise since December 2006.

"There are neighbourhoods on the internet that have dark streets you don't want to go down," Marcus said. "It's an education issue."