Crimeware: Understanding New Attacks and Defenses by Markus JakobssonCrimeware: Understanding New Attacks and Defenses by Markus Jakobsson

Crimeware: Understanding New Attacks and Defenses

byMarkus Jakobsson, Zulfikar Ramzan

Paperback | April 6, 2008

Pricing and Purchase Info

$61.20 online 
$67.99 list price save 9%
Earn 306 plum® points

Ships within 1-2 weeks

Ships free on orders over $25

Not available in stores


“This book is the most current and comprehensive analysis of the state of Internet security threats right now. The review of current issues and predictions about problems years away are critical for truly understanding crimeware. Every concerned person should have a copy and use it for reference.”

—Garth Bruen, Project KnujOn Designer


There’s a new breed of online predators—serious criminals intent on stealing big bucks and top-secret information—and their weapons of choice are a dangerous array of tools called “crimeware.” With an ever-growing number of companies, organizations, and individuals turning to the Internet to get things done, there’s an urgent need to understand and prevent these online threats.


Crimeware: Understanding New Attacks and Defenses will help security professionals, technical managers, students, and researchers understand and prevent specific crimeware threats. This book guides you through the essential security principles, techniques, and countermeasures to keep you one step ahead of the criminals, regardless of evolving technology and tactics. Security experts Markus Jakobsson and Zulfikar Ramzan have brought together chapter contributors who are among the best and the brightest in the security industry. Together, they will help you understand how crimeware works, how to identify it, and how to prevent future attacks before your company’s valuable information falls into the wrong hands. In self-contained chapters that go into varying degrees of depth, the book provides a thorough overview of crimeware, including not only concepts prevalent in the wild, but also ideas that so far have only been seen inside the laboratory.


With this book, you will 

  • Understand current and emerging security threats including rootkits, bot networks, spyware, adware, and click fraud
  • Recognize the interaction between various crimeware threats
  • Gain awareness of the social, political, and legal implications of these threats
  • Learn valuable countermeasures to stop crimeware in its tracks, now and in the future
  • Acquire insight into future security trends and threats, and create an effective defense plan
  • With contributions by Gary McGraw, Andrew Tanenbaum, Dave Cole, Oliver Friedrichs, Peter Ferrie, and others.

Markus Jakobsson, Ph.D., is currently principal scientist at Palo Alto Research Center and an adjunct associate professor at Indiana University. The coauthor of more than one hundred peer-reviewed articles and co-inventor of more than fifty patents, Markus studies the human factor of security and cryptographic protocols with an emphas...
Title:Crimeware: Understanding New Attacks and DefensesFormat:PaperbackDimensions:608 pages, 9.1 × 6.9 × 1.4 inPublished:April 6, 2008Publisher:Pearson EducationLanguage:English

The following ISBNs are associated with this title:

ISBN - 10:0321501950

ISBN - 13:9780321501950


Read from the Book

Traditionally, malware has been thought of as a purely technical threat, relying principally on technical vulnerabilities for infection. Its authors were motivated by intellectual curiosity and, sometimes, by competition with other malware authors. This book draws attention to the fact that this is all history. Infection vectors of today take advantage of social context, employ deceit, and may use data-mining techniques to tailor attacks to the intended victims. Their goal is profit or political power. Malware has become crimeware. That is, malware has moved out of basements and college dorms, and is now a tool firmly placed in the hands of organized crime, terror organizations, and aggressive governments. This transformation comes at a time when society increasingly has come to depend on the Internet for its structure and stability, and it raises a worrisome question: What will happen next? This book tries to answer that question by a careful exposition of what crimeware is, how it behaves, and what trends are evident. The book is written for readers from a wide array of backgrounds. Most sections and chapters start out describing a given angle from a bird’s-eye view, using language that makes the subject approachable to readers without deep technical knowledge. The chapters and sections then delve into more detail, often concluding with a degree of technical detail that may be of interest only to security researchers. It is up to you to decide when you understand enough of a given issue and are ready to turn to another chapter. Recognizing that today’s professionals are often pressed for time, this book is written so that each chapter is relatively self-contained. Rather than having each chapter be sequentially dependent on preceding chapters, you can safely peruse a specific chapter of interest and skip back and forth as desired. Each chapter was contributed by a different set of authors, each of whom provides a different voice and unique perspective on the issue of crimeware. This book is meant for anyone with an interest in crimeware, computer security, and eventually, the survivability of the Internet. It is not meant only for people with a technical background. Rather, it is also appropriate for makers of laws and policies, user interface designers, and companies concerned with user education. The book is not intended as a guide to securing one’s system, but rather as a guide to determining what the problem really is and what it will become. Although we often use recent examples of attacks to highlight and explain issues of interest, focus here is on the underlying trends, principles, and techniques. When the next wave of attacks appears—undoubtedly using new technical vulnerabilities and new psychological twists—then the same principles will still hold. Thus, this book is meant to remain a useful reference for years to come, in a field characterized by change. We are proud to say that we think we have achieved this contradictory balance, and we hope that you will agree.

Table of Contents

Preface xvii

About the Authors xxi


Chapter 1: Overview of Crimeware 1

1.1 Introduction 2

1.2 Prevalence of Crimeware 4

1.3 Crimeware Threat Model and Taxonomy 5

1.4 A Crimeware Menagerie 8

1.5 Crimeware Distribution 19

1.6 Infection and Compromise Points, Chokepoints, and Countermeasures 25

1.7 Crimeware Installation 29

1.8 Crimeware Usage 31

1.9 Organizing Principles for the Remainder of This Text 35


Chapter 2: A Taxonomy of Coding Errors 37

2.1 The Trinity of Trouble 38

2.2 The Seven Pernicious Kingdoms 40

2.3 The Phyla 46

2.4 More Phyla Needed 52


Chapter 3: Crimeware and Peer-to-Peer Networks 55

3.1 Malware in Peer-to-Peer Networks 55

3.2 Human-Propagated Crimeware 76


Chapter 4: Crimeware in Small Devices 83

4.1 Propagation Through USB Drives 83

4.2 Radio Frequency ID Crimeware 89

4.3 Mobile Crimeware 99


Chapter 5: Crimeware in Firmware 103

5.1 Propagation by Firmware Updates 103

5.2 Modeling WiFi Malware Epidemics 130


Chapter 6: Crimeware in the Browser 155

6.1 Transaction Generators: Rootkits for the Web 155

6.2 Drive-By Pharming 160

6.3 Using JavaScript to Commit Click Fraud 167


Chapter 7: Bot Networks 183

7.1 Introduction 183

7.2 Network-Oriented Features of Botnets 188

7.3 Software Features of Bots 205

7.4 Web Bots and the General Future of Botnets 215

7.5 Countermeasures 224


Chapter 8: Rootkits 229

8.1 Introduction 229

8.2 Evolution of Rootkits 231

8.3 User-Mode Windows Rootkits 233

8.4 Kernel-Mode Rootkit Techniques 240

8.5 Linux Rootkits 260

8.6 BIOS Rootkits 264

8.7 PCI Rootkits 265

8.8 Virtual Machine—Based Rootkits 267

8.9 Rootkit Defense 271


Chapter 9: Virtual Worlds and Fraud 275

9.1 Introduction 275

9.2 MMOGs as a Domain for Fraud 278

9.3 Electronic Fraud 283

9.4 Fraud in MMOGs 285


Chapter 10: Cybercrime and Politics 293

10.1 Domain Name Abuse 295

10.2 Campaign-Targeted Phishing 307

10.2.1 Profit-Motivated Phishing 307

10.3 Malicious Code and Security Risks 312

10.4 Denial-of-Service Attacks 315

10.5 Cognitive Election Hacking 316

10.6 Public Voter Information Sources: FEC Databases 319

10.7 Intercepting Voice Communications 320


Chapter 11: Online Advertising Fraud 325

11.1 History 325

11.2 Revenue Models 326

11.3 Types of Spam 332

11.4 Forms of Attack 335

11.5 Countermeasures 342

11.6 Click Fraud Auditing 347

11.7 The Economics of Click Fraud 352


Chapter 12: Crimeware Business Models 355

12.1 The Crimeware Business 355

12.2 A Closer Look at Adware 386


Chapter 13: The Educational Aspect of Security 397

13.1 Why Education? 397

13.2 Case Study: A Cartoon Approach 408


Chapter 14: Surreptitious Code and the Law 413

14.1 Introduction 413

14.2 The Characteristics of Surreptitious Code 415

14.3 Primary Applicable Laws 418

14.4 Secondary Applicable Laws 430


Chapter 15: Crimeware and Trusted Computing 457

15.1 Introduction 457

15.2 Anatomy of an Attack 458

15.3 Combating Crimeware with Trusted Computing 460

15.4 Case Studies 466


Chapter 16: Technical Defense Techniques 473

16.1 Case Study: Defense-in-Depth Against Spyware 475

16.2 Crimeware-Resistant Authentication 484

16.3 Virtual Machines as a Crimeware Defense Mechanism 510


Chapter 17: The Future of Crimeware 515

17.1 Crimeware, Terrorware, Vandalware, and Ransomware 515

17.2 New Applications and Platforms 517

17.3 Using Social Networks to Bootstrap Attacks 520

17.4 New Use of the Internet: Controlling the Infrastructure 520

17.5 Moving Up the Stack 520

17.6 The Emergence of an E-Society: Are We Becoming More Vulnerable? 521

17.7 The Big Picture 522


References 525

Index 557