Subject: [Asrg] fwd (nanog) Over three million computers 0wned?

From: Eric Brunner-Williams in Portland Maine <[email-masked]>
Date: Sat, 28 Jun 2003 19:18:30 -0400

------- Forwarded Message

Delivery-Date: Sat Jun 28 19:12:13 2003
Date: Sat, 28 Jun 2003 19:09:10 -0400 (EDT)
From: Sean Donelan <[email-masked]>
To: [email-masked]
Subject: Over three million computers 0wned?
Sender: [email-masked]

http://www.vnunet.com/News/1141901

Trustcorps claims it has scientific and anecdotal resaerch supporting its
conclusion that over three million computers are "owned" by malicious
groups.

On the other hand, Information Risk Management questioned how any one
person could "own" hundreds of computers at any one time.  And systems are
often not "owned" by a single group, but exploited by multiple groups

Like most statistics, the "truth" is probably a little harder to find, and
a little bit scarier.

The FBI estimates a car is stolen every 27 seconds somewhere in the US.
In 2000, FBI Uniform Crime Report statistics showed that 1,165,559 cars
were stolen; with an estimated value of $7.8 Billion.  Police apprehend
less than 15% of all auto thieves.

Unfortunately this computer crime doesn't fit the FBI crime reporting
statistics well.  Vandalism of Property?  Is the cracking of computers
happening more or less often than car theft?

------- End of Forwarded Message

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Mon, 30 Jun 2003 05:46:21 -0700

> often not "owned" by a single group, but exploited by multiple groups

Read 'Honeypots' by Spitzer which describes the honeynet project. It
is not unusual for a hacker to own hundreds of computers. There are 
some hacker groups that require members to own thousands of machines as 
a condition for entry.

The attack tools are automated. An owned machine can be used as a platform
to launch new attacks.

Some of the hard core criminal spam scams originate from clusters of 
hacked machines. This is how some identity theft spams are sent.

The two currencies of the hacking world are stolen credit card numbers
and owned machines. Both are considered fungible commodities.

		Phill