|
Security Feed
Current events and what they mean to your business.
Nov 17, 2005
Keystroke Logging On the Rise
2005 looks to be a record year for keylogging. According to Reston, Virginia, security vendor iDefense, hackers are expected to release more than 6,000 keylogging programs this year, a 65 percent jump in the amount of software that illegally records every keystroke on a victim’s PC.
The software then reports this information back to the hacker, making it an effective way to snoop out confidential information like user names and passwords for the purpose of identity theft.
The jump in the number of keyloggers is due, in part, to the recent growth in online banking, said Ramses Martinez, director of malicious code operations with iDefense.
But it can also be attributed to a growing international marketplace for stolen credit-card numbers and personal information, he added. "This data can be not only used to compromise an online account, but also to trade it in the underground market."
Keyloggers are often distributed by organized cybercrime groups that send them to unsuspecting victims via e-mail. They are often included with other types of malicious software like spyware or phishing e-mail, iDefense said.
The average cost of a successful keylogging attack is about US$4,000 per victim, iDefense said, citing a survey by National Mutual Insurance Co.
But the financial cost is only part of the equation. These attacks are typically a major drain on a victim’s time, as well. The National Mutual survey found that it took 81 hours, on average, for a victim of this type of fraud to resolve matters.
The use of keyloggers has exploded over the past few years, according to iDefense’s numbers. In 2000, just 300 of the programs were released and the next year the number dropped to 275. The first real spike in the number of keyloggers occurred between 2002 and 2003, when the number of programs went from 444 to 1,230. This year, the total is expected to jump 65 percent, from 3,753 in 2004 to just under 6,200 by year’s end.
Still, enterprise users are only beginning to think about keylogging as a serious threat.
"It is something that we’re going to be looking at next year in an assessment of third-party products and tools," said Joe Nackashi, senior vice president and chief technology officer with Fidelity Information Services Inc. in Jacksonville, Florida. "I don’t see it as a major risk at this particular point, especially in light of the other things that keep you up at night, but it’s something to watch."
IDefense is a unit of VeriSign Inc. and sells security intelligence to government and enterprise customers.
By Robert McMillan - IDG News Service (San Francisco Bureau)
|