the attack at will from a number of unsuspecting hosts. Zombies can be coded as viruses, worms, or logic bombs. The virus is downloaded when the user opens a non-suspicious looking email, probably a hoax, and would unsuspectingly download the virus onto the workstation. As a result the virus would then use services running in the background of its host machine to then carry out an attack on the destination server or workstation. Worms would act in the same manner, but do not have to be attached to a message to spread to and from the host. The logic bomb could exist as either a virus or a worm but would begin the Denial of Service attack at a predetermined date or the start of an event, rather than relying on the user to execute the malicious program.

Social Engineering and Identity Theft

According to Michael T Simpson, Social Engineering is using an understanding of human nature to obtain information from people, and is the most common form of information security breech. Human nature in the case of social engineering is people’s natural instinct to trust one another. Social engineering can take the form of the “chain letter email” where the attacker states that bad luck or other miss fortun

The Internet in and of itself can be an intimidating network filled with hoaxes and criminals that are out to make what was intended to be an new source of communication freedom, seem like a trap in which any one of us in this world can become an unsuspecting victim to a number of cyber crimes. As these crimes increase, so to does the terminology and definitions that describe them. Viruses are no longer the sole worry of those who look to defend themselves from a computer or information systems attack. There is a laundry list of definitions that the common user needs to be aware of to avoid making themselves and their private computer and information systems vulnerable, which would allow the cyber criminals of today to exploit the many door ways to their Identity Theft crime waves.

Malicious Software Codes

Have you noticed that your computer system is running unreasonably slow? Does it stall when shutting down, or refuse to turn off. Do some of your applications freeze on startup? Are you often prompted to download a Malware removal tool from a websites that had conducted a “Free Courtesy Virus Scan?” If you experience any of these frustrating and sickly computer symptoms, then your workstation is probably the victim of some form of malicious code. Malicious code is the first avenue that an attacker can take on a vulnerable information system. When the common computer user thinks of the Malware, the majority would probably think the words viruses, or spy-ware. Very view would be aware of the other malicious codes that exist, codes such as worms, zombies, logic bombs, software key-loggers, backdoors, or root kits. The US Department of Homeland Security has termed all of these codes as Crimeware, as they are typically used to breech the security of an information technology system, and perform criminal activities such as data compromise or theft. The old trend of attack was to knock down or disable the workstation, which probably forced the user to reinstall the operating system. But with the advent of e-commerce, a new trend of intrusion is emerging.

Cyber criminals now wish to gain as much access to a user’s data as possible and a clean install probably destroys the target. The trend now is to attack with out being detected, which would slow the system down to some degree, but would allow the attack to probe the user’s data, and possibly reveal credit card numbers, account information, and other data which could in turn be used to steal ones digital self. Though the home user is more vulnerable to attack, due to the lack of major corporate funding to implement the advanced intrusion detection/prevention tools of today, the target is shifting to corporate America. According to the US Department of Homeland Security, and the Science and Technology Directorate, cyber criminals with the use of Malware or Crimeware, are targeting more and more corporations to gain access to intellectual property and general business data. Malicious code being Malware or Crimeware is dangerous enough when it is deployed on its own, but when coupled with social engineering, it becomes a dangerous avenue of attack for any unsuspecting user.

Denial of Services

According to Cisco Press Denial of Services is a type of network attack design to bring the victimized network to it knees by flooding the network with useless traffic. This attack is by far the most commonly feared among major corporations in that an attack on its services is an attack on the business model of the company itself. In other words, denying the web service of an online search engine, or the FTP service of online FTP site, causes down time, this in turn translates in to the loss of corporate income. Denial of Service attacks can be deployed using a number of venues. According to Michael T Simpson, the Ping of Death is a modified ICMP packet that is redesigned to violate the maximum ICMP packet size of 65,535 bytes, which is then used to crash or freeze systems as they attempt to respond to the oversize packet. This simple but effective packet can completely deny a Network Interface Card access to the Internet just by the overflow of pings that the host under attack is attempting to respond to.

The Distributed Denial of Services attack can use the malware code known as zombies which have been installed on a multiple home user’s computers, to then attack a single corporate information system. This type of attack is used to fool the Intrusion Detection Systems of the corporate office into logging the IP addresses of the zombie infected host, and hides the true origin of the attack. This has the added tactical effect of the attacked host being digitally surrounded by the attacker’s probes and spoofs, and an attack that can exist for extended periods of time due to the fact that the originator of the attack can reproduce the attack at will from a number of unsuspecting hosts. Zombies can be coded as viruses, worms, or logic bombs. The virus is downloaded when the user opens a non-suspicious looking email, probably a hoax, and would unsuspectingly download the virus onto the workstation. As a result the virus would then use services running in the background of its host machine to then carry out an attack on the destination server or workstation. Worms would act in the same manner, but do not have to be attached to a message to spread to and from the host. The logic bomb could exist as either a virus or a worm but would begin the Denial of Service attack at a predetermined date or the start of an event, rather than relying on the user to execute the malicious program.

Social Engineering and Identity Theft

According to Michael T Simpson, Social Engineering is using an understanding of human nature to obtain information from people, and is the most common form of information security breech. Human nature in the case of social engineering is people’s natural instinct to trust one another. Social engineering can take the form of the “chain letter email” where the attacker states that bad luck or other miss fortune

ion is probably the victim of some form of malicious code. Malicious code is the first avenue that an attacker can take on a vulnerable information system. When the common computer user thinks of the Malware, the majority would probably think the words viruses, or spy-ware. Very view would be aware of the other malicious codes that exist, codes such as worms, zombies, logic bombs, software key-loggers, backdoors, or root kits. The US Department of Homeland Security has termed all of these codes as Crimeware, as they are typically used to breech the security of an information technology system, and perform criminal activities such as data compromise or theft. The old trend of attack was to knock down or disable the workstation, which probably forced the user to reinstall the operating system. But with the advent of e-commerce, a new trend of intrusion is emerging.

Cyber criminals now wish to gain as much access to a user’s data as possible and a clean install probably destroys the target. The trend now is to attack with out being detected, which would slow the system down to some degree, but would allow the attack to probe the user’s data, and possibly reveal credit card numbers, account information, and other data which could in turn be used to steal ones digital self. Though the home user is more vulnerable to attack, due to the lack of major corporate funding to implement the advanced intrusion detection/prevention tools of today, the target is shifting to corporate America. According to the US Department of Homeland Security, and the Science and Technology Directorate, cyber criminals with the use of Malware or Crimeware, are targeting more and more corporations to gain access to intellectual property and general business data. Malicious code being Malware or Crimeware is dangerous enough when it is deployed on its own, but when coupled with social engineering, it becomes a dangerous avenue of attack for any unsuspecting user.

Denial of Services

According to Cisco Press Denial of Services is a type of network attack design to bring the victimized network to it knees by flooding the network with useless traffic. This attack is by far the most commonly feared among major corporations in that an attack on its services is an attack on the business model of the company itself. In other words, denying the web service of an online search engine, or the FTP service of online FTP site, causes down time, this in turn translates in to the loss of corporate income. Denial of Service attacks can be deployed using a number of venues. According to Michael T Simpson, the Ping of Death is a modified ICMP packet that is redesigned to violate the maximum ICMP packet size of 65,535 bytes, which is then used to crash or freeze systems as they attempt to respond to the oversize packet. This simple but effective packet can completely deny a Network Interface Card access to the Internet just by the overflow of pings that the host under attack is attempting to respond to.

The Distributed Denial of Services attack can use the malware code known as zombies which have been installed on a multiple home user’s computers, to then attack a single corporate information system. This type of attack is used to fool the Intrusion Detection Systems of the corporate office into logging the IP addresses of the zombie infected host, and hides the true origin of the attack. This has the added tactical effect of the attacked host being digitally surrounded by the attacker’s probes and spoofs, and an attack that can exist for extended periods of time due to the fact that the originator of the attack can reproduce the attack at will from a number of unsuspecting hosts. Zombies can be coded as viruses, worms, or logic bombs. The virus is downloaded when the user opens a non-suspicious looking email, probably a hoax, and would unsuspectingly download the virus onto the workstation. As a result the virus would then use services running in the background of its host machine to then carry out an attack on the destination server or workstation. Worms would act in the same manner, but do not have to be attached to a message to spread to and from the host. The logic bomb could exist as either a virus or a worm but would begin the Denial of Service attack at a predetermined date or the start of an event, rather than relying on the user to execute the malicious program.

Social Engineering and Identity Theft

According to Michael T Simpson, Social Engineering is using an understanding of human nature to obtain information from people, and is the most common form of information security breech. Human nature in the case of social engineering is people’s natural instinct to trust one another. Social engineering can take the form of the “chain letter email” where the attacker states that bad luck or other miss fortun

n, and other data which could in turn be used to steal ones digital self. Though the home user is more vulnerable to attack, due to the lack of major corporate funding to implement the advanced intrusion detection/prevention tools of today, the target is shifting to corporate America. According to the US Department of Homeland Security, and the Science and Technology Directorate, cyber criminals with the use of Malware or Crimeware, are targeting more and more corporations to gain access to intellectual property and general business data. Malicious code being Malware or Crimeware is dangerous enough when it is deployed on its own, but when coupled with social engineering, it becomes a dangerous avenue of attack for any unsuspecting user.

Denial of Services

According to Cisco Press Denial of Services is a type of network attack design to bring the victimized network to it knees by flooding the network with useless traffic. This attack is by far the most commonly feared among major corporations in that an attack on its services is an attack on the business model of the company itself. In other words, denying the web service of an online search engine, or the FTP service of online FTP site, causes down time, this in turn translates in to the loss of corporate income. Denial of Service attacks can be deployed using a number of venues. According to Michael T Simpson, the Ping of Death is a modified ICMP packet that is redesigned to violate the maximum ICMP packet size of 65,535 bytes, which is then used to crash or freeze systems as they attempt to respond to the oversize packet. This simple but effective packet can completely deny a Network Interface Card access to the Internet just by the overflow of pings that the host under attack is attempting to respond to.

The Distributed Denial of Services attack can use the malware code known as zombies which have been installed on a multiple home user’s computers, to then attack a single corporate information system. This type of attack is used to fool the Intrusion Detection Systems of the corporate office into logging the IP addresses of the zombie infected host, and hides the true origin of the attack. This has the added tactical effect of the attacked host being digitally surrounded by the attacker’s probes and spoofs, and an attack that can exist for extended periods of time due to the fact that the originator of the attack can reproduce the attack at will from a number of unsuspecting hosts. Zombies can be coded as viruses, worms, or logic bombs. The virus is downloaded when the user opens a non-suspicious looking email, probably a hoax, and would unsuspectingly download the virus onto the workstation. As a result the virus would then use services running in the background of its host machine to then carry out an attack on the destination server or workstation. Worms would act in the same manner, but do not have to be attached to a message to spread to and from the host. The logic bomb could exist as either a virus or a worm but would begin the Denial of Service attack at a predetermined date or the start of an event, rather than relying on the user to execute the malicious program.

Social Engineering and Identity Theft

According to Michael T Simpson, Social Engineering is using an understanding of human nature to obtain information from people, and is the most common form of information security breech. Human nature in the case of social engineering is people’s natural instinct to trust one another. Social engineering can take the form of the “chain letter email” where the attacker states that bad luck or other miss fortun

auses down time, this in turn translates in to the loss of corporate income. Denial of Service attacks can be deployed using a number of venues. According to Michael T Simpson, the Ping of Death is a modified ICMP packet that is redesigned to violate the maximum ICMP packet size of 65,535 bytes, which is then used to crash or freeze systems as they attempt to respond to the oversize packet. This simple but effective packet can completely deny a Network Interface Card access to the Internet just by the overflow of pings that the host under attack is attempting to respond to.

The Distributed Denial of Services attack can use the malware code known as zombies which have been installed on a multiple home user’s computers, to then attack a single corporate information system. This type of attack is used to fool the Intrusion Detection Systems of the corporate office into logging the IP addresses of the zombie infected host, and hides the true origin of the attack. This has the added tactical effect of the attacked host being digitally surrounded by the attacker’s probes and spoofs, and an attack that can exist for extended periods of time due to the fact that the originator of the attack can reproduce the attack at will from a number of unsuspecting hosts. Zombies can be coded as viruses, worms, or logic bombs. The virus is downloaded when the user opens a non-suspicious looking email, probably a hoax, and would unsuspectingly download the virus onto the workstation. As a result the virus would then use services running in the background of its host machine to then carry out an attack on the destination server or workstation. Worms would act in the same manner, but do not have to be attached to a message to spread to and from the host. The logic bomb could exist as either a virus or a worm but would begin the Denial of Service attack at a predetermined date or the start of an event, rather than relying on the user to execute the malicious program.

Social Engineering and Identity Theft

According to Michael T Simpson, Social Engineering is using an understanding of human nature to obtain information from people, and is the most common form of information security breech. Human nature in the case of social engineering is people’s natural instinct to trust one another. Social engineering can take the form of the “chain letter email” where the attacker states that bad luck or other miss fortun

the attack at will from a number of unsuspecting hosts. Zombies can be coded as viruses, worms, or logic bombs. The virus is downloaded when the user opens a non-suspicious looking email, probably a hoax, and would unsuspectingly download the virus onto the workstation. As a result the virus would then use services running in the background of its host machine to then carry out an attack on the destination server or workstation. Worms would act in the same manner, but do not have to be attached to a message to spread to and from the host. The logic bomb could exist as either a virus or a worm but would begin the Denial of Service attack at a predetermined date or the start of an event, rather than relying on the user to execute the malicious program.

Social Engineering and Identity Theft

According to Michael T Simpson, Social Engineering is using an understanding of human nature to obtain information from people, and is the most common form of information security breech. Human nature in the case of social engineering is people’s natural instinct to trust one another. Social engineering can take the form of the “chain letter email” where the attacker states that bad luck or other miss fortunes will strike the user who doesn’t pass the message on, and good fortunes await the user who passes the message on to a pre-determined amount of “friends.” Social engineering can also be exploited through a simple telephone call asking for an email address of a fellow employee. A social engineering attack is often just a precursor to more devastating attack. Though the leaking of an email address may not seem important, it may give the attacker a means to introduce countless forms of malicious code into the company’s internal information systems infrastructure.

As a result of these various forms of cyber attacks, a new and terrifying form of cyber attack that has emerged within the last decade. Identity Theft has evolved out of social engineering and malware attacks and now encompasses almost every aspect of information system security exploits. According to the Federal Trade Commission, this form of attack uses information technology to gain access to an individuals data to then reproduce a digital copy of that individual that can then be used to make false purchases with credit cards, pose a an citizen of a nation to which the attacker does not belong, or falsely accuse the Identity victim of a crime that that individual did not commit. The Federal Trade Commission also notes that nearly 8.5 million Americans were the victims of Identity Theft crimes in the year 2006. This form of attack is becoming more frequent and more destructive. According to reports Identity Theft 911 Inc., TJ Max and its subsidiary stores were victims to an Identity theft attack where more than 60 worldwide banks reported fraudulent charges that used the information obtained from this attack. A more dramatic and compelling article from Identity Theft 911 Inc. notes that the biggest banking security breech in American history was used to access 676,000 accounts during and inside attack from employees of Bank of America, Wachovia Bank, Commerce Bank, PNC Bank and the former manager of the New Jersey Department of Labor.

This attack also gives rise to the firm believe that employees, and not the advance cyber terrorist and hackers of today are truly the most dangerous attack in a corporation. A cyber-terrorist who wishes to attack and compromise data must first break in to the corporate network, by pass the Intrusion Detection Systems, avoid honey pots which are designed to fool and entrap attackers, and then locate the most useful and profitable information to make the attack worthy. An employee on the other hand could easily dumpster dive by not shredding documents as ordered, piggy back into a more highly secured area of the office due to their relationships with fellow employees, or shoulder surf passwords or other data by looking over a fellow employee, or a customers shoulder All of these internal attacks are another form of social engineering, which in the banking identity theft case, was used with disastrous consequences. The premise of this attack used a false collections agency under the scam name of DRL which sold its information to 40 law firms to conduct collections on behalf of the shell company using the Social Security numbers, account numbers, and account balances of the stolen data. Many of the targeted New Jersey customers had to close old accounts and open new accounts ranging from the normal checking accounts to some brokerage accounts.

Proper Defenses

What can be done to defend ones self from these advanced digital attacks. Well the most low cost form of defense comes from awareness and a little common sense. Leaving the workstation on even thought it is not in use is almost a sure fired way of being attacked with out the user’s knowledge. If the workstation is not password protected, an attacker can simply sit down and start obtaining data with little or no effort. Preventing a remote password guessing or brute force attack is as simple as shutting down the workstation during non-business or off hours. This will limit the attacker’s time frame in which the actual brute-force attack can be implemented. The easiest manner in which a user can prevent data theft or corruption is powering off the device which stores the data. However, turning of workstations or servers is simply not an option for some corporations. Advanced firewalls and Intrusion Detections Systems are often used as combined forces to deter or prevent attackers.

Firewalls are hardware of software systems that are designed to block specified TCP/IP ports that are used to access services both in and out bound on a network interface. Intrusion Detection Systems are most commonly used to track or log these port attacks base on administrative rules defined by a systems administrator or Chief Information Security Officer. Honey pots, which are information security traps that are designed to be vulnerable to attack t