What is the philosophy and mindset of the modern cybersecurity attacker (or “hacker,” if you prefer)? Hacking is a financially lucrative activity, everyone knows that by now. So the motivations for online attacks seem to be changing, just as everything around us is changing.
What are the current motivations for attacks?
Motives are evolving in tandem with the evolution of hacking groups. From individual script kiddies, we now see organized groups with skills, with government funding or funding from professional activities, often linked to other illegal activities.
The motivations for the attacks were described in 2011 by Richard Clarke, a former White House cybersecurity adviser, when he coined the acronym CHEW. The initials stand for Cybercrime, Hacktivism, Espionage, War (cyber).
Cybercrime: Criminal attacks are usually motivated by money. Their number is increasing daily and they take place in all countries around the world. The skill level of these groups ranges from basic to quite advanced.
Hacktivism: Hacktivists are usually motivated not by money, but by a desire to protest or seek revenge against an entity. As with criminals, there are a large number of hacktivist groups. However, most of these groups only have basic skills. A few “stand out” and have individuals with advanced skills.
Espionage: These attacks are aimed at obtaining secrets in support of national security, for economic gain, or both. A growing number of countries have the ability to use cyberattacks for espionage. There are fewer groups associated with these activities, and their skills range from advanced to very advanced.
War (cyber): The fourth, and arguably the most brutal type of attack: The motive is the desire to destroy the adversary. A growing number of countries have the ability to use this form of "politics by other means."
As you can see, the motivations of hackers are changing. But let's take a look at the economics of hackers.
The economic conditions that favor hackers
We have a simple question: Why are financially motivated cyberattacks on the rise?
The answer is equally simple: because there is money.
Based on some recent estimates, an exploit kit can yield over $25,000 per month or more if it has proven to be particularly effective.
The Dark Web is known to be filled with botnets – compromised computer systems available to launch attacks – that can be rented for $50 a month.
In many cases, however, hackers want to be DIYers, meaning they want to launch their own standalone attacks rather than exploit existing botnets. This can be easily done with tools that start at $20. These tools include the base code to target multiple computers, which then become a botnet for the hacker in question.
There are a few motivating factors here as well. First, the downside to botnets available for rent is that many of them are known to the security industry and as a result the IP address of many bots has been added to blacklists and other databases that block access. The other big incentive given to hackers is that they are looking for ways to build their own botnet business, which they can then rent out on the Dark Web.
This approach saves them an additional cost in opening their business: bandwidth, which is free. Although from 2010 to 2015, the cost of bandwidth has decreased by almost 90 percent, individual companies typically pay $10,000 a month for 1 Gbps.
Information security professionals believe the damage that can be caused by these tools is enormous. Estimates that we have seen from time to time from security company research indicate that the economic impact of these attacks can reach an average of $100,000 per attack. However, this amount varies, depending on the company's activity. For example, in the financial services industry, which is very prone to these attacks, the damage that can be caused can reach $10 million.
There are many factors that go into estimating the cost of damages. The immediate loss of revenue is what most people think of. But there are also the longer-term impacts, such as damage to reputation and brand name, loss of customer trust, breach of agreements and many more because in addition to the financial losses, there are always the emotional or moral impacts.
Consider the case of some of the recent attacks on hospitals, where systems and data essential to the clinical care of patients were essentially held hostage for ransom. The financial cost of $17,000 in Bitcoin that the criminals demanded was truly a small price to pay for a hospital that prioritized the lives of its patients….
Let's go upside down now: The business economy
We've looked at the financial incentives of hackers. But what about the companies that invest in the internet? Do they have a financial incentive to secure their customers and their data?
I think the question has already been answered, but how many of the companies are actually concerned and investing in security and not just in the pursuit of profit?
An advanced security strategy is to leverage automation capabilities to fight bots with bots.
Of course before we get there, effective bot protection requires advanced detection and mitigation capabilities.
Criminals are now experts at spoofing IP addresses to avoid being blocked on the IP addresses they use.
It should be mentioned that in addition to the various techniques available from various security companies, what really needs to change is the philosophy before the tactical steps.
And the philosophy in today's internet cannot be economy and cuts to security. Promoting security, exploring and implementing advanced technologies comes at a cost, and businesses and organizations that try to get by with half measures will eventually have to learn that it is absolutely necessary.
But to learn it, they will have to pay tuition, which is also expensive.
