NESTA Crime Online - University of Brighton Repository

origin or signature or a presence on a blacklist, 188 is not enough to keep pace with the
diversification and complexity of advanced web techniques being used by the
criminals. 189
Technological cat and mouse game
The dynamics between the crimeware producers and the IT Security companies have
been often described as a constant game of cat and mouse, since cybercriminals do not
stand still when one of their avenues for distribution is closed. These dynamics were well
represented by an example given by one of our interviewees, from an IT security
company. One of the company’s services is managing their customers’ spam. But they
face the increasing sophistication of spammers.
Initially spammers used to disguise words with spelling mistakes to overcome the filters.
When the IT experts realised this and devised ways to counter it, the spammers started
sending messages embedded in a graphic instead of plain text, since they are harder to
scan for spam filters. When this was detected and dealt with, spammers rapidly started
using animation graphics to confuse the filters. They always seemed to be several steps
ahead of the IT experts in security firms.
Source: Interview Simon Heron, London 10 th November 2008.
Criminals are also cleverly exploiting vulnerabilities in websites to plant malicious code in
newly-discovered browser exploits 190 to infect the computers, crash the network or
computers, and to solicit and steal data. According to a survey conducted by a large
multinational IT company 94 per cent of all browser exploits in 2008 occurred within 24
188 Blacklist detection is based on the detection of viruses through a black list constructed on the basis of
malicious code threats that have been identified in the past. However, this method has been largely criticized
by its limitation to keep pace with the volume and variations of malware released every hour.
189 Interview with Tim Warner, Finjan, 17 th November 2008.
190 A browser exploit is a piece of code that exploits a software bug (flaw, failure or fault) in a web browser
such that the code makes the browser do something unexpected, including crash, read or write local files,
plant a virus or install spyware. A web browser is a software application, which enables a user to display and
interact with text, images, videos, music, games and other information typically located on a web page.
Examples of web browsers are Google, Mozilla Firefox and Internet Explorer.
Page 63