Hacker attacks on firms are rising
Source: Taipei Times
Date: November 24, 2003
CYBER-TERRORISM: Most computer attacks go unreported, and almost 98 percent of cases are discovered purely through chance, while companies lose millions of dollars.
Hacker attacks on company computer systems are increasing. Specialists say that around 98 percent of cases are discovered by chance. The number of unreported cases is believed to be high.
Security adviser Christoph Fischer says that, by the time the intrusion has been discovered, heavy financial damage has already been caused.
Sandra Frings, of the Fraun-hofer Institute's IAO branch say crime fighting is faced with completely new challenges which it is having trouble adjusting to.
Many firms, after finding they are the victims of a hacker attack, are at a loss about how to get on the trail of the hackers and bringing them to book, she adds.
The IAO is involved in a EU-backed project to draw up guidelines to help firms.
One specialist says the guidelines will be aimed at helping firms to recognize criminal Internet transactions and to cope with them.
Emphasis is given to working with prosecutors, police and information technology (IT) security specialists. The central issue is securing electronic evidence and turning it into legally usable evidence.
Fischer says a classic example of cyber crime is when one firm gains access to the lowest acceptable price a construction firm is prepared to tender for a project, and then underbids it to get the order.
Frings believes that, aside from the search for technical solutions, police and prosecution must become more aware of the problem. Many police officers were not in a position to technically assess computer log files. Sometimes, there was a lack of understanding about the damage caused by the attacks, she adds.
This is also Fischer's experience. He says that justice officials can much better understand when files are stolen than when a data bank is downloaded with the click of a mouse.
"It is not that the feeling for Internet crime is missing, more that there is no compulsion to act quickly," Fischer says.
Bureaucracy acts far too sluggishly, sometimes weeks, he says. This gives time for the hacker to delete clues, and firms time to delete them as well, accidentally. Fisher proposes that a prosecution unit be set up to deal with high-tech crime.
Peter Klee, a specialist with IBM Global Services, says the number of unreported cases is "gigantic."
This is because, in many cases, firms prefer to deal with attacks internally so weaknesses in their system are not made public and to avoid a consequent harm to their reputation.
"Successful hackers often do not use unusual techniques. They simply use tricks to persuade employees to reveal passwords," Klee said.
Physically finding the whereabouts of hackers is almost impossible, the specialists agree.
They are nimble at eliminating traces, they operate from other countries, and work more quickly than their pursuers.
Frings says that getting on a trail of the hackers by technical means is one thing. Arresting them and bringing them to book is another.
Fischer says many cases do not even come before the courts because the justice system is overloaded. Some firms withdraw charges are deal with the problem internally.
The EU guidelines being prepared are also designed to assist to cope with different laws in different countries.
Original article
^macro[showdigestcomments;^uri[];Hacker attacks on firms are rising]