So really...what are the chances of a software based approach to protecting the Holy Grail known as PIN's being compromised. There's only 450,000 per day. It's not like it's 165 Million per year. Thank God were only talking about 164,250,000 per year. The good news (NOT) is the number of SQL attacks appear to be slowing down. (insert sarcastic smile here)
After all, in the first two quarters of 2008, the number was 5000 per day. By midyear, the number had grown to 25,000 a day. By late fall, attacks climbed to 450,000 daily. So by this time next year, there will be hardly anything to worry about...
To put into perspective the odds that a software based approach to protecting your PIN will succeed, I bring you the following story from Robert Siciliano, a security analyst and regular contributor to the Finextra Blog. Here's the link: His website is IDTheftSecurity.com
Finextra Blog - Robert Siciliano
There is just no end to the vulnerabilities that computer users face. SQL injection. SQL is abbreviation of Structured Query Language. Pronounced ”Ess Que El” or ”Sequel” depending on who you ask. Editor's Note: "Sequel" seems more apropo, since they'll be more breaches in the future than there were Rocky movies..
IBM Internet Security Systems discovered 50% more web pages infected in the last quarter of 2008 than in the entire year of 2007.
The infection is called a SQL injection. According to Wikipedia, a “SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application.”
In other words, a SQL injection is a virus or bug that effects an application that is not properly coded or secured. There are many different configurations of various software used to build and run a website. An example would be the common Wordpress blog platform that many use and that has been found to be vulnerable. This is just one of hundreds of applications that can be hacked in this way.
In 2005, a now defunct 3rd party payment processor called CardSystems suffered a SQL injection, compromising a reported 40 million credit cards. Editor's Note: I remember CardSystems. Pay By Touch bought CardSystems! Pay By Touch is now defunct too. Food for thought...Coincidentally Pay By Touch also bought ATMDirect (now Acculynk) Hmmm, wonder if there's a connection...either to the SQL attack or being defunct in the future.
Since that time, criminal hackers have multiplied their efforts. SQL injections have evolved in their purpose and sophistication. Originally meant as a tool to attack a merchants database and steal data, the attack was reconfigured last summer to install viruses on users’ computers that contain a remote control component.
Matt Chambers with Corporate IT Solutions says, “Web applications are one of the most outward facing components a corporation contains in its network design, and one of the least protected. Applications typically take input information and send it to a database for storage and processing. We interact with these kinds of applications every day, whether its a signup form or a login page for a favorite networking site.”
The attack on the user’s PC is simple. This type of attack is often called a “drive-by,” because sometimes all the user needs to do is surf the site. Many of the attacks take place during common web tasks such as watching videos, listening to music or downloading files.
The unsuspecting PC user surfs an infected site and bam, code is injected onto their PC and they are infected. Their PC becomes part of a “botnet,” which is a robot network of computers specifically designed for hacking.
Bots, the infected PCs, are also known as zombies. Zombies, as a result of the SQL injection, generally have a virus installed that gives the hacker control from anywhere in the world. The “botnet” can consist of 10 PCs, 10,000 PCs or into the hundreds of thousands. Studies show there are potentially millions of zombies globally, all part of numerous botnets.
Lax security practices by consumers and small businesses are giving scammers a base from which to launch attacks.
Botnet hackers set up phishing websites targeting well known online brands. They send junk mail emails and install redirection services to deliver viruses, malware and keyloggers.
USA Today reports IBM Internet Security Systems blocked 5000 SQL injections every day in the first two quarters of 2008. By midyear, the number had grown to 25,000 a day. By late fall, attacks climbed to 450,000 daily.
The key to identity theft protection and preventing your computer from becoming a zombie is to engage in every update for every browser and media player that you use, keeping your operating system updated and using anti-virus software such as McAfee Total Protection.
Identity Theft Speaker Robert Siciliano discusess SQL injection here
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uqxA6O_C9Zczy0OzvkfS-dmRZ5dR4rrMsgCIpCgZrf8B6sb98_H4A5BY02zHMQwO7AC_4obpWmFZeKNEz5eyPcRvQ6NEA4n41y-YVvEYd2jO5WhVYpf_qnOE9AG8B43R7lC4Ffqz-rie3sirkxA-0=s0-d)
