Imagine life without electricity. Although most of humankind has managed just well with- out electricity, its loss would certainly impact society most profoundly. Now imagine that hundreds of thousands of criminals all over the world could make a quick profit by doing something that-little by little-killed the electric infrastructure. And that politically adver- sarial individuals and governments could speed up this looming catastrophe if they wanted to. It is terrible to imagine. And yet, it is a very real threat-although to the Internet.
Criminals have an array of ways to abuse the Internet. Most commonly in order to make money: Internet crime is both profitable and safe for criminals to engage in. Online crime scales exceptionally well, and is fast to perpetrate. It is often difficult to identify abuse, and almost always difficult to track down the criminals. And most of the time, offenders who are detected and blocked simply vanish, only to resurface with a new pseudonym shortly thereafter. While financial abuses are difficult to block and track, politically motivated abuse is yet harder to control. This is since politically motivated attacks do not involve taking money out of the system-which is often the hardest and riskiest part of online crime.
Any disruptions to the Internet would send shock waves through society. It would affect telephony; banking; how corporations do business; how the energy grid is controlled; and how many of us make a living. It would disrupt government, media, and military. It would impact our entire infrastructure-including our trust infrastructure.
Like a bridge that may tolerate increasing strains untilit comes crashing down, the Intemet may hold up well until the tipping point is reached. We must not wait for that moment. We must understand the problems, and defend against them-before they develop,if possible. We must understand how things can go wrong, and how we can engineer things better.
This book describes the problems the Internetis facing, and gives examples of some possi- ble solutions. You do not need a deep technical background to understand the general nature of these. At the same time, each chapter has in-depth material for readers who do not want to stop at understanding the general concepts, but who want to know exactly how things work.
I hope that the insights that you will gain by reading this book will help you make decisions or designs-depending on who you are-that will help rescuing the Internet from the assault it is under.
Table of Contents
Part Ⅰ The Problem
Chapter 1 What Could Kill the Internet? And so What?
Chapter 2 It is About People
2.1 Human and Sociallssues
2.1.1 Nigerian Scams
2.1.2 Password Reuse
2.1.3 Phishing
2.2 Who are the Criminals?
2.2.1 Who are they?
2.2.2 Where are they?
2.2.3 Deep-Dive： Taking a Look at Ex-Soviet Hackers
2.2.4 Let's try to Find Parallels in the World we Live in
2.2.5 Crime and Punishment?
Chapter 3 How Criminals Profit
3.1 0nline Advertising Fraud
3.1.1 Advertising on the Internet
3.1.2 Exploits of Online Advertising Systems
3.1.3 Click Fraud
3.1.4 Malvertising： Spreading Malware via Ads
3.1.5 Inflight Modification of Ad Traffic
3.1.6 Adware： Unsolicited Software Ads
3.1.7 Conclusion
3.2 Toeing the Line： Legal but Deceptive Service Offers
3.2.1 How Does it Work?
3.2.2 What do they Earn?
3.3 Phishing and Some Related Attacks
3.3.1 The Problem is the User
3.3.2 Phishing
3.3.3 Man-in-the-Middle
3.3.4 Man-in-the-Browser
3.3.5 New Attack： Man-in-the-Screen
3.4 Malware： Current Outlook
3.4.1 Malware Evolution
3.4.2 Malware Supply and Demand
3.5 Monetization
Chapter 4 How Things Work and Fail
4.1 Online Advertising： With Secret Security
4.1.1 What is a Click?
4.1.2 How Secret Filters are Evaluated
4.1.3 What do Fraudsters Know?
4.2 Web Security Remediation Efforts
4.2.1 Introduction
4.2.2 The Multitude of Web Browser Security Mechanisms
4.2.3 Where do we go from Here?
4.3 Content-Sniffing XSS Attacks： XSS with Non-HTML Content
4.3.1 Introduction
4.3.2 Content-Sniffing XSS Attacks
4.3.3 Defenses
4.3.4 Conclusion
4.4 Our Internet Infrastructure at Risk
4.4.1 Introduction
4.4.2 The Political Structure
4.4.3 The Domain
4.4.4 WHOIS： Ownership and Technical Records
4.4.5 Registrars： Sponsors of Domain Names
……
Part Ⅱ Thinking About Solutions
References
Index
