2007-05-16 22:40:40 - Like a strange international arms bazaar, identity theft, credit cards, bank accounts, passwords, fraud, pshing, denial of serviceall of this and more are for sale on the Internet for those who wish to wreak havoc on the Net.

Are you a bad guy? Do you have malice in your heart? Want to shut down somebody's website? Rip someone off? Steal credit card info? Terrorize a company or organization? If so, you're in luck because now computer terrorism is for sale.

‘Cyber-crime has gone completely out of control,' says Internet security expert Ryan Sherstobitoff. ‘You no longer

have to be a professional hacker or programmer in order to wreak havoc on the Internet. Now all you have to do is have a pocketbook and be willing to spend a little money. Internet terrorism is now for sale.'

The situation is very similar to international arms sales. It doesn't matter who you are or who you represent. It doesn't matter what your political beliefs are or what your agenda may be. If you want it, it's yours for a price. The difference is that the cyber-crime tools available on the Internet are not all that expensive.

‘Many of these cyber-crime sites exist in other countries where there are virtually no laws to stop or restrict their activities,' states Sherstobitoff. ‘As a courtesy to potential customers, the sites are often in more than one language - English and Russian for example. And oftentimes, there are price quotes right there on the page for whatever activity you might want to do. It's really surreal to see that kind of thing to tell you the truth.'

One site selling malware, for example, brags of the following:

• Attacks and infects unlimited amount of files
• small size - 1.62K
• Will get past firewalls (author cites several well known firewalls that malware will get past)
• statistics on effectiveness of attack
• Will self deletes from system after attack is accomplished
• Will not be detected by antivirus software (author cites several well known antivirus software programs that can't detect the malware)
• Full customer support
• Price - $60 U.S.

Sherstobitoff, who works for Panda Software (www.pandasoftware.com), acknowledges that the implications of this situation is both alarming and far-reaching.

‘Just imagine criminals and terrorist having total and free access and all and any tools that they might want in order to carry out their evil plans,' he says referring to the anonymity and ease-of-access to the Internet. ‘Bombs, lock picks, spy gear - you name it. It's counterpart now exist on the Internet and it does not take a whole lot of ingenuity to find these sites and utilize their services. The big question is how exactly is this going to impact the world at large? Right now, nobody really knows.'

What is also not known by the general public is that antivirus and Internet security software companies are struggling to keep up with the onslaught. Criminals have been purposely flooding the Internet with as much malware as they can in an attempt to overwhelm the system. By and large, this strategy has been successful.

When malware and Internet attacks are unleashed somewhere in the world, these attacks have to be analyzed and reverse engineered. Most antivirus companies must manually inspect the code, discover what it is doing (is it stealing information, constantly morphing so it can't be discovered, and about a thousand other possibilities), come up with a solution, and then disseminate that solution to the world in order to stop the attack. That takes time, and time is the criminal's best friend.

‘Panda is fortunate in that we have automated the process so that we can keep up with the deluge,' explains Sherstobitoff, ‘but there is another big problem going on. In addition to the volume of malware that is being released, the malware itself has changed in that it is extremely hard to detect. As a result, many computers are infected, and the users don't even know it.'

A specialist who is able to decode viruses and malware can handle perhaps 20 to 30 malicious programs a day. According to one Internet security executive, his company used to process an average of about 300 pieces of malware a month. That figure has exploded to some 2000 to 3000 pieces of malware a day. Until the malware is processed and a patch created, all computers in the world are completely vulnerable to that particular Internet invader.

‘The number of Internet attacks is increasing,' states Sherstobitoff. ‘Now, with computer malware and Internet terrorism basically for sale, who knows how high those numbers will climb.'

Terrorism and the potential to shut down websites, companies, and organizations through targeted Internet attacks is now a reality for a far larger group of people. Potential terrorist and extortionist now have the ability to purchase vast bot networks and control thousands - if not millions - of computers. These computers will do the bidding of whomever controls them - almost certainly without the knowledge of the user.

‘Terrorism and extortion are becoming much more commonplace on the Internet,' says Sherstobitoff. ‘It is fairly easy to overwhelm and shut down a website. There are a variety of tactics available to the would - be terrorist or extortionist, but the bottom line is that a bad guy can threaten to shut down a company or business if they don't do what the bad guy wants. Those demands could be political, financial, or whatever else might be on the agenda.'

The target of terrorism could also be the government. Government computer networks use the same antivirus vendors as the public sector. Therefore, if the public is vulnerable to malware attack, so is the government. Additionally, governmental system at the state and local level tend to be more vulnerable than the federal government computer systems. Should a terrorist want to shut down a city's computer network while simultaneously carrying out some other kind of attack to increase the ensuing chaos, this is a very real possibility.

‘Our society is so incredibly reliant on computer technology and the Internet,' says Sherstobitoff. ‘The benefits, of course, are incredible. But, most people don't realize just how delicate and fragile our hi-tech society is - and how easily everything could come crashing down if we as a society don't recognize the problem and take effective action. I hate to say it, but with terrorism basically now for sale, the stage is now set for some real catastrophes.'

For more information about computer terrorism or Internet security contact Ryan Sherstobitoff at ryans@pandasecurity.com .