It’s all about the bait

Worm on NASA Space Station Underscores Spread of Online Gaming Threats

This story may be breaking news due to the target compromised but the fundamentals of the hack have been around since before the Net was around. The ubiquity and popularity of online games has just made it that much easier to obtain hits on a larger population of targets. Mind you, the value of the results may vary greatly but the numbers raked in more than make up the probability of hitting on a big fish like this one did.

In the earlier days, this would have been done by running a social engineering hack that sold raffle tickets or the like at a location where a can-opener op was planned to gather basic demographics and to be used for further correlation with available information. Then, in conjunction with phone records research targeting dial-in lines as entry points.

In the mid-eighties to early nineties as the proliferation of Computer games started to rise along with the wide-spread use of BBSes by the earlier digital cognoscenti, ant-lion routines that were brutally primitive and prone to crashing started to show up in pirated copies of popular titles. These routines were a serious PITA but the application was usually VERY targeted towards a specific group that you wanted some payback from. The groups were usually not too sophisticated where they could identify the hack but savvy enough to know where to get the warez and how to run them. Back then the platforms of choice were the Atari and Apple platforms with no real efforts that I can recall being aimed at Commodore 64s or Amigas. The returns were usually in the form of bragging rights in that you could prove that you managed to drop code on someone else’s machine. The ability to use the victim to help proliferate the infection were rather limited but it did happen. Especially true in the case of Apple based hacks since a number of the old School Boards used to run II’s and IIe’s.

Once the PC started to gain traction and VGA started to get some following, the shift in focus began to that platform. This made the spread of ‘malware’ (which we usually just called gags) much more prevalent. Still limited as the sophistication of the users on that platform were pretty limited and the entry cost of such equipment made it unlikely for less endowed users to get onto one. Still, I can remember joke "Formatting your Hard Drive" batch files making the rounds at the various offices that I worked in.

Now, today with the ridiculously low cost of entry into a fairly decent machine, coupled with relatively easy access to broadband, the jokes and gags of the past have seen their new evolution into the next generation of underground business applications. And it is only going to get worse. I would caution ANYONE who does not run new software in a sandbox to AVOID downloading code that does not come from a ‘trusted source’ (you be the judge of that!). I usually stick to local gaming on my PCs and avoid any kind of online gaming that needs me to download code. I really have to have a high level of trust before I do that, and even then, I will usually run any new code in a VM for a while before I let it out of the sand box.

Now if I could just teach this same lesson to the girls…