In which I overuse the prefix "cyber"

This week's New Yorker has a short-ish piece on cyber extortion rackets and the people who fight them. It's an interesting read, as this isn't the sort of thing that normally gets press coverage–the cyber extortionists often target disreputable businesses operating outside of American territories (online casinos in the Caribbean, for example) who are unlikely to contact the authorities (and which authorities, anyway?) and report the shake down.

The basis for the extortion is the threat of launching an all-out distributed denial of service attack against a company's web site. The criminals, often part of organized crime rings in former Soviet countries, have no qualms about backing up their threats with attacks; a single day's web site outage can result in enormous losses for a company whose entire business is web-based.

The interesting thing here is that in order for these cybermobsters to pull off an attack on a scale large enough to cripple a decently protected web site, they need a large stable of "zombie" computers to do their bidding. Zombie computers are harvested by planting pieces of malware on ordinary individuals' Windows computers, perhaps as a result of downloading and running an infected program or perhaps by exploiting security flaws on a machine that doesn't have all of its security patches. I used to be a very rabid Mac evangelical, and I still am to some extent, but I think more than anything people need to stop running Internet Explorer (which has had a number of serious security flaws over the past few years) and start running Firefox on their Windows boxes. (Firefox is not without security vulnerabilities, but they tend to be patched in a timely manner, and really haven't been a target of exploitation [yet].) If you're still running Internet Explorer, especially if you're not up to date on your Windows security patches, you're directly (if unwittingly) contributing to cybercrime.